WordPress Vulnerability Monitoring for Agencies Managing Many Sites
At fifty sites the security question changes shape entirely. One site is a thing you look after. Fifty sites is a queue, and the binding constraint stops being whether you can fix a vulnerability and becomes whether you can find out which of the fifty has it, before the five-hour median exploitation window closes on the one you did not check.
The economics change too, and more sharply than most agencies model. A $149-per-site plugin is $7,450 a year across fifty sites. An unlimited-site tool at $199 a year is $199. That single difference decides this category, and it explains why per-site pricing and unlimited pricing are not variations of one market but two different products. This article covers both.
Verified August 2026. Prices confirmed against vendor pages.
What changes at scale
Detection becomes the bottleneck. Fixing a vulnerable plugin takes two minutes. Knowing that eleven of your fifty sites run it, and which version, is the work. Without a central inventory you are checking sites individually, which does not scale past about a dozen and does not happen reliably past about five.
Alert volume becomes hostile. With 11,334 vulnerabilities disclosed across the ecosystem in 2025, up 42% on the year before, a monitoring tool that alerts on everything produces a stream nobody reads by week three. The value of a tool at this scale is as much in what it suppresses as in what it reports.
And you now owe someone an answer. A client asking “are we affected by the thing in the news” needs a response today, with evidence. That is a reporting requirement, not a security one, and tools differ enormously in whether they can produce a per-client statement without you assembling it by hand.
The 6 options compared
1. MainWP
The best economics in this comparison and the reason to read the licensing before the feature list. The dashboard and child plugins are free from WordPress.org, and every tier, including the free one, supports unlimited sites.
Paid plans are $199 a year, $29 a month, or $599 once for a lifetime licence, unlocking more than thirty Pro add-ons and priority support. Read those numbers against a per-site security plugin: across fifty sites the lifetime licence costs less than one year of a $149 per-site product on four sites. It is self-hosted, meaning your dashboard runs on your own WordPress installation and your client data stays with you, which matters to agencies with data processing commitments. The trade is that you maintain the dashboard, and that it is a management platform with security features rather than a security product with management features.
- Price: Free core; $199/yr, $29/mo, or $599 lifetime
- Sites: Unlimited on every tier, including free
- Best for: Agencies of any size wanting to own the platform
- Watch out for: You host and maintain the dashboard yourself
2. Patchstack
The vulnerability intelligence specialist, priced for exactly this audience. The Developer plan is $69 a month, or $828 a year billed annually, with additional capacity at $12.50 a month per five sites and three team seats included; extra seats are $24 a month each.
What you are buying is speed of intelligence rather than breadth of management. It claims 12,000 unique mitigation rules and protection up to 48 hours ahead of competitors, which against a five-hour median time to first exploitation is the difference that matters. For an agency the model works because virtual patching arrives automatically across the portfolio without anyone logging in, which converts the detection bottleneck into a non-problem for known vulnerabilities. Team seats being a separate line is worth noting when pricing for a group rather than a solo operator.
- Price: $69/mo Developer; +$12.50/mo per 5 sites; seats $24/mo
- Sites: Metered, scaling in blocks of five
- Best for: Agencies where response speed is the promise to clients
- Watch out for: Seats and site blocks both add up
3. WPScan
A vulnerability database with an API rather than a dashboard, which makes it the right choice for agencies that would rather build their monitoring into tooling they already have. The CLI scanner is free to everyone, and a free Researcher tier provides API access capped at 25 calls a day for non-commercial use.
That cap is smaller than it sounds once you understand the unit: an average WordPress site consumes about 24 API requests for a full check, one for core, roughly twenty-two for plugins, one for the theme. So the free tier is approximately one site per day. Commercial use requires a paid licence, and Enterprise pricing is quoted by site count, with instant email alerts, webhooks into Slack, CVSS scores and proof-of-concept data. For a small agency, the free Jetpack Protect plugin uses WPScan data and is a reasonable way to get the intelligence without the integration work.
- Price: Free CLI; free tier 25 API calls/day; Enterprise quoted
- Sites: Effectively one per day on free; unlimited on paid
- Best for: Agencies integrating checks into their own tooling
- Watch out for: ~24 API calls per site makes the free tier tiny
4. Wordfence Central
A hosted dashboard aggregating Wordfence installations across sites, which is genuinely useful and does not change the underlying economics. Wordfence Premium is $149 a year per site, so the licence cost scales linearly with your portfolio.
Across ten sites that is $1,490 a year; across fifty, $7,450. Compare that with MainWP’s $599 lifetime and the structural difference in this market becomes obvious. Where it earns its place is the free version, which many agencies already run on client sites: Central lets you see all of them in one view without paying anything, which is a real improvement over logging into each. Remember that free Wordfence receives new firewall rules and malware signatures 30 days after Premium, so a Central dashboard over free installations is monitoring rather than protection.
- Price: Central dashboard itself; Premium $149/yr per site
- Sites: Per-site licensing, linear cost growth
- Best for: Agencies already standardised on Wordfence
- Watch out for: $7,450 a year at fifty sites on Premium
5. MalCare multi-site tiers
Priced in five-site bundles that make the per-site cost legible: Protect at $99 for one site or $299 for five, Repair at $299 or $899, Fortify at $499 or $1,499. That works out at roughly $60 a site a year for virtual patching at the Protect tier.
The reason an agency might accept per-site pricing here is remediation. Repair includes instant malware cleanup with a 24-hour expert response, and Fortify a six-hour response with unlimited manual fixes and host suspension recovery. If your agency’s exposure is that a client site gets compromised on a Friday and you personally spend the weekend cleaning it, buying a response time is buying your weekend back. Price it against what an incident actually costs you in hours rather than against the cheaper monitoring-only tools, because they are not solving the same problem.
- Price: $299/yr for 5 sites Protect; $899 Repair; $1,499 Fortify
- Sites: Five-site bundles, per-site economics
- Best for: Agencies buying a cleanup SLA rather than alerts
- Watch out for: Protect alerts only; cleanup starts at Repair
6. A plugin inventory in a spreadsheet
Free, unglamorous, and the thing that actually answers the client’s question. One row per site, one column per plugin, updated when you onboard or change something.
When a vulnerability makes the news, you filter a column and know in ten seconds which clients are affected and which are not. No dashboard does this faster, because a dashboard has to be logged into and interpreted, and no tool tells you about the site you inherited last year and forgot to add. The inventory is also what makes standardisation visible: an agency running the same eight plugins everywhere has a fundamentally smaller problem than one running forty different ones, and until you list them you cannot see which you are. This does not replace monitoring; it is the thing that makes monitoring actionable, and it is the first thing to build.
- Price: Free
- Sites: As many as you maintain the list for
- Best for: Answering “are we affected” in ten seconds
- Watch out for: Goes stale unless updating it is part of onboarding
Cost at fifty sites
| Option | Licence model | Cost at 50 sites | Virtual patching | Cleanup |
|---|---|---|---|---|
| MainWP | Unlimited sites | $199/yr or $599 once | Via add-ons | No |
| Patchstack | Blocks of five | $828/yr plus site blocks | Yes, 48h ahead | No |
| WPScan | API, quoted | Enterprise quote | Data only | No |
| Wordfence Premium | Per site | $7,450/yr | Yes, real time | Higher tiers |
| MalCare Protect | Five-site bundles | ~$2,990/yr | Yes | From Repair |
| Spreadsheet | None | $0 | No | No |
Alert fatigue, and reporting to clients
An alerting system nobody reads is worse than none, because it produces the feeling of coverage without the fact of it. Four rules keep the stream survivable at portfolio scale.
- Alert on severity, digest the rest. Only 17% of 2025’s vulnerabilities were rated high severity. Route those to a channel that interrupts you and everything else to a weekly summary.
- Alert on your stack, not the ecosystem. A vulnerability in a plugin none of your clients run is news, not work. Filter against your inventory before it reaches a human.
- Route to a channel, not an inbox. Slack or similar, with a rota, so an alert arriving while you are on holiday reaches somebody rather than sitting unread.
- Review what you ignored, monthly. Alerts you consistently dismiss are either misconfigured or genuinely irrelevant. Either way, fix the rule rather than continuing to dismiss it.
On client reporting, the useful artefact is a short monthly statement per site: what was updated, what was found, what was fixed, and what remains outstanding with a reason. It takes minutes to generate from a central dashboard and it does two things at once. It gives the client evidence that the retainer buys something, and it gives you a written record of the risk you flagged and they declined to fund, which is the conversation you will eventually need to have had in writing.
Related guides
Frequently asked questions
Per-site or unlimited licensing?
Unlimited above roughly ten sites, almost without exception. The crossover arrives fast: at $149 a site, ten sites already cost more than MainWP’s lifetime licence.
Should I bill security separately?
Yes, as a named line in the retainer. Clients who see a security charge understand there is something to decline; clients who do not, assume it is included and hold you responsible anyway.
Can I standardise plugins across clients?
As far as possible, and it is the highest-leverage thing an agency can do. Eight plugins across fifty sites is a manageable surface; forty is not, and plugins are 91% of disclosed vulnerabilities.
Should updates be automatic on client sites?
For most plugins, yes, with tested backups and a monitoring check that the site still loads afterwards. The alternative is a weekly cadence losing to a five-hour exploitation median.
What happens when a client refuses to pay for security?
Put the recommendation and their decision in writing, and price the incident response separately so the cost of declining is visible in advance rather than argued about afterwards.
Is a management dashboard enough on its own?
No. It gives you inventory and update control, which solves the detection bottleneck, and it does not give you vulnerability intelligence or virtual patching. Most agencies end up with one of each.
The verdict
Start with MainWP. The core is free, every tier covers unlimited sites, and $599 buys a lifetime licence. Against $7,450 a year for fifty per-site Wordfence Premium licences, the licensing model is the entire decision.
Add Patchstack at $69 a month for the vulnerability intelligence and virtual patching a management dashboard does not provide, with protection arriving up to 48 hours ahead of alternatives.
If your real exposure is spending weekends on cleanups: MalCare Repair at $899 for five sites, where you are buying a 24-hour expert response rather than another alert stream.
And build the spreadsheet this week. One row per site, one column per plugin. When the next high-severity vulnerability lands, that file answers your clients in ten seconds, and no subscription does it faster.
