WordPress site sprawl is what happens when every brand, campaign and region launches its own WordPress site and nobody keeps a central list. In many large organizations no one can give the exact count, and the forgotten sites are the risky ones: unpatched, unowned, still on a company domain. Fixing it starts with an inventory built from DNS, certificate logs, invoices and contracts.
What is WordPress site sprawl?
WordPress site sprawl is an organization running more WordPress sites than its IT or digital team can name, with no single register of who owns each one, where it is hosted or who can log in. It builds up over years, one reasonable decision at a time, until the list lives only in people's heads and in expired contracts.
A typical path looks like this. In 2018 the Canadian region needed a French-language site fast, so the regional marketing manager hired a local agency and paid on a company card. In 2020 a product launch got its own microsite on a separate domain, built by a different agency and hosted on that agency's reseller account. In 2022 HR wanted a careers site they could edit without filing a ticket every time a posting changed.
Each of those solved a business problem. Six years later the regional manager has left, the launch agency has been acquired, and the careers site is still collecting names, emails and CVs on a WordPress install last updated by someone who no longer works there.
WordPress makes this easy to fall into. It runs about 43% of all websites according to W3Techs (2025), any agency can stand a site up in a day, and a basic hosting plan costs less than most approval thresholds, so it rarely passes through procurement. The spend shows up as a $25 line on an expense report, and the site shows up on nobody's asset list.
Why do orphan WordPress sites get breached first?
Orphan sites get breached first because nobody updates them. A WordPress site without an owner keeps running its 2021 plugins long after fixes ship, and attackers scan the internet for exactly those versions. The flagship site has a team watching it. The old campaign site has nobody, and it still carries your brand and your domain.
The numbers point the same direction. According to Patchstack's State of WordPress Security report, 7,966 new vulnerabilities were disclosed across WordPress core, plugins and themes in 2024, with 96% of them in plugins (2025). Every one of those fixes only protects a site if someone installs it. According to the Verizon Data Breach Investigations Report, exploitation of vulnerabilities as the first step in a breach grew 180% year over year (2024).
The unmanaged part matters as much as the unpatched part. IBM's Cost of a Data Breach report found that 35% of breaches involved shadow data, meaning data stored in places the security team did not manage, and those breaches cost more and took longer to find (2024). A careers site or event registration form on a forgotten WordPress install is shadow data with a login page.
Three exposures turn up on orphan sites again and again. The first is plugins several major versions behind, often including premium plugins whose license lapsed, so updates stopped arriving at all. The second is administrator accounts belonging to former staff and former agency developers, sometimes with passwords reused elsewhere. The third is DNS records still pointing at a hosting account that has been closed, which lets a stranger claim the address; we walked through one of those in how a stranger took over a government website's www address.
When one of these sites is compromised, it is still your incident. Your domain, your logo and any personal data on it belong to the organization, whatever cost center paid the hosting bill. Don't expect a quick external scan to tell you whether one is already infected, either. Free WordPress malware scanners only read the public HTML, so a clean result says little about what sits in the files and database.
How to build a complete inventory of your WordPress sites
Build the inventory from four independent sources and reconcile them: DNS zone exports, certificate transparency logs, finance records and old agency contracts. Each one misses sites the others catch. In our experience the first pass on a mid-sized portfolio takes a few weeks, and most of that is waiting for people to answer emails.
Start with DNS zones and registrar accounts
Export every zone from every DNS provider the organization uses: Cloudflare, Route 53, Azure DNS, and the DNS built into registrars like GoDaddy and Namecheap. If you don't know all the providers, search shared mailboxes and finance records for renewal notices. Ask each registrar for a full domain list under every account you can find, including accounts opened by regional staff.
For each hostname, note where it points. An A record to a shared hosting IP or a CNAME to a managed WordPress host is a strong hint that a site lives there. Flag any record pointing at an IP or service that no longer responds. Those are your takeover candidates and go to the top of the list.
Search certificate transparency logs
Every publicly trusted TLS certificate is written to public certificate transparency logs, and Chrome has required this since 2018. Search crt.sh for %.yourcompany.com and you get every hostname that has ever had a certificate under that domain, including things like promo2019.brand.com and staging-old.region.brand.com that nobody remembers creating.
CT logs have one limit. They only find hostnames under domains you already know about. A brand domain registered separately by an agency won't appear in a search for your main domain, so feed every domain from the DNS and finance steps back into crt.sh.
Read the finance records
Pull three to five years of accounts payable and corporate card data and search for hosting vendors (Bluehost, SiteGround, WP Engine, Kinsta, Hostinger, GoDaddy) and premium plugin vendors (Elementor, Gravity Forms, ACF, WPML, Yoast). A recurring Gravity Forms renewal on a regional card means a site with forms exists somewhere, even if nobody can tell you its address. Expense reports from marketing and regional teams are where the smallest sites hide.
Pull old agency contracts and statements of work
Ask procurement and legal for every web agency contract and statement of work in the same window. Deliverables lists name the microsites. Handover clauses tell you who owns the hosting account and who is the registrant on the domain, and you will sometimes learn the answer is the agency. Then email each agency, current and former, and ask for a list of everything they host or manage on your behalf.
Confirm each site is WordPress and who can log in
For every hostname that resolves, check whether /wp-json/ returns a response or the page source references wp-content. Cross-check against your Google Analytics, Tag Manager and Search Console properties, which often list domains the web team forgot. Then find out who holds an administrator login for each site and who controls the hosting account behind it.
| Source | What it finds | What it misses | Who to ask |
|---|---|---|---|
| DNS zone exports | Every hostname in zones you control, plus where each one points | Domains registered on accounts you don't know exist | IT, network team, registrars |
| Certificate transparency (crt.sh) | Forgotten subdomains, staging sites, old campaign hosts | Sites on domains you haven't identified yet | Anyone, it's public |
| Finance and card records | Hosting and plugin spend by department, including tiny sites | Sites paid for by an agency and billed inside a retainer | Accounts payable, card admins |
| Agency contracts and SOWs | Microsites, account ownership, domain registrant | Sites built without a contract | Procurement, legal, the agencies |
| Analytics and Search Console | Domains with live tracking, traffic levels | Sites that never had tracking installed | Marketing ops |
What should the site register record for each site?
The register needs enough detail to answer two questions for any site: who is accountable for it, and what happens if it is breached tomorrow. That means a named business owner, the hosting account holder, who has admin access, when it was last updated, and what personal data it collects. A spreadsheet is fine to start.
The columns we'd put in from day one:
- Hostnames and domains, with the registrar and registrant for each domain
- Business owner by name and job title, plus the budget it is paid from
- Purpose, in one sentence, and whether that purpose still exists
- Host, hosting account owner, and contract or renewal date
- Every administrator account and whether each person still works with you
- Date of the last WordPress core and plugin update
- Personal data collected through forms, logins, applications or orders
- Monthly traffic and inbound links, which feed the keep or retire decision
- Legal obligations that apply, such as the ADA web rule for public bodies, where the same WCAG 2.1 AA failures show up on nearly every government WordPress site
The owner column is the one your leadership will ask about. When someone senior asks who signed off on a site that leaked applicant data, "the register says it belongs to the regional marketing director, who confirmed it in March" is a far better answer than a shrug.
How to decide whether to keep, merge or shut down each site
Decide each site on three facts: whether its business purpose still exists, whether it has meaningful traffic or links, and whether anyone will own it going forward. Sites with a purpose and an owner stay. Sites with traffic but no separate purpose get merged. Sites with neither get retired properly, with the domain kept.
| Situation | Decision | What it involves |
|---|---|---|
| Active purpose, named owner, regular traffic | Keep | Move to managed hosting, close stale accounts, add to update schedule |
| Purpose overlaps another site, some traffic or links | Merge | Move content into the main site, 301 every old URL to its new home |
| Campaign or event ended, little traffic, no owner | Retire | Archive, redirect, keep the domain, remove the hosting |
| Collects personal data, no owner, outdated | Retire or keep, urgently | Decide within days; this is the highest-risk row on the list |
| Required by law or contract (accessibility statement, regional legal notice) | Keep or merge | Keep the content reachable at a stable URL |
Merging is mostly redirect work. Map every old URL to its closest equivalent on the destination site before you switch anything off; our guide to WordPress redirects and regex patterns covers the mapping, and the broader WordPress migration checklist covers the move itself.
Retiring a site takes more steps than cancelling the hosting plan:
- Archive it first. Take a full backup of files and database, store it somewhere the organization controls, and record where it is in the register.
- Redirect the domain. Point the old domain at the most relevant page on a site you keep, so links and bookmarks still land somewhere useful.
- Keep the domain registered. A lapsed brand domain can be bought by anyone, including people who will rebuild a convincing copy of your old site. Renewal is cheap insurance, even with domain renewal prices rising in 2026.
- Remove the DNS records. Delete every record that pointed at the old hosting, so nobody can claim that address on the same provider.
- Close accounts and revoke access. Cancel the hosting, revoke administrator logins, and cancel plugin licenses that were only there for this site.
What does WordPress site sprawl cost the organization?
The cost of sprawl lands in places nobody adds up: hosting and plugin bills spread across departments, agency retainers for small sites, staff hours spent on logins and vendor calls, and breach exposure on every unowned site. Each line looks small on its own. Totaled across a portfolio, it often matches a full-time salary.
Here is an illustrative example. These are not figures from any client, and your numbers will differ.
Say the inventory turns up 35 WordPress sites across nine hosts, paid by six departments. Hosting averages $30/mo per site, or $12,600 a year. Premium plugin licenses run about $150 per site per year, another $5,250. Five sites sit on agency care retainers at $300/mo each, which is $18,000 a year. Then staff time: 45 minutes per site per month on updates, password resets, broken forms and vendor tickets comes to about 26 hours a month. At a loaded cost of $70 an hour, that's $22,050 a year. The total is roughly $57,900 a year before a single incident.
Now say the keep, merge or retire pass leaves 15 sites. On TopSyde's starting price of $89/mo per site, that is $16,020 a year at list price, before per-site rates drop for a portfolio that size, with updates, backups and monitoring in one place instead of nine. Staff time doesn't go to zero, since someone still owns content and decisions, but the vendor juggling mostly goes away. We broke down the same hours math for agencies in what DIY WordPress hosting costs every month, and most of it carries over to an in-house team.
The breach line is harder to put a number on, but it is the one leadership will care most about. IBM put the global average cost of a data breach at $4.88 million (2024). A small site does not carry that full figure, but notification duties, forensic work and reputational damage don't scale down neatly with the size of the site.
How to keep the WordPress inventory from going stale
An inventory goes stale the month after you finish it unless new sites have to pass through it. Three process rules keep it current: no new site launches without a register entry and a named owner, hosting and domain purchases route through one approved account, and the CT and DNS checks repeat every quarter.
The procurement rule does most of the work. If corporate card policy blocks hosting and domain vendors outside the approved account, the next regional microsite has to come to you, and you can say yes quickly. Teams spin up their own sites when the central route is slow, so make it fast. Pair that with an annual attestation where every owner confirms their site still has a purpose. Sites nobody vouches for go straight to the retire column.
Updates need a process too, or the consolidated portfolio drifts back into the same state. A staged approach, like the one in our WordPress plugin update testing workflow, catches breakage before it reaches a live brand site, and many of the habits in this workflow for managing multiple WordPress sites apply to in-house teams running ten brands as much as to agencies running ten clients.
This is the part where we can help. A TopSyde portal holds your whole portfolio in one view, with each site's status and its open vulnerabilities listed per site, so the register and the operational picture live in the same place. Ongoing updates, backups and monitoring are covered as described on our spec sheet. Support tickets are answered in under 2 hours during business hours, and a site-down ticket is answered within 15 minutes, 24/7, as set out in our SLA. If you're comparing hosts for a consolidation, our list of vendor due diligence questions for a WordPress host works just as well against us as against anyone else.
If you want a first look before committing to anything, run the free audit on any one site from your list, ideally the one you're most worried about. When you're ready to talk about the full portfolio, start with our enterprise page, or put a single site on the 30-day free trial and see how the portal handles it. Pricing for multiple sites is on the pricing page.
Frequently Asked Questions
How many WordPress sites does a typical enterprise run?
There is no reliable public benchmark, and we'd be wary of anyone quoting one. The count depends on how many brands, regions and campaign teams the organization has and how long they've had budget to build sites on their own. The only number that matters is yours, and the four-source inventory above is how you get it.
Is it safe to just switch off a WordPress site we no longer need?
Switching off the hosting is only one step. Archive the site first, redirect the domain to a relevant page you keep, keep the domain registered so nobody else can buy it, and delete every DNS record that pointed at the old host. Skipping the DNS step can leave an address that a stranger can claim.
Can certificate transparency logs find every site we run?
No. CT logs at crt.sh show every hostname that received a publicly trusted certificate under the domains you search for, which catches most forgotten subdomains. They won't reveal sites on separate domains you haven't identified, or sites that never had HTTPS, so pair them with DNS exports, finance records and agency contracts.
What does it cost to move a WordPress portfolio onto TopSyde?
TopSyde starts at $89/mo per site, and per-site rates drop as you add sites to the account. You can run the free audit on any single site, try one site on the 30-day free trial, or talk through the whole portfolio on our enterprise page before moving anything.
DevOps & Security Lead
12+ years DevOps, Linux & cloud infrastructure certified
Marcus leads infrastructure and security at TopSyde, managing the server fleet and AI monitoring systems that keep client sites fast and protected. Former sysadmin turned WordPress hosting specialist.
