How to manage multiple WordPress sites

If you manage more than a handful of WordPress sites, you already know the problem: forty admin logins, forty update screens, forty places a backup can quietly fail. A WordPress management tool collapses that into one dashboard. The category has matured a lot in the last two years — visual regression testing is standard now, vulnerability feeds are built in, and three of the tools ship AI agents — so the choice is less “which one works” and more “which one fits how your agency runs.”

This guide compares the eight tools agencies actually use, with current pricing verified against each vendor’s site in August 2026, a cost model at 10, 50, and 200 sites, and a decision section at the end. It’s written by an agency operator who has run care plans since 2017 and is not selling any of these tools.

Who this is for: agencies and freelancers managing ten or more WordPress sites, and anyone about to pick a tool for the first time or switch from one they’ve outgrown.

Why you need one dashboard

The job of a management tool is boring on purpose. It exists so that four things happen reliably across every site you’re responsible for:

1. Updates get applied — core, plugins, themes — without breaking layouts, and with a rollback path when they do.
2. Backups exist somewhere off the site, and you can restore one without a support ticket.
3. Someone knows when a site goes down, a certificate expires, or a plugin ships a vulnerability.
4. The client sees a record of all of the above, ideally without you writing it by hand.

Every tool in this guide does all four. What separates them is how — hosted or self-hosted, per-site or flat pricing, screenshot-based or diff-based update checks, whether you can get your data out through an API — and how much of the client-facing side they’ve thought about.

One thing a management tool won’t do is tell the client anything beyond WordPress. We come back to that in the last chapter.

How we evaluated these tools

We scored each tool on nine things an agency care plan depends on. They’re the same nine columns in the comparison table below.

Prices are list prices from each vendor’s pricing page as of August 2026, monthly billing unless noted. Feature claims come from vendor documentation and changelogs; where a claim comes from third-party reviews, we say so.

Tools we considered but didn’t include

iControlWP, WP Managify, Glow, WPVibe — either too small to recommend with confidence, or too new to have a track record. WordPress Multisite isn’t a management tool; it’s a network architecture, and it’s the wrong answer for client sites that need to live on separate hosting. Hosting-provider dashboards (Kinsta, WP Engine, Cloudways) manage sites on that host only.

The best WordPress management tools, compared

Two patterns jump out. The hosted, care-plan-first tools (WP Umbrella, Modular DS, WP Remote) have converged on the same feature set and differ mostly on price shape and API access. The flat-priced tools (MainWP, WPMU DEV, InfiniteWP) win on cost at scale and lose on polish — you assemble more of the stack yourself.

The tools, one by one

WP Umbrella

What it is: A hosted dashboard from a bootstrapped French team, built specifically around agency care plans. About 80,000 sites across 5,000+ agencies.

What it does well: The safe-update flow is the reference implementation in this category — pre-update backup, visual regression screenshots, automatic rollback if the diff fails, scheduled and bulk updates, full update history. Backups are encrypted, incremental, stored 50 days on EU infrastructure. Patchstack vulnerability scanning runs every six hours and is included in the base price. Uptime, SSL, domain expiry, PHP error monitoring, and mobile performance checks are all in. Client reports are white-label PDFs on a schedule. It has a public API (GA since January 2025) and an official Claude skill that can query the fleet and run safe updates.

Trade-offs: Pricing is per site with no volume tiers, which is the simplest to budget under ~100 sites and worth modelling above that (see the cost table below). Firewall, virtual patching, malware scanning, and an activity log are available as a €2/site Security add-on, and hourly backups as a €2.49/site add-on.

Pricing: €1.99 (about $2.19) per site/month, all core features, unlimited team members, 10% off yearly. Security add-on €2/site. Hourly backups €2.49/site.

Best for: agencies that want the most polished care-plan tool, an API to build on, and per-site pricing that’s simple to pass through to clients.

Modular DS

What it is: A hosted dashboard from León, Spain (Uniqoders Technologies), grown fast since 2023 — 3,000+ agencies and roughly 35–40k sites. Version 3.0 shipped in May 2026.

What it does well: Updates get a risk score from their “Update Copilot,” before/after screenshots, automatic rollback, and rule-based automation. Backups are included (weekly on the cheapest plan, daily above that) with EU, US, or Asia storage regions and in-app restore. Patchstack-powered vulnerability alerts arrive up to 48 hours before public disclosure. Uptime checks run as often as every two minutes with SSL monitoring and email, WhatsApp, Slack, or Discord alerts. The client reports are the strongest in this group: scheduled, white-label, and able to include Google Analytics, Search Console, WooCommerce, and PageSpeed data. Pricing is by site count rather than per site, which makes it the cheapest hosted option at scale.

Trade-offs: No public API yet — an official API and MCP server are planned for fall 2026, which would close the one real gap against WP Umbrella and WP Remote. Malware scanning arrived in 3.0, with scheduled scans as a $2.25/site add-on.

Pricing: Freelance $16/mo (10 sites), Starter $34 (35), Business $59 (75), Enterprise $96 (125). Overage $1.25 per extra site. Up to 17% off yearly. 14-day trial, no card.

Best for: agencies that want strong built-in client reporting and the lowest hosted price at 50+ sites.

WP Remote

What it is: The agency dashboard from the BlogVault / MalCare team. Its strengths are theirs: the backup engine and the security stack.

What it does well: Backups are BlogVault — incremental, off-site, with the longest restore track record in the category, staging environments, and retention from 30 to 180 days by tier. Safe updates with visual regression and an “UpdateLens” risk score are on every plan, including the free tier for dev sites. Security scales by tier from malware scanning to AI scans, a firewall, and virtual patching. Uptime is included even on the free plan, and “Advanced Monitoring” (July 2026) added SSL, domain, page-content, and form-page monitoring. API v4 (September 2025) exposes 150+ read and write capabilities, and an MCP server followed in August 2026. Cloudways adopted WP Remote’s visual regression testing in July 2026, which says something about the engine.

Trade-offs: It’s the priciest hosted option once you need the security tiers — Premium is $4.99/site and Advanced $19.99/site per month. Malware removal became a $100-per-cleanup add-on in late 2025 rather than an included service. Reviewers note the lower tier lacks the firewall and bot protection that make the security story compelling.

Pricing: Free plan for dev sites. Essential $1.99, Premium $4.99, Advanced $19.99 per site/month; roughly 60% less billed annually ($19.99 / $49.99 / $199.99 per site/year). Custom agency pricing above 100 sites.

Best for: agencies that sell backups and security as the headline of the care plan, or that already use BlogVault or MalCare.

MainWP

What it is: The leading self-hosted option. You install the MainWP dashboard on a WordPress site you control and a child plugin on each managed site. Founder-run (Dennis Dornon) since 2014, open source, debt-free, 700,000+ sites under management, and 2,200+ five-star reviews on WordPress.org.

What it does well: Your data never leaves your server, which matters for some client contracts and for anyone burned by an acquisition. Pricing is flat — free Essentials, or Pro at $199/yr for unlimited sites and all 33+ extensions — so it’s the cheapest serious tool at any scale. Uptime monitoring with incident history is built into the core dashboard, not an extension. It has a REST API with read-only scoped keys, a CLI, and (since July 2026) a free open-source MCP server for Claude, Cursor, and the like. Cost tracking for plugin licenses, client management, and white-label are all included.

Trade-offs: You host and maintain the dashboard, and if that server goes down so does your control plane. There’s no native backup storage — MainWP manages UpdraftPlus, BackWPup, WPvivid, and others from the dashboard, but the storage is wherever those plugins put it. The Regression Testing extension is a side-by-side HTML/DOM diff, not screenshots, and it doesn’t auto-rollback. Security is an integration layer (Wordfence, Sucuri, Patchstack via extension) rather than a built-in feed. The learning curve is real, and the feature set is spread across many extensions.

Pricing: Free (Essentials). Pro $29/mo, $199/yr, or $599 lifetime — unlimited sites. Nonprofits get Pro free.

Best for: technical agencies with 50+ sites that want control over data and cost and are comfortable running one more WordPress install.

ManageWP

What it is: The original hosted WordPress management tool, acquired by GoDaddy in 2016. Two million sites managed. Free core with per-site premium add-ons.

What it does well: The free tier is genuinely useful — unlimited sites with monthly off-site backups (90-day retention, US or EU storage), security and performance checks, basic client reports, one-click login, and a template builder. Safe Updates take before/after screenshots with an optional automatic restore. Since a quiet stretch after the acquisition (their own team wrote in 2025 that “as updates slowed down, our public roadmap faded away”), it has picked up: a relaunched roadmap, a UI refresh with a dark theme, and Patchstack vulnerability protection in early 2026. Bundles at 25+ sites make the add-on pricing predictable.

Trade-offs: No public API — it was planned for the Orion release a decade ago and “deprioritized with no ETA,” and the only outbound integration is a Slack webhook. That’s a dead end if you want to connect the data to anything. Safe Updates require the $2/site premium backup add-on. The screenshot comparison is a manual slider, not an automated diff score. And a meaningful care-plan feature set (backups, uptime, advanced reports, white-label, vulnerability protection) adds up to about $7/site before bundles.

Pricing: Free core. Add-ons per site/month: Backups $2, Uptime $1, Advanced Reports $1, White Label $1, Vulnerability Protection $2, and others at $1. All-in-one bundle $150/mo for up to 100 sites; bundles stack.

Best for: agencies with an existing ManageWP setup that works, or very small portfolios that can live on the free tier.

InfiniteWP

What it is: The other self-hosted dashboard, older than MainWP. You install the admin panel on your own server and the IWP Client plugin on each site.

What it does well: Simple, self-hosted, and inexpensive. Updates, backups to your own destinations (S3, Dropbox, Google Drive, FTP, SSH), malware scanning with Google Safe Browsing, uptime with email alerts, PageSpeed, and client reports with three templates. A v3 interface refresh shipped in September 2025, so “dated UI” is no longer a fair complaint. The free tier covers 10 sites.

Trade-offs: No visual regression testing — safe updates are a staging-based test. No vulnerability feed of the Patchstack kind. No public API. Releases are still slow compared with the hosted tools, and the vendor’s own blog opens with “it’s been a while since our last update.” The pricing page currently shows two overlapping price tables, which doesn’t inspire confidence. Reviewers cite setup complexity and slowdowns on large fleets.

Pricing: Free (10 sites). Annual licenses: Starter $147 (10 sites), Developer $247 (20), Freelancer $347 (50), Agency $447 (unlimited), Enterprise $647 (unlimited, extra modules). Renewals at the same price.

Best for: budget-conscious freelancers who want self-hosted and don’t need visual regression or an API.

WPMU DEV

What it is: A plugin suite (Smush, Hummingbird, Defender, Snapshot, Forminator) with a management Hub, hosting, and white-label reseller tools. Repriced in 2025–26 around a $9.99/mo Premium tier.

What it does well: For the price, the Premium plan is remarkable — unlimited sites, unlimited backups and CDN, white-label everything, 0% commission client billing, a white-label CRM, unlimited seats, 24/7 support, and hosting discounts. If you already use their plugins for performance and security, the Hub consolidates management of all of them.

Trade-offs: It’s a plugin-company dashboard first and a management tool second. There’s no Hub-wide public API (only per-plugin APIs and a hosting API). Safe-update visual regression isn’t documented on the pricing or product pages — the Hub’s “Automate” does update-and-rollback, but we couldn’t verify screenshot comparison because their docs return errors to fetchers. The value proposition assumes you’ll host with them. Reviewers cite backup and migration frustrations and hosting costs for low-traffic sites.

Pricing: Pro Basic $50/yr (1 site), Pro Standard $75/yr (3), Pro Plus $100/yr (10). Premium $9.99/mo for unlimited sites. Hosting from $4/site/mo.

Best for: agencies already standardized on WPMU DEV plugins, or that want white-label reseller billing bundled in.

Jetpack / Automattic for Agencies

What it is: Automattic’s agency program. The Sites Dashboard (formerly Jetpack Manage) is free to join and manages Jetpack-connected sites on any host; the paid pieces are per-site Jetpack licenses (VaultPress Backup, Scan, Boost) at volume discounts.

What it does well: The dashboard is free and covers bulk plugin updates, downtime monitoring, backup and scan status, Boost performance scores, license management, and client billing. Volume discounts on Jetpack licenses run from 10% at five licenses to 50% at a hundred, and there’s a referral commission program. Backed by Automattic, so it isn’t going anywhere.

Trade-offs: No safe updates with visual regression and no rollback. Client Reports (beta, 2025) only work for sites hosted on WordPress.com or Pressable, and white-labeling isn’t documented. No public API for the dashboard. The per-site license model means backups and security cost more than any tool here once you scale — Jetpack Security is $19.95/site/month at list, $9.95 the first year, before discounts. And the Jetpack plugin’s weight is a perennial complaint, which Automattic disputes with data but agencies keep raising.

Pricing: Dashboard free. Jetpack Security $9.95/site/mo first year, $19.95 after; Backup and Scan standalone; Complete $24.95 → $49.95. Agency volume discounts 10–50%. Exact per-site agency pricing requires a login.

Best for: agencies whose clients are on WordPress.com or Pressable, or that already sell Jetpack licenses and want the referral revenue.

What it costs at 10, 50, and 200 sites

The comparison most vendor blog posts avoid. These are approximate monthly costs for a care-plan feature set — updates, backups, uptime, and client reports — at list prices as of August 2026, monthly billing. Annual billing takes 10–60% off depending on the tool. Self-hosted tools exclude the server you run the dashboard on (budget $10–30/month).

Three takeaways:

• Under 25 sites, price barely matters. Everything hosted is $15–$70/month. Pick on features.
• Between 50 and 100 sites, the per-site tools start to diverge. WP Umbrella and WP Remote cost 2× Modular DS, and 5× MainWP.
• Above 100 sites, flat pricing wins by a mile — if you’re willing to run the dashboard yourself. If you’re not, Modular DS is the hosted compromise.

Don’t let the tool cost drive the decision on its own, though. Across a care plan priced at a few hundred dollars per site per month, even WP Umbrella at €2 is under 1% of revenue. What matters more is what the tool lets you sell — and that’s where safe updates, reporting, and API access earn their keep.

Self-hosted vs. cloud

This is the first fork in the road, and it’s mostly a question about your team.

Self-hosted (MainWP, InfiniteWP)

• You control the data, the uptime of the dashboard, and the cost — flat, forever.
• You also own the dashboard’s hosting, updates, and security. If it goes down, you’ve lost your control plane until it’s back.
• Backups are bring-your-own: a plugin plus your storage. That’s flexible, and it’s one more thing to configure per site.
• Better fit for technical teams, contracts with data-residency clauses, and anyone who’s been burned by a vendor acquisition.

Hosted (everything else)

• Backups, monitoring, and the dashboard itself are the vendor’s problem. Setup is minutes per site.
• You pay per site or per tier, and the vendor holds your backups. Read the retention and storage caps.
• Better fit for teams that want to spend their time on client work, not infrastructure.

A reasonable rule: under 50 sites, go hosted unless you have a specific reason not to. Over 100, the math starts pushing toward MainWP, and the question becomes whether you have someone who’ll enjoy running it.

MainWP vs. ManageWP vs. WP Umbrella

The three most-searched-for head-to-head. They represent the three models — self-hosted flat, hosted freemium, hosted per-site — so the comparison is really about which model fits.

Pick MainWP if you have the technical bandwidth, 50+ sites, and want an API and flat cost. Pick WP Umbrella if you want the best safe-update flow and reporting without running anything, and your fleet is under ~100 sites. Pick ManageWP if you’re already on it and it works. It’s hard to recommend starting fresh on a tool with no API in 2026.

Which tool for which agency

Match the tool to the shape of your business, not the feature list.

Freelancer, under 15 sites. ManageWP free tier or Modular DS Freelance ($16). You don’t need to spend more yet. Set up backups you’ve tested and move on.

Small agency, 15–50 sites, care plans are a real revenue line. WP Umbrella or Modular DS. Both give you safe updates, backups, vulnerability alerts, and white-label reports for $30–110/month. Choose WP Umbrella if you want the API today (for reporting beyond WordPress); Modular DS if you want GA and Search Console in the built-in report and can wait for its API, planned for fall 2026.

Security-led agency, any size. WP Remote. If the pitch to your clients is “we keep you safe,” BlogVault backups and MalCare security are the strongest foundation, and the API and MCP mean you can build on it.

Technical agency, 50–500 sites. MainWP Pro. $199/yr, your server, your data, REST API and MCP server. Pair it with a backup plugin you trust and an uptime service if you want independent monitoring.

Large hosted fleet that doesn’t want to self-host. Modular DS at scale, or WP Remote with a custom agency quote. Model WP Umbrella’s per-site pricing against your plan margins before deciding — for many care plans it still pencils out.

Already standardized on WPMU DEV plugins. Stay — Premium at $9.99/mo for unlimited sites is a bargain for what you already use.

Clients on WordPress.com or Pressable. Automattic for Agencies. The free dashboard plus discounted licenses fits that world specifically.

Whichever you pick, don’t plan on switching often. Migrating a fleet is a week of work and the tools are close enough that it rarely pays back. Pick one, run it for a year, and build on top of it.

What none of them do

Every tool in this guide answers the same question: are the WordPress sites maintained? They answer it well, and the answer is the foundation of a care plan.

They don’t answer the question your client actually asks, which is closer to: is my website working for my business?

• Whether the contact form delivered a lead this week — and what people chose in its dropdowns
• WooCommerce revenue, checkout conversion, abandoned carts
• Traffic, and how it moved after the deploy you shipped
• The Craft site, the Shopify store, the Next.js app the same client also pays you for
• The commits and pull requests that represent the real development work
• Which care-plan clients are current, overdue, or consuming far more support than they pay for

Modular DS gets closest, with GA and WooCommerce summaries in its reports. None of them monitor form health, break down form fields, see non-WordPress projects, or join site health to billing.

That’s the layer Burrow adds — and it works with the tools above rather than replacing them. Burrow connects to WP Umbrella, WP Remote, and MainWP with a read-only API key, imports your sites and clients, and puts the maintenance data next to forms, WooCommerce, Shopify, analytics, GitHub, and invoicing in one timeline per client. A Modular DS integration is in development alongside the public API Modular DS has planned for fall 2026. For ManageWP and the others, the Burrow WordPress plugin captures forms and WooCommerce directly.

The result is a monthly report — you can see a sample — that shows the plugin updates and the leads, the uptime and the revenue. Keep your management tool for the work. Use Burrow for what you send the client.

If you’re building or repricing a care plan around one of these tools, the WordPress care plans guide covers the eight layers a plan should include and how to tier it by reporting depth. Start a free trial to connect your fleet tool and see what the report looks like with your own sites in it.