If one client’s WordPress site can access another client’s files or database, the sites share a meaningful security boundary. Agencies should separate client sites into distinct hosting users or accounts where practical, and ask the host to confirm how its isolation works. Separate installs reduce shared exposure; they do not prevent every compromise or replace updates, strong authentication, and tested backups.
Why one hosting account can be a problem
A single hosting login may be convenient, but it does not tell you whether the sites behind it are isolated. If a compromised site’s process can read or alter another site’s files, configuration secrets, or database, one client’s incident could affect others. WordPress’s Hosting Handbook recommends, where possible, running separate WordPress websites as separate users to isolate them: WordPress Hosting Handbook security guidance.
The important question is the boundary the host actually enforces—not simply how many WordPress dashboards, domains, or logins you see. A separate WordPress administrator account or role is not, by itself, proof that files, databases, or hosting credentials are separate.
Choose an arrangement that matches the clients’ needs
| Arrangement | What it means | What to verify |
|---|---|---|
| Separate hosting accounts or system users | Can provide a stronger account or operating-system boundary, depending on the provider’s implementation. | Ask whether files and processes are isolated, and whether each account has distinct database credentials, quotas, backups, and a recovery path. |
| Multiple WordPress installs under one hosting account | Each site can have its own database and database user, but the installs may still share hosting-level access and resources. | Ask whether a compromised site process could reach another site’s files, credentials, or database. |
| WordPress Multisite | One WordPress installation and database manage a network of sites. | Decide whether shared administration and network-wide changes fit the clients’ requirements; confirm the host supports the needed configuration. |
| Managed agency hosting | May centralize site management and provider maintenance; features differ by plan. | Confirm the per-site isolation model, restore process, support scope, resource limits, and current client or site limits. |
WordPress documents these as distinct architectures: a Multisite network, multiple installations sharing a database, or multiple installations using separate databases. It also describes using separate MySQL users for individual installations. Database separation is useful containment, but it is not the same as separating hosting accounts or system users: WordPress database creation guidance.
#1 Best Overall
When Multisite is—and is not—a fit
Multisite is an operating model for sites meant to be administered as a network, not simply a way to put unrelated clients’ sites under one roof. It uses one WordPress instance and database, so a network administrator has broad control across the network. That can suit intentionally connected sites with shared administration, but may not suit clients who need independent ownership, plugins, updates, or control.
WordPress cautions that Multisite may not fit sites intended to remain strongly independent rather than share users or data. Some network configurations also require server control that a shared hosting environment may not provide. Check the host’s capabilities and the client governance model before adopting it: WordPress Multisite guidance.
Questions to ask the hosting provider
Get specific answers for the plan you are considering; a product label such as “WordPress hosting” or “agency dashboard” does not establish isolation.
- Does each site run under a distinct system user?
- Can one site’s PHP process read or modify another site’s files?
- Does each installation have a separate database and database credential?
- What happens to the other sites if one site is compromised, suspended, restored, or exceeds resource limits?
- Are backups and restores available per site, and can a client’s site be restored without affecting other clients?
- What security maintenance and support are included, and which tasks remain the agency’s responsibility?
WordPress’s hardening guidance recommends considering separate databases managed by different users for multiple blogs on one server. It presents this as a containment measure that makes it harder for an intruder in one installation to alter others—not as a guarantee that separate databases alone isolate every hosting-level risk: WordPress hardening guidance.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Decide ownership and offboarding before launch
Technical separation is only part of a workable client arrangement. Record who owns and controls the hosting account, domain, site, and subscription; who can approve billing changes; who handles updates; and how access will be revoked when the contract ends. Also agree on where backups are stored and who can authorize or perform a restore.
Do not assume that site ownership and subscription ownership are the same. WordPress.com, for example, documents multiple sites managed under one login while each site has its own subscriptions and payments, and it supports transferring site ownership. Those details apply to WordPress.com and should not be assumed for other providers: WordPress.com guidance on managing multiple sites.
For agencies or freelancers with six or more client sites, that same WordPress.com page points to Automattic for Agencies. Treat it as a platform-specific workflow option: confirm current eligibility, features, and commercial terms directly with WordPress.com before relying on them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep security and recovery controls in place
Isolation reduces the chance that one installation’s compromise directly exposes another, but it does not make any site invulnerable. WordPress advises keeping software current, using strong authentication—including two-step authentication for administrators—and maintaining regular backups that include databases. Keep recovery copies in a trusted location and verify that restoration works; a backup that has never been tested may not be usable when needed. See the WordPress hardening guidance and Hosting Handbook security guidance.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
