Shared Hosting Isolation
Why Shared Servers Need Separation Between Accounts
Shared hosting account isolation is the set of measures that keep each customer's files, processes and resources separate from every other account on the same server.
A shared server may host hundreds of unrelated websites. Without separation, a single compromised site could read or change the files of its neighbours, or use the server's resources in ways that slow everyone else down. Isolation turns one shared machine into many separate environments that only meet at the hardware and network level.
How Isolation Is Built Into Shared Servers
Several techniques work together to create this separation:
- A separate system user per account, so that file ownership and permissions keep one account's files away from another.
- Separate PHP processes per account, so scripts run under the account's own user rather than one shared web user.
- Restricted file system views, sometimes called jailed environments, so a process sees only its own directories.
- Resource limits that stop one account from consuming all the processor time or memory, a topic covered in CloudLinux and CageFS.
One Hacked Blog and a Neighbouring Shop
Two websites share one hosting server. A plugin on the hobby blog is exploited, and the attacker gains code execution. The shop's configuration file holds its database password. Without isolation, the attacker reads that file and gains access to the shop's database. With isolation, the blog's scripts run as their own user and cannot open the shop's folder, so the damage stays with the blog.
What Isolation Cannot Protect Against
Isolation limits spread, but it does not remove risk. A hacked site still exposes its own data and visitors. Shared network addresses can be affected by spam sent from one account, which may lead to blocklisting that touches neighbours. Weak permissions set inside an account, and flaws in the server software itself, also fall outside what per-account separation can prevent.
Frequently asked questions
Can a hacked website on shared hosting affect other websites?
Yes, in some setups. If accounts are poorly separated, an attacker may reach other sites' files. Even with good separation, a neighbour's spam can affect the reputation of a shared network address, which can cause delivery or blocking problems for other sites.
Is account isolation the same as least privilege?
They are related but not identical. Least privilege is a principle applied to each user, database and key, deciding what each one may do. Account isolation is a server-level separation between customers. Both reduce how far a single compromise can travel.