The text came in at 9:40 on a Saturday night. I was in a rented suit, two glasses of cava in, standing at the edge of my sister's wedding reception in San Antonio. "Site is showing a pharmacy page. Is this us?" It was a dentist. Then a second text, from a roofer. Then an email from a bakery. Same plugin, same hole, and I was the person who had installed it on all of them. I remember walking into the hotel bathroom, locking the door, sitting on the closed lid with my laptop on my knees, and thinking: I have eleven servers, eleven passwords, and one phone battery.
Who I am
My name is Tomás. I am forty-one, I live in Austin, and I run a three-person web shop. We build and look after websites for small businesses: a couple of dental practices, a roofer, a bakery with online ordering, two law offices, a yoga studio, a handful of consultants. Almost all of it is WordPress. Our clients do not care what a server is. They care that the site is up, that it is fast enough, and that nobody is selling pills on their homepage.
For years I ran each client on its own small VPS, because that felt tidy and because it was easy to bill. Each one had its own Linux login, its own way of renewing SSL, its own backup script that I had written in a hurry and never looked at again. It worked, in the way a shed full of unlabeled boxes works: fine until you need something at night.
The Saturday everything was on fire
I was not scared of the hack. I was scared of the eleven logins.
The hack itself was ordinary. A popular plugin had a known vulnerability, the fix had been out for days, and I had not applied it everywhere because applying it everywhere meant logging into eleven machines one at a time. What frightened me was not the attackers. It was the arithmetic. Eleven logins, eleven updates, eleven file checks, eleven restores if the updates did not clean things up, on a hotel wifi connection, with my mother texting "where are you".
I got through it. It took until almost three in the morning and I missed the cake. On the drive home the next day I decided that the problem was not the plugin. The problem was that I had built my business on eleven separate sheds.
What I tried (and why it failed)
- Shell scripts and a cron job to update plugins everywhere. It worked until one client's theme broke on an update and I had no easy way to roll that one site back without touching the others.
- Moving everyone onto one big shared hosting account. Cheaper, but one client's traffic spike or infection would be everyone's problem, and I could not give a client their own login without giving them everything.
- A managed WordPress host. Lovely for the WordPress sites, useless for the two clients who needed custom PHP apps, a mail server, and a database that was not MySQL.
- Spreadsheets of credentials. I am not proud of this one.
The turning point
A friend who runs a small hosting company in Monterrey laughed when I told him the bathroom story. "You are doing by hand what a control panel does," he said, and showed me his screen. He was running dozens of customers on Plesk. One dashboard. Every domain, every mailbox, every database, every certificate, and a WordPress tab that showed him which sites had plugins waiting for updates.
I started a free trial that week on a fresh VPS. Plesk installs on Linux or Windows, and it is also offered ready-made on cloud marketplaces like AWS Lightsail, DigitalOcean, Vultr and Linode, so I did not have to build the box myself. I migrated the bakery first, because they were the most patient.
How I actually use it
All the sites, one screen
The thing I wanted most was simply to see everything at once. In Plesk each client is a subscription with its own domains, mail, databases and files. I can give the dentist a login that only shows the dentist's site, while I see all of them. Adding a domain or a subdomain, pointing DNS, turning on DNSSEC, moving a database from one subscription to another: these are clicks now, not a Saturday night.
- For me: one password manager entry instead of eleven, and one place to look when a client says "the site is weird".
- For the client: their own panel for email and files, without being able to touch anyone else's.
WordPress, finally under control
The WP Toolkit is why I stayed. It lists every WordPress install across every subscription, shows pending plugin, theme and core updates, and lets me update in bulk or one at a time. Before an update I can clone a site to a staging copy, try it, and push it back. If that plugin vulnerability happened again, the whole response would be a filter, a checkbox and one button.
- For me: the bathroom scenario becomes a ten-minute job from a phone.
- For the client: updates happen before they ever hear about a vulnerability.
SSL without the ritual
Certificates used to be a calendar reminder and a small prayer. With the SSL It! extension, domains get certificates issued and renewed from the panel, and I can see at a glance which ones are covered. That alone would have paid for the move.
Backups I can actually restore
Plesk schedules incremental backups and can send them to remote storage such as S3, Google Drive or OneDrive. More importantly for me, a restore is a click on a site or a database, not a hunt for a tarball on a disk that may or may not exist. Test a restore before you trust the backup - an untested backup is a guess, not a backup.
Email, security and the boring essentials
Mailboxes come with webmail and auto-configuration for Outlook and Thunderbird, plus DKIM, SPF and DMARC so client mail stops landing in spam. On the security side a web application firewall (ModSecurity) and brute-force protection (fail2ban) are active out of the box, and there is a catalogue of extensions for things like malware scanning when a client wants more. There is a mobile app, and the panel is available in more than thirty languages, which matters because one of my law offices works mostly in Spanish.
- For me: fewer "my email is not working" calls, because the records are set up correctly from the start.
- For the client: a site that is protected by default, not by whether I remembered.
The results that mattered
I will not give you invented percentages. What I can tell you is what changed in my week. Plugin updates went from a task I dreaded and postponed to something I do with coffee on Monday morning, for every client, from one tab. Certificate renewals disappeared from my calendar. New client onboarding is a subscription and a service plan, so the second dental practice took an afternoon to set up instead of a weekend.
When a client asks for something I used to say no to, like a staging copy before a redesign, or a second mailbox for a new hire, the answer is now "give me five minutes". That has quietly changed what I can charge for.
Isn't this a bit much for a three-person shop?
I asked myself the same thing. Plesk is sold in editions by the number of domains you manage, from a small edition for a handful of sites up to an unlimited one aimed at hosting companies, and it is a monthly licence on top of whatever your server costs. If you run one WordPress site, a managed host is simpler. If you look after other people's sites for money, the licence is cheaper than one lost client, and far cheaper than one lost Saturday night. There is a free trial, so you can decide on your own server before paying anything.
The new me
Last month a different plugin had a different hole. I read about it on Thursday morning, opened the WP Toolkit, filtered for the plugin, updated eleven sites, and was done before my second coffee. Nobody texted me. My sister, for the record, has forgiven me for missing the cake.
My honest recommendation
If you manage more than two or three websites for clients, especially WordPress, put them under one control panel. Plesk is the one I chose because it runs on the servers I already rent, handles mail, databases and certificates as well as WordPress, and lets me give each client their own door without giving them the whole building. Start the trial on a spare VPS, migrate your most patient client first, and restore a backup on purpose before you trust it. That is the whole method.
Community discussion
Enjoyed this story? Share your thoughts below.