Standardizing One Subsystem Across a Portfolio in a Single Day

A portfolio of PHP and JSON sites had accumulated three different implementations of the same admin subsystem. Seven sites used one pattern. Two used a second. Two more used a third.

Nobody had planned that. It happened the way drift always happens: each site was built from whichever sibling was handy at the time, and the sibling that was handy changed over the years.

Two of the outliers were not merely different. They were broken. One returned HTTP 500 across its entire admin area because it required three template files that had never been created on that site. Another had been silently converting every admin request into a 404.

The work started with a survey rather than a fix, because "how many sites have this problem" is a different question from "is this site broken".

A script walked every site with the relevant function suite, classified which of the three patterns it used, and checked whether the required files actually existed. That produced a table showing seven sites on one pattern and four outliers, which is what made the majority pattern obvious rather than a matter of preference.

Each outlier was then converted, linted, smoke-tested against a local server, and verified live after deploy. Authenticated views were proven to render using a temporary harness that faked a session, which was removed from the web root immediately afterward and its absence confirmed.

The broken 500 was caused by a half-finished migration. The site's dispatcher had been updated to require three separate template files, but the templates were never created. The site's actual, complete admin was sitting in a single file from an earlier generation that nothing referenced any more.

Converging on the majority pattern surfaced a second problem immediately. Copying the reference dispatcher pulled in a call to a function that did not exist on either target site, and a dashboard count for a content folder neither site had. Both would have produced fresh errors.

That is the same class of bug the conversion was meant to eliminate, appearing during the fix. It was caught by checking every function and path the copied code referenced before trusting it, then porting the missing function rather than deleting the feature.

A separate finding came out of the sweep. Credential files holding password hashes were being stored in a directory that is deliberately public across this portfolio, because that directory exists to expose datasets to AI crawlers. On one site those credentials were being served publicly. That was closed the same session.