I have a client with a lot (read several thousand) websites in several old cms solutions that are no longer maintained. Now moving all of them to a maintained solution isn't really an option at this point. So I'm thinking about ways to secure the solutions without patching them.

The solutions are mostly joomla 1.0/1.5 and wordpress. What I'm thinking is something like this:

• mod_suexec to lock everyone into their own home directory
• apparmor to deny any and all file writes by default. (exclude by default, include things like "images" directories).
• use htaccess to prevent anything in writable directories from being executed. (aka disable php_engine for images/ directory).
• mysql triggers to check the "users" tables to prevent adding new admins/superadmins.

Does this make sense? Is it viable? Am I missing something obvious?