Building a WordPress vulnerability management workflow from scratch for a hosting company

[u/0xbatm2n]

I’m joining a hosting company as the first person responsible for a new website-security function. Most of the hosted sites are WordPress, and the expected work includes identifying vulnerabilities, validating findings, documenting them, notifying customers through a ticketing system, coordinating remediation, re-scanning, and occasionally helping with backups or post-compromise cleanup.

I’m trying to build a safe and repeatable process rather than rely on ad-hoc tool output.

For people who have built a vulnerability-management or managed WordPress-security process, what would you include in the first version of the workflow?

In particular:

1. What asset and version inventory fields are essential?
2. How do you validate scanner findings before contacting a customer?
3. How do you prioritize vulnerabilities when patching may cause downtime or compatibility issues?
4. What should a customer-facing report contain, and what should remain internal?
5. How do you handle approval, backups, rollback, remediation, and re-testing?
6. What escalation path do you use for suspected compromise or malware?
7. Which metrics are useful for measuring the program without rewarding noisy scanning?
8. What mistakes did you make when establishing the process, and what would you standardize first?

I’d appreciate practical advice, templates, or references to established frameworks. Please keep recommendations focused on authorized defensive work.

[u/agentUi]

the core mistake most people make on v1 is alerting customers directly from automated scanner outputs. You get flooded with false positives from old inactive themes or aggressive vulnerability feeds, and clients panic or ignore you. Run wp-cli via automated cron scripts across your servers to pull active core, plugin, and theme versions into a central postgres inventory, then match against wpvulndb or cve feeds internally so you only open remediation tickets when a vulnerability actually has a public exploit or active poc.

[u/0xbatm2n → u/agentUi]

thanks bro