Most universities and large organizations run dozens of websites, often one per department or program, across Drupal, WordPress and more. Each has its own versions, owners and security exposure, tracked in a spreadsheet that was accurate once.
As an agency, we hit this with almost every client. Security advisories came by email, one site at a time, and every tool we tried covered only part of the picture. This session shares what we learned fixing that:
- Seeing security advisories and outdated core, modules and plugins across every site in one place
- Knowing which sites are patched and who owns the fix
- Checking best practices (accessibility, SEO, performance) continuously, not once a year
- Turning policies into automated checks with evidence ready when asked
We'll briefly show the platform we ended up building, but the focus is patterns and open source building blocks you can use on your own sites.
