Sites sharing one hosting account share its files, limits, backups and reputation, so one hacked site can infect or suspend the rest. Give each business its own account, set up properly, well before any sale.

Three businesses, one login

Plenty of owners run more than one business: a trade and a rental sideline, a shop and a second brand, a practice and a property company.

Often every one of their websites sits in a single hosting account. One control panel, one password, one monthly bill.

It happened gradually. The first site went onto a plan that allowed extra domains, and each new business was added at no extra cost.

It works, until one of the sites is hacked, or one of the businesses is sold.

What the sites share

The first is the one that turns one problem into three. On most hosting, every site in an account runs as the same user, so anything that can change one site's files can change them all.

One hacked site, three infected sites

Small business sites are usually broken into through something outdated: a plugin nobody updated, a theme its developer abandoned, an old copy of a site left in a forgotten folder.

Once inside, the attacker's script can reach every folder the account owns. It plants spam pages, redirects or mail scripts in the other sites too, often in files named to look like part of WordPress.

Cleaning only the site that was attacked leaves the others infected, and the problem is back within days. Every site in the account has to be cleaned and checked together, and every password changed.

A suspension takes everything

When a host finds a site sending spam or hosting a phishing page, it usually suspends the whole account rather than the single site, because the account is what it bills and controls.

So an outdated plugin on the smallest site can take the main business's website offline too, along with every mailbox in the account.

Email reputation is shared the same way. If one compromised site sends thousands of spam messages, the server's address can end up on block lists, and quotes from the other businesses start landing in junk folders.

Busy days and backups

Hosting plans limit how much of the server an account can use. A rush on one site, or a misbehaving plugin, slows the others, and the host's usage figures show the account, not the business that caused it.

Backups are usually taken for the whole account. Restoring one site to last Tuesday can mean restoring all of them, and losing a week of orders or bookings on the businesses that were fine.

A good host can restore a single folder, but it is slower, and it is the kind of detail nobody checks until the day it matters.

A worked example

A demolition contractor also owns a bin rental company and a store selling doors, windows and fixtures salvaged from its jobs. All three websites ran from one hosting account, set up years earlier by whoever built the first site.

In the summer, an outdated gallery plugin on the salvage store's site was used to plant spam pages and a mail script. Two days later the host suspended the account.

All three sites and all three businesses' email went down together, in the busiest month for bin rentals. The clean-up found infected files in every site, not only the one that was attacked.

The owner was also planning to sell the bin rental business next year. So the web company that handled the clean-up gave each business its own hosting account, with separate logins, mailboxes, backups and contact addresses.

Each domain was moved into the name of the business that uses it.

What separation costs

Separate accounts cost more than one: an extra monthly fee for each business, depending on the host and the plan.

The bigger cost is the move, and it is modest when done properly. Each site is copied to its own account, tested, then switched over, with its mailboxes moved and nothing offline for more than a few minutes.

Set against a week of three businesses offline, or a sale held up while the buyer's adviser asks why the website shares a server with two other companies, it is cheap.

This is work for whoever looks after your hosting rather than a weekend project, since moving email and changing DNS records are where things quietly go wrong.

Untangling before a sale

A buyer expects the business to come with its own website, domain, email and history, ready to hand over. If those live inside an account shared with businesses not being sold, the handover becomes a project at the worst moment.

Start a year ahead if you can. Give each business its own hosting account, domain registration, Analytics property and Google My Business ownership, with every login in the business's own name.

The sale then includes a list of accounts to transfer, rather than a request to rebuild.

Who can see what

One login for three businesses means everyone who has it can read every mailbox and change every site.

A manager at one business should not be able to read another business's email, and somebody who leaves one business should not keep access to the others.

Separate accounts make that simple: each business has its own logins, and removing a person from one touches nothing else.

The counter-case

Separation matters less for some setups. Two simple sites for the same business, such as a main site and a single page for one service, already share an owner, a risk and a fate.

Static sites with no plugins, forms or logins offer an attacker very little, so the chance of one infecting another is small.

But where separate businesses run separate sites on software that needs updating, each deserves its own account, set up and moved by somebody who does it routinely.

The order to do it in

  1. List every site and mailbox in the account.
  2. Update or remove outdated plugins and old copies.
  3. Open a separate account for each business.
  4. Move each site and its email with testing.
  5. Give each account its own logins and contact address.
  6. Move domains into each business's own name.
  7. Confirm backups run for every account.

Step two comes before any move. A site copied with an outdated plugin carries its weakness into the new account, and separation only limits the damage of a problem that should have been fixed.

Another reason to know exactly what each account runs on is covered in TLS 1.0 and 1.1 are being retired.

Frequently asked questions

Can one hacked site infect my others?

Yes, if they share a hosting account. The sites usually run as the same user on the server, so a script planted in one can change files in all of them.

Why would the host suspend every site?

Hosts usually suspend the account, not the single site, when they find spam or phishing. Every site and mailbox in that account goes offline together.

What else do shared sites share?

Server limits, so one busy site slows the others; backups, often restored as a whole; the mail server's reputation; and a login with access to everything.

How much does separation cost?

An extra monthly fee per business, plus the move itself. Done properly, each site is copied, tested and switched over with its email, with almost no time offline.

What should happen before selling a business?

Give it its own hosting account, domain registration, Analytics property and listing ownership, all in the business's name, so the sale hands over accounts rather than a rebuild.

Is one account ever reasonable?

For two simple sites belonging to the same business, or static sites with no plugins or forms. Separate businesses running software that needs updating should each have their own.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Several businesses in one hosting account?

Send us the list of sites. We will give each business its own account and move them one at a time.

Start a Conversation