A $9.99 VPS can serve five brochure sites and a small store without strain. The limit is almost never the machine. It is what you decide on day one: how domains arrive, where the databases live, and who backs up what. This is how to host multiple websites on one VPS without the third one breaking the first.
Why share one VPS between several sites
Every NVMe VPS plan includes a dedicated IPv4, unlimited bandwidth, root access, a management panel, automatic backups, a firewall with DDoS protection, 24/7 monitoring, six-day-a-week support and a 99.9% SLA on infrastructure. Paying for five servers to run five low-traffic sites means reserving the same capacity five times.
One address is enough. With SNI, nginx presents the certificate that matches the requested hostname, so several domains can share the same IPv4.
What sharing does well
- An agency portfolio. Five or six client sites on the same stack, one place to patch.
- A brochure site and a light store. Irregular traffic, short peaks, a database of a few hundred megabytes.
- Staging and redesigns. A clone next to the production site, kept out of search results by basic auth or a
noindextag.
What it does not fix
A shared server does not isolate you from a memory leak: one site that saturates the CPU slows the others, which is the whole point of sharing. It does not isolate you legally either, if a client demands its own machine. And it does not forgive improvisation: three sites installed by hand under /var/www produce a platform nobody dares to update.
Virtual hosts or containers: choosing the isolation
One nginx server block per site
Each site gets its own server block, document root, logs, and, for PHP, its own PHP-FPM pool running as a separate system user. This is the lightest option: no extra layer, straight answers in the logs, minimal memory footprint. The trade-off is that every site shares one PHP version and the same system libraries, so a major upgrade has to be planned rather than improvised.
One container per site
Each site carries its own runtime: the old PHP branch for the 2019 site, the current one for the new build, Node for the internal app. Memory and CPU caps are set per container, a restart touches a single site, and rebuilding an image replays the exact same configuration. The price is a Docker daemon, a network layer to understand, and gigabytes of images on the NVMe disk.
| Criterion | nginx server block | Container per site |
|---|---|---|
| Memory | Minimal, a single PHP-FPM | One image and runtime per site |
| Runtime versions | One, shared by all | One per site, no conflict |
| Blast radius | Everyone is affected | Caps and targeted restart |
| Updates | Files replaced in place | Image rebuilt, instant rollback |
| Complexity | Low | Moderate: daemon, network, volumes |
| Choose it when | Three to five simple sites | Mixed stacks, separate clients |
The shared database is where things break
One database instance is still defensible for five sites: PostgreSQL and MariaDB both handle multiple schemas well. What breaks is the admin account copied into every configuration file. One SQL injection on the oldest site, and the attacker reads the newest client's tables. Four rules prevent that:
- One user per site, scoped to its own schema and nothing else.
- One schema per site, named unambiguously, so exports stay targeted.
- Separate dumps, otherwise restoring one site rolls every other site back.
- A compatible application version per schema: two CMS releases that demand different major versions do not share a database politely.
TLS and DNS: automate every domain
An expired certificate is still the most avoidable outage in this business, and it becomes systematic once you manage eight domains. The sequence that works: DNS points to the server's IPv4, the virtual host answers on HTTP, then the ACME client requests a certificate for that name.
- Verify renewal, do not just schedule it.
systemctl list-timersshows the next run. HTTP-01 is enough for one domain per site; a wildcard requires DNS-01. - Watch the proxy. Behind a proxying CDN, the origin certificate must stay valid for every name, or the visitor gets a 525 while the site works fine locally.
After each addition, curl -sI https://example.com must return 200 or 301, and openssl s_client -servername example.com must present the right name.
Backups and monitoring, one site at a time
The automatic backups included with every plan cover machine failure: a dead disk, a faulty hypervisor, a mistake at server level. They do not replace a consistent application dump, because a raw copy taken mid-write can be unusable. The right unit is the site, not the server:
- One dump per site per night, database and files, with a documented rotation.
- A copy off the server, or the backup disappears with what it protects.
- A restore that has been tested at least once per site: an archive nobody ever read back is a hypothesis.
The 24/7 monitoring and the 99.9% SLA cover infrastructure. Whatever runs inside your sites stays your responsibility: add one probe per domain that checks the response code and the content, not just whether the server answers.
Sizing: which plan for how many sites
The five plans, at public prices in US dollars and in dirhams excluding tax, with a realistic workload for each. Estimates assume brochure sites or low-traffic stores with caching enabled:
| Plan | vCPU | RAM | NVMe | USD/mo | MAD excl. tax | Realistic site count |
|---|---|---|---|---|---|---|
| VPS-1G Démarrage | 1 | 1 GB | 30 GB | 9.99 | 94.48 | One site, or two very light ones |
| VPS-2G Business | 1 | 2 GB | 40 GB | 19.99 | 189.06 | Three or four brochure sites |
| VPS-3G Performance | 2 | 3 GB | 50 GB | 34.99 | 330.93 | Four to six sites, one store |
| VPS-4G Avancé | 2 | 4 GB | 80 GB | 39.99 | 378.22 | Six to eight sites, two stores |
| VPS-5G Ultra | 3 | 5 GB | 100 GB | 49.99 | 472.80 | Eight to ten sites, builds and staging |
Ranges, not guarantees: measure before you choose, then keep 30% headroom. Moving to a bigger plan happens at any time without a painful migration. Hosting runs from New York today (under 5 ms locally, 10 to 20 ms to Montreal); a Rabat datacenter is announced but not open yet.
When to stop sharing
Sharing turns into a bad idea when it costs more than separating. Five signals:
- One site saturates the machine. A single domain takes most of the CPU at peak hours.
- Backup windows overlap. A nightly dump still running at opening time means the server carries too many sites.
- A client demands separation. Sensitive data, an audit, a contract clause: the question is no longer technical.
- Environments drift apart. Two apps demand incompatible versions and workarounds pile up.
- An incident becomes collective. An attack on one site takes the rest offline.
The exit is simple: a second VPS, a copy of the files and the database, one DNS record change.
FAQ
How many sites fit on a 1 GB VPS?
One brochure site with caching fits, two if one of them is static. Beyond that memory runs out: each PHP-FPM pool, each database process and each daemon takes its share. The 2 GB plan is the realistic starting point for three or four small sites.
Do I need one IPv4 address per site?
No. Every plan includes a dedicated IPv4, and SNI lets several domains share that address with a separate certificate per domain. An extra address is rarely justified: a client who insists on its own, or outbound mail whose reputation must stay separate.
Are the automatic backups enough for several sites?
They cover machine failure, not an application mistake. If one site corrupts its database, the server backup hands you a healthy machine with a corrupted database. Keep a dump per site and test a restore.
Can each client get separate access?
Yes at the filesystem and PHP-FPM level, with one user per site. But root access stays shared: whoever holds it sees every other site. Real separation means one server per client.
Host more sites without rebuilding the platform
Start with a written inventory: domains, runtime per site, databases, backup window, traffic peak. That table decides the rest — server blocks if the sites look alike, containers as soon as the environments diverge. If you run sites for clients, the white-label hosting program is built for exactly this case; for the machine itself, compare the NVMe VPS plans, their prices and their specs.