The Challenge
A fifty-site agency does not buy plugins. It buys licences, one site at a time, and then lives with them.
- Three vendor dashboards and a spreadsheet. Yoast, WP Rocket and CookieYes each had their own account, their own renewal date per site, and their own idea of which sites were still active. The spreadsheet that tried to reconcile them was last right about a year ago. Twice, a client site lost its cookie banner because a CookieYes domain lapsed and nobody noticed until the client did.
- $19,100 a year, invisibly. Yoast SEO Premium at $118.80 a site across 52 sites. WP Rocket's 50-site licence plus two singles. CookieYes Pro at $250 a domain on 31 sites. No single invoice showed the total, so no one had ever questioned it.
- Two-factor login on four sites, and a support queue for it. The agency had turned on a security plugin's 2FA for the four clients who asked, usually after a cyber-insurance questionnaire. Each one brought lockout tickets when a client's editor changed phones. For the other 48 sites, a stolen password was still enough.
- Plugins that generated work instead of doing it. Yoast flagged missing meta descriptions and the agency's project managers wrote them, site by site, during a quarterly sweep. WP Rocket's settings were tuned once at launch and then drifted every time a theme updated.
The agency had already decided to consolidate hosting. What it had not expected was that the plugin stack could go with it.
The Approach
Step 1 — Inventory the stack, not just the sites
Once the portfolio was on TopSyde, the portal's plugin inventory showed every site's SEO, caching, consent and security plugins in one list. That was the first complete count of what the agency was paying for: 52 Yoast licences, 53 WP Rocket seats, 31 CookieYes domains, 105 renewals a year.
Step 2 — Turn on the four switches, site by site
Auto SEO, Auto Speed, two-factor login and cookie consent are each a switch on a site's Dashboard tab in the portal. The agency's operations lead turned them on over two weeks, a client group at a time, accepting the short feature agreement for each. Each switch went live on the site within a day, and the cards showed what had changed.
Step 3 — Retire plugins only after checking the overlap
TopSyde reviewed what each plugin was actually doing before removing it. Yoast came off every site; none depended on a Yoast-specific integration. WP Rocket came off after confirming that page caching was already handled at the edge and that Auto Speed was tuning images and loading. CookieYes was switched over in one step per site, our banner on as theirs went off, so no site ever showed two. Two client sites serve German-speaking visitors; because our banner is English only, those two stayed on a dedicated consent product, and the agency knew that before anything changed.
Step 4 — Cancel the renewals, and the spreadsheet
With nothing left to renew, the three vendor accounts were closed as their terms ran out. The spreadsheet was archived.
The Results
Within the first month:
- $19,100 a year in licences stopped. 52 × Yoast SEO Premium ($118.80), WP Rocket's 50-site licence plus two singles ($419.85), and 50 × CookieYes Pro ($250), at the vendors' list prices in October 2026.
- Two-factor login went from 4 sites to 52. Every administrator, editor, author, contributor and shop manager set up an authenticator app or email codes the next time they opened their dashboard. The portal card shows who has and who hasn't, per site, which is now the agency's answer to every insurance questionnaire.
- Cookie consent went from 31 sites to 52, 50 on TopSyde's banner and two on a dedicated product. Each of the 50 has a Cookie Policy page from the first scan and a receipt for every choice, exportable as a CSV when a client asks.
- Auto SEO filled the gaps the quarterly sweep never caught up with. Weak titles, missing descriptions and image text were improved from each page's own content in the first runs, with the before and after recorded.
- Auto Speed replaced the launch-day caching settings with weekly tuning from each site's own Lighthouse evidence, verified and reversible per site.
- Licence admin and plugin tuning fell from about twelve hours a month to under one.
Why It Worked
- The plugins were never the point. The agency wanted descriptions written, pages fast, logins protected and banners compliant with its clients' policies. The licences were how it bought those outcomes one site at a time. Built-in tools deliver the outcomes without the per-site price.
- A switch beats a sweep. A weekly pass on every site, with change history, is more thorough than a quarterly manual review and leaves a record the agency can show a client.
- Overlap was checked, not assumed. Two sites kept a dedicated consent product because the fit was wrong. The review that found them is the same review that made the other 50 safe to switch.
- The savings compound with the portfolio. Each new client site arrives with the four tools already included, so the licence line never comes back.
Frequently Asked Questions
Where does the $19,100 figure come from?
From the vendors' own pricing pages, checked in October 2026: Yoast SEO Premium $118.80 a year per site, WP Rocket $299.95 a year for up to 50 sites plus $59.95 for each single site, and CookieYes Pro $250 a year per domain, the plan with region targeting like ours. Multiply by the sites the agency had each on, and the total is $19,097. An agency on a cheaper SEO plugin or a free consent tier would save less; one paying CookieYes monthly would save more.
Did the agency lose anything when Yoast and WP Rocket came off?
Not on these sites. TopSyde reviewed each site's use of the plugins before removal. Some sites elsewhere depend on a specific plugin feature or integration, and in those cases the plugin stays alongside the built-in tools.
Why are two sites not on TopSyde's cookie banner?
They serve German-speaking visitors, and our banner is English only and does not implement the IAB TCF. For those sites a dedicated consent product is the right fit, and TopSyde said so before the switch rather than after.
Is two-factor login the same as a security plugin?
For the login step, yes. The open-source Two Factor plugin handles the codes; TopSyde installs it, enforces it for everyone who can edit the site, keeps it updated and resets it when someone loses a phone. Scanning and malware removal are handled separately by Sentinel on every site.
What does rollback look like?
Each tool's changes can be rolled back from its card, all at once, by the agency or by TopSyde. Every change is recorded with its before and after, so a client question about a changed description has an answer in the portal.
The Stack — Named, Not Hidden
We tell you exactly what runs underneath. No proprietary black box.
Business Outcomes
- →Replaced Yoast SEO Premium, WP Rocket and CookieYes Pro across the portfolio with tools included in the plan, taking $19,100 a year of licences off the agency's card at the vendors' own list prices.
- →Every one of 52 client sites now requires a second login step from everyone who can edit it, up from 4. Lockout resets go to TopSyde, not the agency's inbox.
- →Cookie consent went from a per-domain subscription on 31 sites to a per-site switch on 50, with consent receipts and a Cookie Policy page on each; the two sites that need another language stayed on a dedicated product.
- →Weekly Auto SEO and Auto Speed passes replaced the quarterly plugin-settings sweep, with change history and rollback the agency can show a client.
DevOps & Security Lead
12+ years DevOps, Linux & cloud infrastructure certified
Marcus leads infrastructure and security at TopSyde, managing the server fleet and AI monitoring systems that keep client sites fast and protected. Former sysadmin turned WordPress hosting specialist.
