Client isolation, sizing, backups, security and billing: how a web agency can host several client websites on a single VPS.
By Mouhamed BANKOLE, CEO at ITNET Technologies · Updated 13 October 2026 · Reading time: 8 min
Your agency hosts a dozen client sites, each with a different provider, its own logins and its own outages. Grouping these sites on an agency VPS makes sense, but a poorly organised server turns one client's incident into an outage for everyone else. This guide explains how to isolate clients, size the machine, back up and bill hosting without eroding your margins.
In short
- A VPS for web agencies centralises client sites and cuts the time spent juggling hosts.
- Per-client isolation (system user, database, PHP pool) stops a compromised site from contaminating the others.
- Sizing is based on the combined load of active sites, plus headroom for each one's peaks.
- Backups must be restorable site by site, not just server by server.
- Hosting becomes a recurring service to bill, with responsibilities set out in a contract.
Contents
- Why should a web agency use a VPS?
- How many client sites can a VPS host?
- How do you isolate client sites from each other?
- How do you back up without mixing clients?
- How do you secure a multisite VPS?
- How do you monitor many sites without spending your days on it?
- How do you bill hosting to clients?
- One VPS or several: which should you choose?
- How do you migrate existing sites to the VPS?
- FAQ
Why should a web agency use a VPS?
A VPS lets an agency group its client sites on a platform it controls, with the same tools, the same procedures and a single invoice. For a structured approach to moving sites over, see our guide on moving from shared hosting to a VPS.
What the agency gains:
- One environment to master instead of a dozen hosting panels.
- Software versions you choose, suited to your projects.
- A standard deployment for every new site.
- A recurring revenue stream: hosting and maintenance become a service.
The trade-off is clear: the agency becomes responsible for the availability and security of every hosted site.
How many client sites can a VPS host?
The number of sites depends on their combined load, not on a fixed figure: a few busy dynamic sites weigh more than dozens of quiet brochure sites.
Starting points, to confirm by measurement:
- Low-traffic brochure sites and blogs: 2 vCPUs and 4 GB of RAM often host several dozen sites with good caching.
- A mix of brochure sites and a few stores: 4 vCPUs and 8 GB of RAM is a reasonable base.
- Several active stores: better to isolate them on a dedicated VPS, as explained in our guide on choosing a VPS for an online store.
Keep headroom so that a peak on one site does not affect the others. Wayhost VPS plans let you move up a tier without reinstalling the machine.
How do you isolate client sites from each other?
Isolation rests on a simple rule: one client, one system user, one database and one PHP pool.
The minimum to apply:
- One system user per site, owning only its own files.
- One database and SQL user per site, with no cross permissions.
- One PHP-FPM pool per site, so a stuck script does not freeze the others.
- Resource limits per pool: memory and number of processes.
- Separate FTP or SSH access if clients need to work on their site.
| Isolation level | Implementation | Protects against |
|---|---|---|
| System user | One account per site | Reading another client's files |
| Database | One database and user per site | Access to another client's data |
| PHP pool | One pool per site, with limits | One site hogging resources |
| Container | One container per site | Version and dependency conflicts |
| Separate VPS | One machine per sensitive client | Any cross-contamination |
How do you back up without mixing clients?
An agency's backups must be able to restore a single site, to a given date, without touching the others.
What to set up:
- One backup per site: files and database together, with the same date.
- A copy outside the VPS, to survive an incident on the machine.
- Retention matched to each client contract.
- Regular restore tests, on a site picked at random.
The host's backups protect the whole machine; yours protect each client. You need both.
How do you secure a multisite VPS?
On a multisite VPS, security first aims to stop a compromised site from becoming a gateway to the others.
Basic rules:
- Updates to the system, CMS and plugins on a fixed schedule.
- Removal of unused sites, themes and plugins.
- SSH key login and named accounts for the team.
- Firewall limited to the ports you need.
- TLS certificates for every domain, renewed automatically.
The NIST SP 800-123 guide recommends treating configuration, maintenance and logging as a whole. For WordPress sites, apply the official hardening documentation.
How do you monitor many sites without spending your days on it?
Agency monitoring should alert you before the client does: availability, certificates, disk space and resources.
Checks to automate:
- Availability of each site, with an alert after a few minutes of downtime.
- Expiry of certificates and domain names.
- Disk space and log growth.
- CPU and memory load, per PHP pool where possible.
Also centralise your clients' domain names: a forgotten renewal takes a site down as surely as a server failure.
How do you bill hosting to clients?
Bill hosting as a recurring service that covers the machine, maintenance, backups and some support, not as simple server rent.
What the contract should state:
- What is included: updates, backups, monitoring, certificate renewal.
- Response times in case of an outage.
- Backup retention and restore conditions.
- Reversibility: how the client gets their site back if they leave.
Price from the real cost: share of the VPS, monthly maintenance time, off-server backups and margin.
One VPS or several: which should you choose?
A single VPS is enough while sites are similar and not critical; as soon as a client is sensitive or very active, they deserve their own machine.
Criteria for splitting:
- One client generates most of the load.
- A client requires contractual isolation.
- Incompatible software versions must coexist.
- A site needs specific hardware: in that case, a dedicated physical server makes sense.
Many agencies end up with two levels: a shared VPS for brochure sites and dedicated VPS instances for key clients.
How do you migrate existing sites to the VPS?
Migrate sites one by one, starting with the least critical, with an inventory and a rehearsal for each.
Recommended order:
- Site inventory: files, database, emails, DNS, integrations.
- Copy to the VPS and test on a protected address.
- DNS switchover in a quiet window.
- Observation, then shutdown of the old hosting.
If your clients need their data hosted under European control, our guide on VPS in France lists what to check.
Frequently asked questions
Is a VPS suitable for a small web agency?
Yes, as soon as the agency manages several sites and has Linux administration skills. Without those skills, a managed offer or shared hosting remains safer.
Can a client be given access to the VPS?
Yes, provided you create an account limited to their own site. Never share the server's administrator access with a client.
Do you need a control panel to manage an agency VPS?
It is not mandatory, but a panel makes it easier to create accounts, databases and certificates per site. Choose one based on your team's skills and its licence cost.
What happens if a client site is hacked?
If sites are properly isolated, the attack stays limited to that site. Isolate it, restore a clean backup, fix the vulnerability, then rotate the affected secrets.
Who is responsible for client site data?
The client usually remains the data controller, and the agency acts as a processor for hosting. Formalise this role in a contract that specifies the security measures.
How do you stop one site from slowing down all the others?
Give each site its own PHP pool with resource limits, and monitor load per site. A site that keeps exceeding its limits should move to its own machine.
Key takeaways
- An agency VPS centralises client sites and creates recurring revenue.
- Isolate every client: separate system user, database and PHP pool.
- Back up site by site, with a copy outside the VPS and restore tests.
- Monitor before the client notices: availability, certificates, domains, resources.
- Move sensitive clients to their own machine as soon as load or contract requires it.
Ready to group your client sites? Wayhost VPS plans scale up without reinstallation and run on immersion-cooled servers.
Article written by Mouhamed BANKOLE, CEO at ITNET Technologies, publisher of Wayhost.cloud.