The problem
An organisation working in EU-funded education and social innovation, running its programmes across a WordPress estate of around eighty sites. An estate that size stops being a set of websites and becomes infrastructure: it needs an inventory, a patching story, a way to find out what is wrong on one site without logging into eighty, and someone who can say what is installed where. Security came first and set the clock for everything after it.
The constraints
- A sector I had not worked in, entered on a contract measured in weeks rather than quarters.
- The stakeholders were non-technical domain experts. They are the people who know what the programmes are for, and none of the work could depend on them learning a toolchain.
- Funder compliance obligations shape what may be automated at all, so the constraint arrived before the design rather than after it.
- Delivery processes that predated me by years, on an estate I had not built.
- Everything had to be operable by people who would still be there when I was not. On a four-week contract that is not a nice-to-have, it is the definition of the work.
What I built
- Security first: hardening across the estate, followed by an audit and penetration testing.
- Estate management: tooling over the hosting provider's REST API covering inventory, plugin and theme lifecycle, PHP version upgrades, database health and domain reputation. One command against eighty sites instead of eighty visits.
- An incident workbench: a per-incident debugging tool that captures evidence, records a hypothesis, runs remote probes and renders a verdict, used on real incidents rather than designed in the abstract.
- A translation-import pipeline written directly against a plugin that exposes no write API, so the import had to go through the plugin's own query layer rather than around it.
- A course builder turning PowerPoint course material into semantic, published learning content, so subject-matter experts could keep authoring in the tool they already use.
- Two WordPress plugins, authored and released, and the reusable template with static analysis, coding standards and integration tests pre-wired that the second was bootstrapped from. Terraform for the estate's mail path.
- Bash, Python and PHP, each tool carrying its own tests, plus Terraform, which does not. The tests are the reason a non-specialist can run any of this after I left.
The outcome
The contract ran its full term and closed on 7 September 2026. The security work landed first, was audited and penetration tested. The tooling that followed turned an estate that was being firefought into one that can be run.
There are no numbers on this page, and that is the point rather than an omission. Every figure I could give you here, the line counts, the test counts, the repository totals, the release tags, the exact size of the estate, would be a readout of a codebase that is not mine. Those belong to the client and their size is theirs to disclose. The rounded scale of the estate is professional record, so it is here; nothing counted is. The two pages on this site that do carry counts are Slipway and Handee, and I wrote both codebases myself.
What was handed over
Tooling and runbooks rather than knowledge in my head. Every tool ships with its own tests and its own documentation, and the estate work is reproducible by someone who was not there when it was written. That is the same handover discipline I bring to a customer team, compressed into four weeks.