## 🧭 BUILD THE MULTISITE ARCHITECTURE ### 📊 SECTION 1 — Network Planning **Business objectives:** - Reduce new-client site launch time from ~3 weeks (custom build) to under 48 hours (template clone + config) - Standardize hosting/security/compliance posture across 30 independently owned small-business storefronts - Create a repeatable revenue model: agency retains platform ownership, clients pay recurring "managed storefront" fee **Site hierarchy:** - Tier 0: Template sandbox (never publicly indexed, source of truth for new site cloning) - Tier 1: Agency showcase site (public, drives new client acquisition) - Tier 2: 30 client storefronts (flat structure, no sub-hierarchy — each is a peer, fully independent commercially) **Network topology:** Subdomain-based network (`clientname.agencyplatform.com`) as default, with domain mapping offered as a premium tier for clients who want their own custom domain (`clientboutique.com`) **Tenant model:** Hard multi-tenancy — each client storefront is financially, legally, and operationally independent (separate Stripe/payment processor accounts, separate QuickBooks instances); the network exists purely for shared infrastructure/theme efficiency, not shared business data **Growth projections:** Agency targets 60 client sites within 12 months, 120 within 24 months — architecture must support 4x growth without re-platforming **Executive architecture summary:** - This is fundamentally a SaaS-style "sites-as-a-product" model, not a departmental network — every architectural decision should optimize for clone-and-launch speed and strict tenant isolation, since clients are unrelated third parties with no reason to share data - Hard tenant isolation is non-negotiable here: unlike a university or corporate network, these are independent small businesses with separate financial and legal identities - The template sandbox site becomes the single most important asset in this network — it's the product, and every hour invested in refining it compounds across all future client launches --- ### 🌐 SECTION 2 — Network Design **Subdomain vs subdirectory:** Subdomain structure mandatory — subdirectory would create SEO cannibalization and brand confusion across 30 unrelated boutique businesses sharing one domain path **Domain mapping:** - Optional premium add-on: clients on "Custom Domain" tier get native WordPress domain mapping with WP Engine SSL auto-provisioning - Clients on base tier remain on `clientname.agencyplatform.com` subdomains indefinitely **Network administration:** - Super Admin (CTO) retains sole rights to network plugin/theme installation and template sandbox modification - Network Admin (Ops Manager) handles new site provisioning (clone-from-template) and billing-tier flags but cannot alter template sandbox or install plugins **Site isolation:** - Absolute hard isolation per client: separate database prefix, separate uploads directory, separate payment gateway credentials, separate QuickBooks/Klaviyo API keys stored in site-specific encrypted options — never network-wide - No client can view, access, or reference another client's data under any role configuration **Shared resources:** - Shared: base WooCommerce theme framework, network-activated performance/security plugins, shared agency-managed CDN - Explicitly NOT shared: media libraries, customer data, payment processor connections, marketing integrations **📋 Network architecture blueprint:** - Network type: Subdomain core, with opt-in domain mapping as a monetized upsell tier - Isolation boundary: every client storefront fully isolated at the data, integration, and financial layer — network exists for infrastructure efficiency only - Product core: template sandbox site as the master clone source, version-controlled and change-managed separately from live client sites --- ### 👥 SECTION 3 — User & Permission Model - **Super Admin (Agency CTO, 1 person):** Full network control, sole owner of template sandbox, plugin/theme governance - **Network Admin (Ops Manager, 1 person):** New site provisioning via clone workflow, billing tier management, cannot touch template sandbox or install plugins - **Client Owners (30):** Full Administrator role scoped entirely to their own storefront; zero visibility into network settings, other client sites, or the template sandbox - **Agency Designers (5):** Custom role "Cross-Site Designer" — theme customization (colors, layout blocks, homepage builder) across all client sites via a scoped capability, but explicitly denied plugin installation and user management rights - **Agency Support Staff (3):** Time-boxed elevated access — support ticket system grants temporary Editor-level access to a specific client site for max 48 hours, auto-revoked via scheduled task, all actions logged **🛡️ Access control framework:** - Client Owners are the only role given true Administrator rights, and only ever scoped to their single site — this preserves the "you own your storefront" client value proposition - Agency Designers get broad reach but narrow capability — cross-site by design, but capability-restricted to prevent accidental plugin conflicts or data exposure - Support access follows a strict time-boxed, ticket-linked, auto-expiring model — no standing elevated access for support staff, closing the most common insider-risk gap in agency-managed multisites --- ### 🔌 SECTION 4 — Plugin & Theme Strategy **Network-activated plugins (mandatory, all sites):** - WooCommerce (core commerce engine, network-activated as foundation) - Security: iThemes Security or equivalent, network mode - Performance: WP Engine's native object caching integration plugin - Backup: WP Engine native automated backups **Site-specific plugins (scoped, client-approved only):** - Twilio SMS connector: activated per-client during onboarding, API keys unique per storefront - QuickBooks Online sync: activated per-client, never network-wide (each client has separate accounting entity) - Klaviyo: activated per-client based on which marketing tier the client subscribes to **Shared themes:** - Single network-activated parent theme ("Boutique Base") built as a flexible block theme with pattern library covering jewelry/apparel/home-goods layout variants - Child theme auto-generated per client during clone workflow, pre-seeded with client's brand color palette and logo placement **Update strategy:** - Template sandbox receives updates first, tested for 5 business days, then staged rollout to client sites in batches of 10 (never all 30 simultaneously) to contain any regression blast radius - Client Owners notified 48 hours before their batch's update window via automated email **⚙️ Plugin management plan:** - New plugin requests from Client Owners routed through Network Admin to Super Admin for security review before any site-specific activation - Batched rollout strategy specifically designed to prevent a single bad update from taking down all 30 storefronts simultaneously — critical given each site is an active revenue-generating business --- ### 🔒 SECTION 5 — Security & Governance **Authentication:** Standard WordPress auth with mandatory strong-password policy per site; SSO not applicable given clients are independent businesses, not internal staff **MFA:** Enforced for Super Admin, Network Admin, and all Agency Designer/Support accounts; strongly recommended (not yet enforced) for Client Owners via onboarding nudge **Audit logging:** Per-site activity logs retained 6 months; network-wide log specifically tracking template sandbox changes and cross-site Designer actions, since those carry the highest blast-radius risk **Firewall:** WP Engine's platform-level WAF applied network-wide; additional rate-limiting on wp-login.php across all 32 sites given the target-rich environment of 30 independent small-business admin accounts **Backups:** WP Engine automated daily backups per site (not shared network backup) — critical since each client storefront is an independent business needing independent restore points **Malware protection:** WP Engine platform-level scanning; additional manual quarterly review of the template sandbox specifically, since a compromised template would propagate to every future client clone **🚀 Security blueprint:** - Per-site backup isolation (not network-wide backup) — a client's restore needs are independent of the other 29 businesses - Template sandbox treated as highest-value security asset — it's the "golden image" and gets extra scrutiny beyond standard site-level protections - wp-login.php rate limiting is a priority given the realistic risk of credential-stuffing attacks across 30+ small-business-owner accounts with varying password hygiene --- ### ⚡ SECTION 6 — Performance & Scalability **Object caching:** WP Engine native object cache, per-site namespacing (critical here — cache pollution between unrelated client storefronts would be a serious data-leakage risk, not just a performance bug) **Page caching:** Full-page caching enabled per client site with automatic cart/checkout exclusion built into WooCommerce compatibility layer **CDN:** WP Engine's global CDN for all client-uploaded product imagery; particularly impactful for the 800-SKU catalog clients **Database optimization:** - Per-site WooCommerce order table monitoring — high-SKU clients flagged for `wp_options` autoload review given WooCommerce's known bloat tendency at scale - Scheduled cleanup of expired cart sessions and transients across all 32 sites weekly **Load balancing:** Native to WP Engine's platform architecture; no manual configuration required at 32-site scale **Horizontal scaling:** Clone-based onboarding model scales linearly — architecture validated to support the 60-site (12-month) and 120-site (24-month) growth targets without re-platforming, contingent on WP Engine plan tier upgrades at each growth milestone **📈 Performance roadmap:** - Phase 1 (Month 1): Per-site cache namespacing audit to eliminate any cross-tenant cache risk - Phase 2 (Month 2): High-SKU client database optimization pass (top 5 largest catalogs first) - Phase 3 (Month 3): CDN performance benchmarking across all product imagery - Phase 4 (Ongoing): Plan tier review triggered automatically at every +15 client sites added --- ### ☁️ SECTION 7 — Infrastructure & DevOps **Docker:** Local development mirrors WP Engine's stack via Local by WP Engine for designer/dev environment parity **CI/CD:** Template sandbox changes flow through a Git-based pipeline (GitHub → WP Engine Git push deploy) with a mandatory staging review before promotion to the sandbox's live template state **Staging:** WP Engine's native dev/stage/prod environment trio used per client site during onboarding customization; template sandbox itself maintains a permanent staging shadow for testing updates before batch rollout **Monitoring:** Uptime monitoring per client domain (critical — each site is a client's live revenue channel), WooCommerce order-flow monitoring to catch checkout failures immediately **Backups:** Covered in Section 5; additionally, template sandbox gets its own independent version-controlled backup outside the standard site backup rotation **Disaster recovery:** - RTO target: 2 hours per individual client site (revenue-critical, tighter than a typical internal network) - RPO target: 24 hours standard, with on-demand pre-update snapshots for any client site scheduled for a plugin/theme batch update - Runbook distinguishes single-storefront restoration (routine, self-service via WP Engine backup UI) from template-sandbox corruption (rare, high-severity, Super Admin-only response) **🏗️ Infrastructure strategy:** - Tighter RTO than a typical corporate network, reflecting that each site is an active small business's revenue channel, not just informational content - On-demand pre-update snapshots specifically protect against the batch-rollout risk identified in Section 4 --- ### 📊 SECTION 8 — Operations & Maintenance **Update workflows:** Batched rollout (10 sites per wave) with 48-hour client notice; template sandbox always updated and tested first **Monitoring:** Real-time uptime/checkout-failure alerts to Agency Support Staff Slack channel; weekly performance digest to Network Admin **Plugin governance:** All plugin requests reviewed by Super Admin; no client-initiated plugin installs permitted under any tier **Documentation:** Client-facing onboarding guide (self-service storefront management) separate from internal agency runbook (template maintenance, batch update procedures, DR steps) **Support procedures:** - Tier 1: Client Owners self-serve via documentation and in-dashboard help widget - Tier 2: Agency Support Staff handle ticketed issues via time-boxed elevated access - Tier 3: Network Admin/Super Admin handle template sandbox issues, security incidents, and infrastructure-tier problems **📋 Operational playbook:** - Ticket-linked, auto-expiring support access as the standard operating model, not an exception - Batched update cadence formalized as the default deployment method for anything touching client-facing sites --- ### 📈 SECTION 9 — Future Growth Strategy **Multi-region expansion:** Not currently planned — all clients are domestic; international boutique clients would require future data-residency evaluation **Multilingual support:** Bilingual (English/Spanish) storefront template variant planned within 9 months to capture a growing segment of prospective clients **API integrations:** Exploring a unified agency-side analytics dashboard aggregating (anonymized, opt-in) performance data across all client sites for agency reporting purposes — must be carefully scoped to avoid violating the hard tenant-isolation principle from Section 2 **SaaS features:** Self-service client signup and automated clone-provisioning (removing Network Admin as the manual bottleneck) planned as the biggest lever for hitting the 120-site 24-month target **Enterprise scaling:** Not applicable — growth trajectory is horizontal (more small independent clients), not vertical (larger enterprise tenants) **🚀 Long-term roadmap:** - Month 1–3: Stabilize batched update process, close cache-namespacing and wp-login rate-limiting gaps - Month 4–9: Launch bilingual template variant, formalize onboarding documentation - Month 9–12: Build self-service signup/clone-provisioning to remove manual onboarding bottleneck, reaching 60-site target - Month 12–24: Scale to 120 sites using proven self-service pipeline, reassess WP Engine plan tier at each +15 client milestone --- ## 🧾 FINAL MULTISITE ARCHITECTURE REPORT 1. **Executive Summary:** A hard-isolated, subdomain-based SaaS storefront network turns a 3-week custom build process into a 48-hour clone-and-launch product, while strict per-client data/financial isolation preserves the trust required for 30 independent small businesses to share infrastructure 2. **Network Architecture:** Subdomain core with opt-in premium domain mapping; flat peer hierarchy of 30 fully isolated client storefronts plus a version-controlled template sandbox as the master product asset 3. **Site Hierarchy:** Two functional tiers — the template sandbox (product core) and 30 peer client storefronts (no cross-client hierarchy) 4. **User Permission Strategy:** True per-site Administrator rights for Client Owners, capability-scoped cross-site access for Designers, and strictly time-boxed auto-expiring access for Support Staff 5. **Plugin & Theme Management:** WooCommerce and security/performance tools network-activated; all client financial/marketing integrations (QuickBooks, Klaviyo, Twilio) isolated per-site with zero shared credentials 6. **Security Readiness Score:** 8/10 — strong isolation and template-asset protection; gap is MFA not yet enforced for Client Owners 7. **Performance & Scalability Score:** 8.5/10 — clone-based model validated for 4x growth; per-site cache namespacing is the critical control keeping this score high rather than a risk factor 8. **Infrastructure Recommendation:** Remain on WP Engine Multisite with plan-tier review triggered at every +15 client sites; tighter 2-hour RTO justified by each site's revenue-critical status 9. **Top 10 Implementation Priorities:** - Template sandbox hardening as the highest-value security/product asset - Per-site cache namespacing audit to eliminate cross-tenant data risk - Batched update rollout process (10 sites per wave) with pre-update snapshots - Time-boxed, auto-expiring support access implementation - wp-login.php rate limiting across all 32 sites - MFA enforcement rollout for Client Owners - Self-service clone-provisioning system to remove onboarding bottleneck - Per-client backup isolation verification - Bilingual template variant development - Plan-tier scaling checkpoints tied to client-count milestones 10. **Enterprise Deployment Roadmap:** Month 1 — cache isolation + security hardening; Month 2–3 — batched update process formalized; Month 4–9 — bilingual template + documentation; Month 9–12 — self-service provisioning launch, 60-site milestone; Month 12–24 — scale to 120 sites via proven self-service pipeline