Find the gaps before
a client — or an incident — finds them for you.
Eight categories, one score per site. A structured way to find outages, security exposure, lost margin and client surprises hiding across a WordPress portfolio.
Last reviewed 17 August 2026 by the Stack2 team — we run our own agency hosting operation the same way.
The gaps that cause outages are rarely the ones you're watching.
A site nobody's looked at in months is where the outdated plugin, the ex-employee's still-active login, and the backup that quietly stopped running all live. An audit surfaces them on your terms, not the client's.
Run each site through these eight checks.
| Category | What to check |
|---|---|
| Ownership | Client, internal owner, service tier, renewal date and commercial scope. |
| Infrastructure | Host, domain/DNS owner, SSL, PHP version and production/staging status. |
| Access | Admin ownership, MFA, shared credentials, former-team access and recovery path. |
| Maintenance | Core/plugin/theme status, update policy, exclusions and rollback capability. |
| Protection | Backup recency, off-site status, retention, restore test and uptime monitoring. |
| Risk | Known vulnerabilities, unsupported plugins, compatibility concerns and unresolved errors. |
| Reporting | Last client report, evidence delivered, recommendations and next review date. |
| Economics | Price, monthly delivery time, software allocation and gross margin estimate. |
The scoring model
Score each category red, amber or green per site:
- Red — a genuine gap: no backup retention, shared credentials, an unsupported plugin still active.
- Amber — partially in place: backups exist but untested, access is documented but not reviewed recently.
- Green — fully in place and confirmed, not assumed.
Roll the eight category scores into one overall Control score per site — the number of green categories out of eight is enough for most agencies; weight categories by risk if you want more nuance. Sort your portfolio by Control score and you have an instant priority list.
An audit is a snapshot. Inventory is a live view.
Once you've run the audit, connect your sites in Stack2 so ownership, access, maintenance and monitoring status stay current automatically — instead of going stale the moment the spreadsheet is saved.
14 days free. No credit card required.
Keep going.
How to Manage 100 WordPress Websites: The Agency Operations Playbook
Build a repeatable operating system for a growing client portfolio — inventory, access, updates, backups and reporting — instead of five dashboards and a spreadsheet.
The WordPress Agency Maintenance SOP: Daily, Weekly, Monthly and Quarterly
A complete maintenance rhythm your whole team can follow — daily checks through quarterly reviews — plus an editable SOP pack with escalation fields.