Taking 200+ WordPress sites from 99 critical vulnerabilities to zero

There was no update routine. Core, theme and plugin updates waited until someone had a reason to log into a site, and across 200+ sites that rarely happened.

On August 10 I connected every site to WP Umbrella and took a baseline. The fleet had 157 pending updates and 99 critical vulnerabilities. Some sat in plugins like Slider Revolution where no patched version existed, so updating alone would never close them. The security view scored the fleet 50 out of 100, with 96 sites flagged.

WP Umbrella and MainWP both expose MCP servers, which let an AI agent work through them directly. I connected AI to both. It runs the safe updates, checks each site visually before and after to catch layout breaks, and watches the vulnerability and uptime alerts. Anything that fails a check or has no safe update comes to me.

Between August 10 and September 15, the number of active update automations went from 19 to 44.

With routine updates handled, I worked through the vulnerability list the dashboard surfaced. One morning pass on September 15 closed 22 issues by itself, taking critical vulnerabilities from 30 to 23 and medium or low ones from 53 to 38.

I kept going through the rest of the list. By October 14 the fleet had zero vulnerabilities of any severity and five pending updates.