6 Surprising Things I Learned After Acquiring WP Folio for ~$750,000: A WordPress Security Business Acquisition Case Study

How buying from a portfolio company differs from entrepreneur acquisitions (and why that creates hidden opportunities for focused operators)

Published by Michael Frew | Acquisition Entrepreneur | 12 min read

Key Takeaways:

• Portfolio company acquisitions require 90-180 days of foundation building before focusing on growth.
• Undocumented operational knowledge is your biggest challenge when ops teams don’t transfer over.
• Misunderstood “inefficiencies” often have logical roots.
• Different operators optimize for different outcomes (breadth vs. depth).
• Archaeological discoveries (hidden revenue, abandoned accounts) are common when buying from established businesses.
• Team dynamics shift from “maintenance mode” to “growth mode” takes patience.

Advice for Acquisition Entrepreneurs

If you’re considering buying from a larger organization rather than individual entrepreneurs:

1. Budget 90-180 days for foundation building before expecting growth
2. Secure extended access to operations teams in your purchase agreement
3. Approach with archaeological mindset—understand before optimizing
4. Expect team dynamics shifts from maintenance to growth mode
5. Embrace the discoveries as opportunities, not problems
6. Remember different operators optimize differently—neither approach is wrong

Six months ago, I closed on a ~$750,000 acquisition that challenged a few things I thought I knew about buying online businesses. I hadn’t acquired from a portfolio company before, so I had some things to learn…

Through a WebStreet partnership, I invested just under $50,000 of my own capital for a ~20% profit share in WP Folio. WP Folio is a WordPress security plugin business that helps protect content through PasswordProtectWP.com and PreventDirectAccess.com.

This wasn’t my first acquisition. I’ve been buying and operating SaaS businesses for over a decade:

• QuotaGuard (2015): Acquired from founder, now generates $1.7M annually on ~1 hour/day
• Gigalixir (2022): Acquired from founder, runs smoothly with minimal oversight
• Appointment Reminder (2018): Another founder acquisition, practically runs itself

But WP Folio was fundamentally different 👇

Instead of buying from an entrepreneur who built the business, we acquired it from an organization managing 10-20 businesses simultaneously.

That difference led to six surprising discoveries that every acquisition entrepreneur should understand before buying from a portfolio company.

The Critical Difference: Entrepreneurs vs. Organizations

When you buy from individual entrepreneurs, they can explain every decision, every weird configuration, every line of legacy code. They built it. They lived it. The entire business exists in their head.

When you buy from organizations, you become an archaeologist excavating layers of decisions made by people who are no longer there to explain them.

As a single operator taking over from a distributed organization, you gain the advantage of narrow focus. Seeing the entire business as one interconnected system. But you also inherit complexity and history without the institutional knowledge to understand it.

Let me walk you through the six specific surprises I documented in my acquisition knowledge bank.

Discovery #1: The Institutional Knowledge Puzzle

We kept WP Folio’s technical and customer service teams. These are incredibly knowledgeable people within their domains. The operations team stayed with the seller, which made sense since I was taking over operations.

What I didn’t anticipate was how much undocumented operational knowledge would walk out the door.

First-layer questions were covered in the SOPs. But second-layer questions revealed the gaps:

Me: “I understand the process to update hosting. But why do we have hosting across multiple providers?”

Team: Silence

It wasn’t their fault. The operational person who made that decision was no longer with the company.

The Perfect Example

We discovered our sites hosted on two different companies with different:

• Account structures
• Security protocols
• Backup systems
• Even PHP versions

My first instinct: frustration. This seems so inefficient!

But digging deeper, each decision had logic:

• One host was chosen for better performance
• The other came from an acquisition made years earlier
• Migration was deemed too risky at the time

The Opportunity

As a focused operator, I could see the full picture and optimize. For someone in my position, who could spearhead the project, it was logical to consolidate to a single provider, saving several hundred dollars monthly. 

But, more importantly, I now understand why every decision was made that today looked reckless or poorly thought out.

Key Lesson: Make your purchase agreement include extended access to the operations team. You’ll need them for those once-a-year situations nobody thought to document. Many events are so rare, they never make it into the SOP manual.

Discovery #2: The Security Company with Shared Gmail Passwords

WP Folio sells WordPress security plugins. Naturally, I expected Fort Knox-level internal security practices.

Instead, I discovered:

• Shared personal Gmail account for critical system access
• Same password for everyone
• No audit trail of who logged in when
• Proprietary information sent to personal emails

My first reaction was alarm. How can a security company have such loose practices?

Understanding the “Why”

The previous owner managed 10-20 businesses. They optimized for speed and simplicity:

• One login = no password resets.
• No access delays.
• No chasing down “Joe” from another division.
• Maximum efficiency across their portfolio.

When you’re running that many businesses, this optimization makes perfect sense.

The Transformation Opportunity

As someone managing just four businesses, I could afford to optimize differently. We spent a few weeks implementing:

• Individual company email accounts
• Personal logins with multi-factor authentication
• Proper access controls and audit trails

Yes, I became “the annoying guy” changing everyone’s access. Team members in different time zones took days to regain access. But we turned it into a learning opportunity.

The Result: Our team now deeply understands security and can speak more authoritatively with customers. They’ve lived through a security transformation themselves.

Discovery #3: Archaeological Discoveries – Hidden Revenue and Abandoned Accounts

Three months post-acquisition, I received a confusing email: PayPal notifying us about chargebacks. But the email address wasn’t tied to any of our three PayPal accounts.

The Hidden PayPal Account

We had a fourth PayPal account, only active a few months per year, processing $2,000-$3,000 monthly. 

This apparently was tied to a migration from years ago that was then abandoned for a different PayPal account. 

Customers who signed up during that period kept renewing through this forgotten account. 

Since the cash was automatically deposited in the portfolio company’s bank account, it was slowly forgotten about over the ensuing years. 

It’s not the worse thing to find extra revenue you didn’t pay for, so no complaints from me! 

The Abandoned Marketplace Mystery

A customer complaint led to an even bigger discovery. Someone claimed they bought our product but received no support. My first thought: Some scammer had copied our sites

Reality: We discovered we did actually own an abandoned marketplace accounts selling outdated versions of our plugins. Real customers were:

• Buying obsolete versions
• Getting no support
• Understandably upset
• Damaging our brand

The previous owner probably didn’t know these existed. 

When managing 20 businesses, these details slip through cracks.

The longer a business has been in operation and the larger a firm that’s selling it, the better chances there are that not everything is fully accounted for in the acquisition paperwork. 

Yet More Archaeological Finds

• Multi-factor authentication tied to phone numbers nobody recognized
• DNS entries pointing to abandoned services
• Email marketing accounts from failed experiments

Each of these needed to be figured out, untangled, and put back to normal. 

This is the Opportunity: We integrated the lost revenue, removed damaging listings, and strengthened our brand. 

Each discovery made the business stronger.

Discovery #4: Infrastructure Archaeology – Every Decision Has a Reason

I inherited two WordPress sites with the same basic function but completely different:

• Hosting companies
• Domain registrars
• Backup systems
• Security protocols
• Caching plugins
• PHP versions

This annoyed me to no end. Why the heck was it setup like this? 

My engineering brain wanted immediate standardization. But I learned to be an archaeologist first.

The History Emerged

• Site A: Original product, built scrappy and fast
• Site B: Came from an acquisition, kept separate to avoid disruption
• Various DNS entries: Failed CDN experiment from 2019

Each “inefficiency” had a story. That Cloudflare DNS entry? It broke payment processing, so they only used it for static assets.

It’s just that nobody cleaned that project up. I’m guilty of that too. I still find DNS entries for mailing services we canceled years ago. 

The Consolidation Payoff

We’ve now:

• Standardized on single hosting platform
• Unified our tech stack
• Documented everything
• Saved hundreds a month in redundant services

Critical Learning: I needed to stop overreacting. Don’t rip and replace. Understand why each seemingly stupid thing exists first. 

The archaeological approach prevents breaking things that seem pointless but are actually critical.

Discovery #5: Different Games, Different Optimization Strategies

This took weeks to fully understand: The previous owners and I were playing completely different games.

Their Game: Breadth

• Managing 10-20 businesses
• Optimize for minimal time investment
• If it generates solid returns on 2-3 hours/week, don’t dig deeper
• “It works fine” = correct answer

My Game: Depth

• Managing 4 businesses (3 require just hours weekly)
• Optimize for maximum value creation
• Worth spending 20 hours to save a few hundred monthly
• Can dig into every inefficiency

The Team Dynamic Challenge

When I asked why Site A used one caching plugin and Site B used another, the team said: “They both work fine.”

They were right, for a company managing 20 business lines.

But for one business, duplicate systems meant:

• 2x renewal schedules
• 2x support relationships
• 2x documentation sets
• 2x troubleshooting processes

I inherited a team with the philosophy of operating in “maintenance mode management“. 

Just keep things running, don’t question why. 

Shifting to growth mode optimization was an adjustment.

Key Insight: The previous owners’ approach wasn’t wrong. It was perfect for their situation. 

But, as a focused operator, I could unlock value by playing a different game entirely.

Discovery #6: Why the First 90 Days Feel Like Quicksand

Coming from QuotaGuard (1 hour/day), I had aggressive plans:

• Deploy growth capital
• Launch marketing campaigns
• Rebuild onboarding flows
• Scale customer acquisition

Reality: You can’t jump straight into growth mode when acquiring from organizations.

Daily Discoveries Demanding Attention

• Security overhauls (team relearning access rules)
• Infrastructure consolidation
• Archaeological surprises
• Team dynamic shifts

Everything felt like slow motion.  But it’s necessary. 

It was my expectations that caused me stress. Had I known beforehand, I would have expected all of this and not created undue tension. 

The Transformation Reality

When acquiring from organizations (not other entrepreneurs), you’re not just buying a business, you’re starting on a transformation.

Those first 90 days aren’t about growth. They’re about building the foundation that enables growth.

The Payoff: We’re now deploying capital effectively because we understand our customers, our team’s aligned, and infrastructure’s solid. 

The “slow” first quarter set us up for a much faster year two.

The Bottom Line: Opportunities Disguised as Inefficiencies

These six discoveries taught me something fundamental about acquisitions:

When you buy from larger organizations rather than individual entrepreneurs, you’re not buying problems. You’re buying opportunities that only a focused operator can capture.

The previous WP Folio owners successfully managed 10-20 businesses. 

They built impressive value by optimizing for breadth. 

As a focused operator, I can optimize for depth in ways that weren’t logical for them.

Every discovery became an opportunity:

• Shared passwords → Security training and team development
• Weird infrastructure → Streamlining and cost savings
• Knowledge gaps → Creating engaged, business-savvy team members

Advice for Acquisition Entrepreneurs

If you’re considering buying from a larger organization rather than individual entrepreneurs:

1. Budget 90-180 days for foundation building before expecting growth
2. Secure extended access to operations teams in your purchase agreement
3. Approach with archaeological mindset—understand before optimizing
4. Expect team dynamics shifts from maintenance to growth mode
5. Embrace the discoveries as opportunities, not problems
6. Remember different operators optimize differently—neither approach is wrong

What looks like chaos at first probably has perfectly logical roots. 

Your job as an acquirer isn’t to judge past decisions, but to understand them, improve them, and use your focused operator advantage to unlock hidden value.

That’s why I’ve learned to love buying from large organizations. They’ve built great businesses that can become even better with focused attention.

Michael Frew is an acquisition entrepreneur who has bought and operated multiple SaaS businesses over the past decade. He shares transparent insights about business acquisitions at michaelfrew.com and runs WP Folio, QuotaGuard, Gigalixir, and Appointment Reminder.

Want more acquisition insights? Subscribe to my newsletter where I share monthly behind-the-scenes updates on operating a $3M+ portfolio of SaaS businesses.