Hi aaPanel team, I have some questions about hosting multiple WordPress websites with customer-level access and how to properly isolate each website in aaPanel. My situation: I am hosting multiple WordPress websites on the same server. Some of these websites will be delivered to customers, and customers will have WordPress Administrator privileges. Since WordPress administrators can install plugins, upload files, and modify themes, I want to make sure that a security issue on one customer's website cannot affect other websites on the same server. I would like to know the recommended aaPanel configuration for this kind of multi-tenant WordPress hosting. My questions: Does aaPanel create a separate Linux user for each website by default, or do all websites run under the same system user (such as www)? Does aaPanel support running each website with an independent PHP process/user, such as separate PHP-FPM pools or LSAPI users, to prevent one website from accessing another website's files or processes? What is the recommended way in aaPanel to isolate: website files PHP processes database users Redis/session storage Regarding Redis: If multiple WordPress websites use Redis, should each website have its own Redis database number, password/user, or key prefix? For example: Website A: Redis DB 1 / prefix site_a_ Website B: Redis DB 2 / prefix site_b_ Is this supported or recommended in aaPanel? I noticed aaPanel has a "Session isolation" option: "Session files will be stored in a separate folder, not in a common storage location with other sites. Do not enable this option if you are saving sessions to caches such as memcache/redis in your PHP configuration." Does this option only isolate file-based PHP sessions (session.save_handler = files)? If PHP sessions are stored in Redis, does this option become unnecessary? Or is there another recommended way to isolate PHP sessions between websites? In your experience, what is the recommended architecture for a server hosting multiple customer WordPress websites? For example: separate Linux users separate PHP workers separate database users Redis isolation Docker containers What approach does aaPanel recommend? My goal is to provide customers with WordPress admin access while minimizing the risk that one compromised website could affect other websites on the same server. Thank you!

Hello, The main panel is for the www user by default. Other configurations require manual configuration. If it is a sub-account website, it is Independent Linux users Different PHP runs based on user Independent database user Currently, it is not supported to set up independent programs such as redis and Docker. aaP_p127x

Questions on aaPanel Isolation Settings for Multiple Customer WordPress Websites

aaP_p127x

Hi aaPanel team,

I have some questions about hosting multiple WordPress websites with customer-level access and how to properly isolate each website in aaPanel.

My situation:

I am hosting multiple WordPress websites on the same server. Some of these websites will be delivered to customers, and customers will have WordPress Administrator privileges.

Since WordPress administrators can install plugins, upload files, and modify themes, I want to make sure that a security issue on one customer's website cannot affect other websites on the same server.

I would like to know the recommended aaPanel configuration for this kind of multi-tenant WordPress hosting.

My questions:

Does aaPanel create a separate Linux user for each website by default, or do all websites run under the same system user (such as www)?
Does aaPanel support running each website with an independent PHP process/user, such as separate PHP-FPM pools or LSAPI users, to prevent one website from accessing another website's files or processes?
What is the recommended way in aaPanel to isolate:
- website files
- PHP processes
- database users
- Redis/session storage
Regarding Redis:

If multiple WordPress websites use Redis, should each website have its own Redis database number, password/user, or key prefix?

For example:

Website A:
Redis DB 1 / prefix site_a_

Website B:
Redis DB 2 / prefix site_b_

Is this supported or recommended in aaPanel?
I noticed aaPanel has a "Session isolation" option:

"Session files will be stored in a separate folder, not in a common storage location with other sites.

Do not enable this option if you are saving sessions to caches such as memcache/redis in your PHP configuration."

Does this option only isolate file-based PHP sessions (session.save_handler = files)?

If PHP sessions are stored in Redis, does this option become unnecessary? Or is there another recommended way to isolate PHP sessions between websites?

In your experience, what is the recommended architecture for a server hosting multiple customer WordPress websites?

For example:

separate Linux users
separate PHP workers
separate database users
Redis isolation
Docker containers

What approach does aaPanel recommend?

My goal is to provide customers with WordPress admin access while minimizing the risk that one compromised website could affect other websites on the same server.

Thank you!

aaP_p127x

Can the aapanel sub-account feature solve these problems?

aaPanel_Kern

Hello,

The main panel is for the www user by default. Other configurations require manual configuration.

If it is a sub-account website, it is

Independent Linux users
Different PHP runs based on user
Independent database user
Currently, it is not supported to set up independent programs such as redis and Docker.

aaP_p127x

aaP_mattewwade06

Good question. For hosting multiple customer WordPress sites, proper isolation is definitely worth implementing. It helps improve both security and stability, especially if one website becomes compromised. Hope the aaPanel team can share some recommended best practices.