Toolkit
The Result
A modernized, secured portfolio
Over three years, Bancroft's web presence moved from a sprawling, page-builder-heavy set of sites to a secured, performance-tuned, and easily managed portfolio — with a redesigned content experience carrying its stories to the families it serves. The work spanned hosting and server modernization, a full blog rebuild, privacy compliance, and real-world threat response.
9
WordPress installs managed as one portfolio
253
Blog posts migrated off the page builder
PHP 8.2
Stack modernized across production & staging
9/9
Sites secured in a live supply-chain response
The Partnership
One non-profit, nine websites
Bancroft is one of the Northeast's leading non-profits serving children and adults with autism, intellectual and developmental disabilities, and acquired brain injury — more than a century of care, thousands of individuals served, and a workforce in the thousands across New Jersey and Delaware.
Its digital footprint had grown into a complex multi-site architecture on WP Engine: nine distinct WordPress installations separating the main hub, careers, clinical programs, the special-education school, vocational and retail ventures, and a staging environment. The engagement began in late 2023 to standardize, optimize, and secure all of it. The starting state was familiar for a portfolio this size — aging PHP runtimes and slow load times, page-builder bloat dragging on performance, inconsistent content styling, growing security exposure, and mounting privacy-compliance pressure.
bancroft.org
Primary non-profit hub
careers.bancroft.org
Careers & applicant tracking
neurorehab.bancroft.org
Neurological rehabilitation
school.bancroft.org
Special-education school portal
kohleracademynj.com
Kohler Academy (special education)
cafeone.bancroft.org
Vocational training café
shop.bancroft.org
E-commerce & merchandising
Executive leadership site
Leadership & brand presence
Staging / QA
Isolated testing environment
Phase 1
Infrastructure & performance
The foundation came first. Working alongside Bancroft's network and cybersecurity team, we established clean separations between production, staging, and local development across every environment, so system updates and theme changes could be tested in isolation before ever touching a live public user.
Stack modernization
A performance audit found the legacy Careers and School portals running on outdated PHP runtimes, driving high time-to-first-byte and server-side latency. We modernized the staging and production environments to PHP 8.2 — backing up databases, checking plugins for compatibility, and resolving errors in legacy scripts before promotion.
Automated patching
To keep a nine-site portfolio secure without constant manual overhead, we activated WP Engine's Smart Plugin Manager across the production environments — daily automated plugin scans that update critical security and SEO plugins, with automated rollback scripts that restore the previous state if any update fails. Core Web Vitals were then audited quarterly on the primary domain to keep performance honest as content and features grew.
Phase 2
The blog, rebuilt
Bancroft's stories are how families first meet the organization. But years of page-builder implementations had left individual articles with inconsistent styling and layout drift. The fix was a single programmatic, reusable template — one system that styles every article the same way, automatically.
A programmatic template
The redesign replaced ad-hoc page-builder layouts with a consistent, mobile-first article system: high-contrast breadcrumbs matching the main site, a dynamic "In This Article" table of contents in Bancroft's corporate blue that docks to the top of the screen on mobile scroll, blockquotes with a bold left border, green call-to-action blocks, and inset 3:2 media. Outdated pagination gave way to a dynamic tag filter and a programmatic related-articles grid with soft-teal cards and red hover states.
253 posts, decoupled from the page builder
Behind the redesign was an architectural change. Storing layouts inside page-builder meta fields bloated the database, slowed queries, and broke layouts on theme updates. Using Custom Post Type UI and Advanced Custom Fields, we built a blog framework that decouples article content from presentation, then migrated 253 legacy posts out of the page builder and into clean, classic-editor HTML. Data integrity was preserved, layout rendering was unified across the entire archive, and the database got measurably lighter — improving query efficiency and Core Web Vitals in one move.
The programmatic article template and blog index — one system styling every post consistently.
Phase 3
Privacy & consent compliance
Late in the engagement, Bancroft's liability insurance carrier issued a privacy-compliance mandate: verify that all tracking — GA4 and third-party pixels — stays blocked until a visitor gives explicit consent. We implemented the CookieYes consent platform and reconfigured the Google Tag Manager containers so tracking scripts are held back until opt-in, with server-side tagging stripping and anonymizing identifiers before any data reaches Google.
Recovering analytics without breaking compliance
Strict opt-in banners created a new problem: most visitors never clicked them, so their sessions went untracked and Bancroft's marketing metrics fell off a cliff. Rather than choose between compliance and visibility, we built a passive-consent path — a custom scroll-depth script that fires an anonymous consent signal once a visitor scrolls past a set threshold, recovering meaningful traffic data while still meeting the carrier's underwriting standards.
Visitor arrives
No tracking fires. GTM containers stay suppressed until a signal is received.
Explicit consent or passive scroll
An opt-in click — or scrolling past the threshold — triggers a consent event through the CookieYes API.
Anonymous, server-side tags fire
Only then do tags run, with identifiers stripped and anonymized server-side before reaching Google.
Phase 4
Security & threat response
Securing a public non-profit portfolio meant a standing perimeter, not a one-time hardening. In partnership with Bancroft's cybersecurity director, we deployed Sucuri server-side scanning across the portfolio, blocked malicious database activity at the firewall level during a monitored incident, renewed lapsed SSL certificates on redirected domains, and evaluated a Content Security Policy — flagging where it would have conflicted with active plugins so Bancroft could allocate its IT resources with clear information.
The polyfill.io supply-chain response
In mid-2026, the widely used polyfill.io service — sold to a new owner in 2024 — began injecting malicious redirects into any site still referencing it. A legacy template on one Bancroft application page still did. We launched an immediate portfolio-wide sweep:
Secure access to all nine installs
Established SSH connections into every WordPress installation across the portfolio.
Database & filesystem scans
Ran WP-CLI database searches and recursive filesystem greps for any reference to the compromised domain.
Verified clean, secured the rest
Eight of nine sites came back completely clean. The ninth had a routing mismatch we resolved to finish verification and secure the entire portfolio.
Phase 5
Technical SEO across the portfolio
Search visibility was maintained the same way everything else was — as a portfolio. Using Screaming Frog and Semrush, we ran standard crawl audits across the main site and its subdomains, then worked through what they surfaced: broken internal and external links on high-traffic resource pages, redirect loops and thin meta descriptions on the Careers and NeuroRehab domains, and a content hierarchy realigned around achievable, high-intent keywords for the school calendar and merchandising shop. Each subdomain is its own site with its own crawl profile, so the audits ran site by site.
Three of the nine properties — each audited and maintained as its own site.
Alongside Bancroft, a parallel web overhaul ran for the Business Enterprise Institute (BEI) — a full front-end rebuild and custom-post-type event system, sequenced against the same block of engineering hours.
Reflections
What I Learned
A portfolio is a system, not a set of sites
Nine WordPress installs can't be maintained as nine separate to-do lists. Shared patching, shared security scanning, and a shared response playbook are what make a portfolio this size sustainable for a lean team.
Decouple content from presentation
The single most valuable structural change was pulling 253 posts out of page-builder meta fields into clean CMS data. It made the database lighter, the layouts consistent, and every future theme update safer.
Compliance and analytics aren't opposites
Strict consent gating tanked Bancroft's metrics until a passive-consent path recovered them. The right answer wasn't choosing one — it was engineering a route that honored both.
Infrastructure is invisible until it isn't
PHP upgrades and plugin patching go unnoticed — until a supply-chain compromise hits and the value of being able to SSH into all nine sites and sweep them in an afternoon becomes very visible.
