What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A subdomain shares a main site’s database only when the application is deliberately configured to use the same database service and its schema defines what may be shared. Creating play.example.com in DNS does not create a database connection, copy content, or grant users access.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
For a WordPress main site, WordPress Multisite is usually the cleanest design: one WordPress installation and one database, with separate tables for each site and a shared user table. A separately deployed application can also use the same database, but it needs explicit table ownership or tenant keys, restricted database permissions, coordinated migrations, and a security review. The steps below cover both designs, including DNS, web-server routing, HTTPS, cross-subdomain login, isolation tests, and recovery from common failures.
As an Amazon Associate I earn from qualifying purchases.
What “sharing the database” actually means
A subdomain is a hostname and routing decision. It is not a database feature. When someone visits stats.example.com, DNS sends the hostname to an IP address or load balancer, the web server selects an application, and that application opens a connection to a database. Sharing occurs only if the connection details and authorization model intentionally point to the same database service.
There are several different goals that are often confused:
#1 Best Overall
- Used Book in Good Condition
- Shared identity: users can sign in on both hosts, with one account and one password.
- Shared business records: profiles, game libraries, orders, scores, or entitlements are stored in records both applications can read or update.
- Shared CMS content: posts, pages, menus, and settings are visible to more than one site.
- Shared infrastructure only: both applications use the same database server but have completely separate tables.
One database can satisfy one of these goals without satisfying the others. For example, WordPress Multisite shares users by design but keeps each site’s posts and settings in that site’s own tables. Conversely, two independent applications can read a common players table while keeping their CMS data private.
Choose the architecture before changing DNS
| Approach | Installation and files | Database isolation | User and session sharing | Content sharing | Deployment independence | Migration and security considerations |
|---|---|---|---|---|---|---|
| WordPress Multisite with subdomains | One WordPress installation and one database | Each site receives its own content and options tables; the user table is shared | Built into the network model; network cookies still need secure host configuration | Not shared by default; content must be exposed or synchronized deliberately | Low: core, plugins, and themes are managed at network level | Network-wide updates and permissions; a plugin or administrator can affect every site |
| Separate WordPress installations, one database | Independent code and configuration for each host | Each installation must use a unique table prefix such as main_, projects_, or test_ |
Not automatic; sharing users or sessions requires custom integration | Separate unless an application reads another installation’s tables | High: each site can deploy independently | Strict prefix ownership, database privileges, migration ordering, and backup procedures are required |
| One custom application serving several hosts | One codebase or service handles multiple hostnames | Rows are separated with a site or tenant key, or by separate schemas | Can be shared in one application; authorization is enforced centrally | Defined by application queries and permissions | Low to medium, depending on deployment design | Every query must enforce the current host’s tenant; an omitted filter can expose another site’s records |
| Separate frontend and API | Different deployments, often on different origins | API owns the database; frontend does not connect directly | Requires credentialed CORS and correctly scoped cookies or token authentication | API endpoints decide what is exposed | High | Cross-origin policy, CSRF protection, cookie scope, and API authorization become critical |
Use Multisite when the sites are WordPress properties managed as one network. Use separate installations when teams need independent releases or plugin sets. Use a tenant-aware application when the subdomain is simply another view of the same product. Do not create a second application solely because you want a different hostname.
Free tools Windows power users keep installed
One-click scans. No signup required.
WordPress Multisite: the documented fit for WordPress subdomains
WordPress describes Multisite as a single WordPress instance with a single database. In a subdomain network, each site has its own tables for posts, comments, terms, and options, while the user table is shared. A site at news.example.com therefore does not automatically see posts from community.example.com. Network administrators can manage users centrally, but site content remains separated unless code intentionally bridges it.
When Multisite is appropriate
- The main site and subdomain use WordPress and can run the same core version.
- You want centralized user accounts, updates, themes, and network administration.
- Each subdomain can have its own pages, menus, and settings.
- You accept that a network-level plugin, administrator, or database migration can affect every site.
When to avoid it
- The subdomain requires a different framework or a release cycle unrelated to WordPress.
- Its data model is a high-volume game service, analytics system, or API that should not depend on WordPress tables.
- Teams require hard operational boundaries or separate database credentials.
- You need content shared as one undivided set rather than per-site tables.
Configuring a subdomain network
- Back up the existing site and verify restoration. A network conversion changes configuration and database behavior. Keep a tested database dump and a copy of the files before enabling it.
- Enable Multisite in the WordPress administration workflow. WordPress presents a choice between subdirectory and subdomain networks. Select subdomains only when the server and DNS can route arbitrary hostnames to the same installation.
- Set the network’s primary domain and scheme. Use the final HTTPS hostname, not a temporary staging address. Check that the site URL and home URL agree with the canonical host.
- Configure DNS. Create the required host records, or a wildcard record such as
*.example.comwhen many sites must reach the same application. A wildcard does not replace the record for the main domain; keep the apex andwwwbehavior explicit. - Configure the web server or hosting control panel. The virtual host, container ingress, or reverse proxy must accept the main domain and the subdomain pattern and route both to the WordPress installation. URL rewriting must pass the original host through to WordPress.
- Update the generated network configuration. WordPress supplies configuration values and rewrite rules for the selected server. Apply them to the correct configuration files, then reload the service using your hosting platform’s documented procedure.
- Issue certificates. Obtain a certificate covering the main host and every subdomain pattern you actually use. Test HTTPS before enabling redirects so an invalid certificate does not lock administrators out.
- Create the site in Network Admin. Enter the subdomain label, title, and administrator email. Confirm that the resulting address resolves to the same installation and that a new site receives its own table set.
Changing an existing network from subdirectories to subdomains is more than a rewrite-rule edit. Stored addresses, DNS, virtual hosts, TLS certificates, redirects, and cookie settings all have to agree. Plan a maintenance window and search the database for old hostnames where WordPress’s migration guidance requires it.
Separate WordPress installations using one database
WordPress also documents a pattern in which independent installations point to one database while each uses a different table prefix. The main site might use main_, a projects site projects_, and a test site test_. This keeps each installation’s posts, options, and metadata in its own namespace.
Prefixes are an organizational boundary, not a complete security boundary. A database account that can read and write every table can still modify another installation. Create separate database users where the database engine supports granular grants, and grant each application only the tables it owns plus explicitly approved shared tables.
Rules for the prefix model
- Choose prefixes before installation and record ownership in version control or an operations document.
- Never reuse a prefix after deleting an installation unless you have confirmed that every old table and scheduled job is gone.
- Review plugins and maintenance scripts for hard-coded table names; they must use WordPress’s table-name APIs.
- Run migrations for one installation at a time and test that they do not alter another prefix.
- Back up the complete database, then verify that a single-installation restore can be performed without overwriting unrelated tables.
This design does not automatically share WordPress users or login sessions. If both installations must recognize the same account, use a deliberate identity integration rather than pointing both at the same user table and hoping cookies line up. A shared user table can conflict with differing salts, role models, plugin expectations, or deletion policies.
Custom applications: route the host to a tenant
In Laravel, Django, or another framework, a subdomain can be only another hostname for the same application. The request’s host selects a site or tenant record, and every data access is constrained to that identifier.
Rank #3
Host resolution
At the beginning of a request, normalize the host, remove an optional port, and look it up in a table such as sites with columns for hostname, status, and database or tenant settings. Reject unknown or disabled hosts before running business queries. Never derive a tenant ID by trusting an arbitrary query parameter when the hostname is the authority.
Tenant-safe data access
For shared tables, include a required site_id or tenant_id column and enforce it in the data-access layer. A query for game profiles should conceptually include both the profile key and the current tenant key; a request that changes only the hostname must not be able to retrieve another tenant’s row. Add database constraints and indexes that reflect this compound lookup.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If tenants need stronger separation, use separate schemas or databases while keeping the same application code. That costs more operational work but narrows the effect of a query or credential mistake. Whichever model you choose, make migrations aware of every schema and test upgrades against a copy of production data.
Separate frontend on a subdomain
If app.example.com is a frontend and api.example.com owns the database, the browser calls the API; the frontend never receives database credentials. Configure the API’s allowed origins explicitly and decide whether requests include credentials. Laravel Sanctum documents that authentication from a separate-subdomain single-page application commonly fails when CORS or session-cookie settings are wrong. Credentialed CORS, an allowed origin that is not a wildcard, and a cookie domain covering the intended hosts are required for a cookie-based session.
DNS and web-server routing
Use a specific record for one subdomain
Create an A or AAAA record for play.example.com, or a CNAME when your hosting provider supplies a target hostname. Point it to the same load balancer or server that serves the application. DNS propagation and resolver caching mean that a change can appear at different times for different users.
Use a wildcard for many sites
A record such as *.example.com sends otherwise-unmatched subdomains to the same endpoint. The application still must validate each hostname; wildcard DNS should not make every arbitrary host a valid tenant. Keep explicit records for hosts that need different services, because an exact DNS record normally takes precedence over the wildcard.
Pass the original host through the proxy
Reverse proxies and container ingress must preserve the host and scheme headers that the application uses to select a tenant and generate secure URLs. If the proxy terminates TLS, configure the framework’s trusted-proxy settings so it knows the original request was HTTPS. Otherwise it may create HTTP redirects, reject secure cookies, or generate links to the wrong hostname.
HTTPS, redirects, and canonical addresses
Issue certificates for the main domain and every subdomain users can visit. A wildcard certificate covers a single subdomain level, while an apex name usually needs to be listed separately. Redirect HTTP to HTTPS only after the certificate and virtual-host mapping work for each host.
Choose one canonical spelling for every site—such as the HTTPS, non-www form—and redirect alternate spellings without changing the tenant identity. Check administrator pages, API callbacks, password-reset links, embedded assets, and sitemap URLs after the redirect is enabled.
Cross-subdomain login and cookie security
A browser cookie scoped to the parent domain can be sent to multiple subdomains, but that convenience enlarges the trust boundary. Any subdomain that can run untrusted code, host user uploads, or be taken over may be able to interfere with a parent-domain session. Django’s session documentation warns that a compromised subdomain can set a cookie for *.example.com and attack the broader session scope.
If you intentionally share a session
- Set the cookie’s
Domainto the narrowest parent that includes the participating hosts; do not use a public suffix. - Use
Secureso the cookie is sent only over HTTPS andHttpOnlyto block ordinary JavaScript access. - Choose an appropriate
SameSitevalue and test the actual navigation and API flows. - Configure CSRF protection for every state-changing endpoint, including requests initiated by a subdomain.
- Use credentialed CORS only for an explicit allow-list of origins; never combine credentials with a wildcard origin.
- Regenerate the session after login and privilege changes, and invalidate it on logout or account compromise.
If you do not need a shared session
Keep cookies host-only by omitting the parent-domain attribute. Let each application authenticate independently or use a short-lived, audience-restricted token issued by a dedicated identity service. This limits the damage if one subdomain is compromised and avoids accidental login coupling.
Database permissions, migrations, and backups
Use a database account created for the application, not an administrator account. For separate table prefixes, grant access to the owning prefix and explicitly approved shared tables. For a tenant-aware service, grant the application the minimum schema privileges needed to run its migrations and requests; use a separate migration role if the platform permits it.
Coordinate schema changes across every deployment that uses the database. A column rename that is safe for one application can break another still running the old code. Prefer backward-compatible changes—add a column, deploy code that can use both forms, backfill, then remove the old column in a later release.
Backups must include database contents, connection configuration, and the mapping between hostnames and tenants. Test a restore in an isolated environment and verify that credentials, URLs, scheduled jobs, and DNS do not accidentally point the restored copy at production.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Staging tests before production
- Resolve the main domain and each planned subdomain from an external DNS resolver and confirm the expected endpoint.
- Open every hostname over HTTPS and verify the certificate subject, chain, redirect target, and canonical URL.
- Log in on each host and inspect cookie attributes in browser developer tools:
Domain,Path,Secure,HttpOnly, andSameSite. - For a Multisite network, create sample content on one site and confirm it is absent from the other site’s normal queries.
- For separate installations, attempt maintenance and content operations with each database account and confirm that unauthorized tables are inaccessible.
- For a tenant-aware application, change only the host and repeat an object request; the response must not reveal another tenant’s record.
- Test unknown, disabled, and malformed hostnames. They should be rejected or sent to a neutral error page, not mapped to a real tenant.
- Exercise password resets, API calls, uploads, background jobs, and webhooks because they often use hard-coded domains.
- Restore the staging backup and repeat the isolation checks before approving the production change.
Troubleshooting the usual failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Subdomain shows a DNS error | No matching record, stale resolver data, or an incorrect wildcard | Authoritative DNS records, record precedence, TTL, and the hostname actually being requested |
| Subdomain displays the main site | Virtual host or application host mapping ignores the requested hostname | Proxy host preservation, server routing order, and the tenant/site lookup |
| WordPress reports “Error establishing a database connection” | Wrong credentials, database host, privileges, or configuration file | Connection settings and grants; do not assume DNS routing changed the database endpoint |
| WordPress sites overwrite each other’s data | Duplicate table prefixes or a plugin using hard-coded table names | Table names, installation configuration, and plugin compatibility |
| Login works on one host but not another | Host-only cookie, incorrect parent-domain cookie, HTTPS mismatch, or session storage mismatch | Cookie attributes, secure-proxy settings, session domain, and shared session backend |
| API calls fail in the browser but work with a direct client | CORS does not allow the frontend origin or credentials are omitted | Exact Origin, preflight response, allowed methods and headers, and credential mode |
| Users see another tenant’s records | A query, cache key, background job, or authorization check omitted the tenant key | Data-access middleware, cache namespaces, queue payloads, and authorization tests |
| HTTPS redirects loop | The proxy terminates TLS but the application believes the request is HTTP | Trusted-proxy and forwarded-scheme configuration, then clear cached redirects |
A practical decision checklist
- Choose WordPress Multisite when one WordPress team should operate several subdomain sites with shared users but separate content tables.
- Choose separate WordPress installations with unique prefixes when code, plugins, and release schedules must remain independent and shared login is optional.
- Choose a tenant-aware application when the subdomain is another site, region, game community, or dashboard within one product.
- Choose a separate frontend and API when the browser interface needs independent deployments; keep all database access in the API.
- Use a host-only session unless cross-subdomain login is a real requirement, because parent-domain cookies make every participating subdomain part of the same trust boundary.
- Do not launch until DNS, routing, TLS, database permissions, migrations, cookies, and tenant-isolation tests pass together.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
