@askwpgirl You should set these sites up as Composer-based sites an wpackagist for all plugins. You could then also use the WP-CFM plug-in to lock-in the active plugins. They wouldn’t be able to do anything with plugins without you. 😉