How to Host Multiple WordPress Sites on LEMP With Separate Users

The safest baseline for unrelated WordPress sites on one LEMP VPS is one complete service identity per site: a Unix account, document root, Nginx server block, PHP-FPM pool and local socket, database, and database user. This arrangement limits routine file and database access between sites and makes a compromise easier to contain, although it is not a substitute for host-level security.

Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.

The per-site layout that works

Map every domain to its own resources rather than placing several installations under one shared account. A practical layout is:

#	Preview	Product	Price
1		Gaoye Blue Light Blocking Glasses	$9.99	Buy on Amazon
2		Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and...	$6.59	Buy on Amazon
3		LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men	$9.99	Buy on Amazon
4		Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack	$9.99	Buy on Amazon
5		HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″...	$59.98	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Repeat this pattern for every additional domain. One Nginx server {} block owns one domain and document root; its PHP location sends requests only to that site’s socket. A separate database and credential set prevents a WordPress installation from routinely reading another installation’s tables.

What isolation does—and does not—protect

Unix users and PHP-FPM pools reduce the normal blast radius. If site1 is compromised through a plugin, the attacker runs as site1 and should not be able to read files owned by site2. Separate database accounts similarly prevent ordinary SQL access to another site’s database.

#1 Best Overall

Sale

Gaoye Blue Light Blocking Glasses

• BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
• EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
• COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
• LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
• WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

$9.99

Buy on Amazon

This is a permission boundary, not a virtual machine boundary. The Nginx master process, database service, kernel, host administrator and shared system resources remain common. A vulnerable plugin, a permissions mistake or a service-level exploit can still become a server-wide incident. Patch WordPress, PHP, Nginx and the database; inspect writable paths; keep off-site backups; monitor logs; and maintain an incident and restore procedure.

Choose independent installations or Multisite first

Use independent installations when boundaries matter

• Different customers or owners need separate administration.
• Sites require different plugins, themes or PHP lifecycles.
• Filesystem and database boundaries are more important than shared management.
• You want to remove or restore one site without operating on the others.

Use WordPress Multisite for shared administration

Multisite runs several sites from one WordPress installation and shares core files and network administration. It is useful when sites are managed as one network, but it is not equivalent to separate Unix users and PHP pools. Network configuration is generally required when Multisite is created, and all sites share the installation’s core and operational lifecycle. Decide this before provisioning the server; converting a collection of independent sites later is a migration project.

Provision the server and DNS

1. Create an A or AAAA record for each domain and confirm that every name resolves to the VPS before testing Nginx.
2. Install Nginx, PHP-FPM, the PHP extensions required by your chosen WordPress version and plugins, and a MySQL-compatible database server using your distribution’s supported packages.
3. Confirm the PHP-FPM service name and configuration directory. The pool directory commonly contains a versioned path represented here by /etc/php/*/fpm/pool.d/.
4. Create separate log locations and decide how logs will be retained and monitored for each site.

Do not expose PHP-FPM on a public address. A local Unix socket keeps the FastCGI endpoint on the machine and avoids publishing an interface that could permit arbitrary code execution if misconfigured.

Create one Unix account and file tree per site

Create non-login service accounts

Create a non-login account and matching group for each site, then create its document root. The exact account-management command varies by distribution; use the system tool that creates a service user with a disabled shell and no interactive login. For example, the resulting identities should be named site1 and site2, not a single shared www-data owner.

/home/site1/public/
/home/site1/logs/
/home/site2/public/
/home/site2/logs/

Set the WordPress tree’s owner and group to the corresponding account. Parent directories must allow Nginx to traverse the path, but they should not grant one site’s account read access to another site’s home. Avoid placing all sites below a directory that is broadly readable by every service account.

Use deliberate permissions

• Do not use chmod 777.
• Keep wp-config.php readable only by the site account and the processes that genuinely need it.
• Make only deliberately writable paths, such as wp-content/uploads, writable by the PHP process.
• Keep plugin, theme and core code non-writable at runtime when your update workflow permits it.
• Grant Nginx directory traversal and socket access without granting it ownership of every site’s files.

WordPress file operations normally run as the user who owns the files. Therefore, choose ownership together with your update method: automatic updates require the PHP process to write the relevant files, while a deployment process may instead update files outside the web request and then set ownership back to the site account.

Rank #2

Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)

• WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
• AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
• PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
• ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
• COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

$6.59

Buy on Amazon

Create a PHP-FPM pool for every site

Each pool has a unique name, Unix identity and local socket. A minimal pool for the first site is:

[site1]
user = site1
group = site1
listen = /run/php/site1.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
pm = ondemand
pm.max_children = 8

Create a second file with a different pool name, user, group and socket:

[site2]
user = site2
group = site2
listen = /run/php/site2.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
pm = ondemand
pm.max_children = 8

The socket owner and group above allow the Nginx worker account to connect without making the socket world-writable. Verify that your distribution’s PHP-FPM service creates /run/php at boot and that the socket permissions survive a restart.

Size pools from the machine, not a template

pm.max_children = 8 is an example, not a universal capacity target. Pool sizing depends on available RAM, PHP version, traffic and workload. Multiple pools multiply the potential number of PHP workers, so count the limits across all sites and leave memory for Nginx, the database, the operating system and filesystem cache. Start conservatively, observe memory and queueing, then adjust.

PHP-FPM supports per-pool users, groups, sockets or ports and additional per-pool settings. Prefer Unix sockets for local traffic. Never bind FPM to an Internet-facing address, and firewall any administrative interfaces that must exist.

Give each domain its own Nginx server block

Put one configuration file in /etc/nginx/sites-available/ for each site and enable it using your distribution’s standard mechanism. The first site can use this pattern:

Rank #3

Sale

LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men

• Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
• Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
• Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
• ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
• Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

$9.99

Buy on Amazon

server {
    listen 80;
    server_name example.com www.example.com;
    root /home/site1/public;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        try_files $uri =404;
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/site1.sock;
    }

    location ~* /.ht {
        deny all;
    }
}

For the second site, change server_name, root and fastcgi_pass:

server {
    listen 80;
    server_name example2.com www.example2.com;
    root /home/site2/public;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        try_files $uri =404;
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/site2.sock;
    }

    location ~* /.ht {
        deny all;
    }
}

The try_files $uri =404 check prevents Nginx from passing nonexistent PHP paths to FPM. The front-controller rule sends WordPress permalinks to index.php. Reusable include files can hold common WordPress restrictions, but inspect every copied rule: a typo in a restriction can create an exposure.

Before every reload, run:

nginx -t

Reload only after the test reports a valid configuration. A successful syntax test does not prove that the document root, socket path and filesystem permissions are correct, so perform an application request after reloading.

Create least-privilege databases and credentials

Create one database and one database user for each installation. Grant each account privileges only on its own database, and use a different password for every site. Never reuse a database password across sites.

site1_db       site1_db_user       (unique password)
site2_db       site2_db_user       (different unique password)

The exact SQL syntax and administrative login depend on your MySQL-compatible server, but the required result is the same: site1_db_user can access site1_db and has no reason to access site2_db. Store the selected credentials only in the matching site’s wp-config.php. Restrict that file’s permissions after writing it, and do not place all site credentials in a shared configuration file readable by every account.

Install and configure WordPress separately

1. Download WordPress from WordPress.org for each site and place the files in the matching document root.
2. Create that site’s wp-config.php with its own database name, user, password and database host.
3. Set a unique table prefix if it fits your operational conventions; do not treat a prefix as a substitute for separate databases and users.
4. Ensure the file owner and permissions match the update workflow you selected.
5. Open the domain in a browser and complete the installer, confirming that it is using the intended database credentials.

Installing each copy in its own root prevents accidental overlap. Do not copy one site’s entire configuration into another and then edit only the domain name: check database credentials, salts, filesystem ownership and any absolute paths individually.

Rank #4

Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack

• Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
• Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
• 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
• Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
• USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

$9.99

Buy on Amazon

Bring the services online and verify the mapping

1. Start or reload PHP-FPM after adding the pools, then confirm that both /run/php/site1.sock and /run/php/site2.sock exist with the expected owner, group and mode.
2. Enable the Nginx site files and run nginx -t.
3. Reload Nginx and request each domain independently.
4. Confirm that a PHP diagnostic or WordPress response for the first domain is served by the first pool and that the second domain reaches only the second pool. Remove any temporary diagnostic file immediately after testing.
5. Log in to each wp-admin, save a permalink structure, open a post URL and upload a test image.
6. Verify that scheduled tasks run for each installation and that its logs record failures separately.

If one domain displays the other site’s content, check the Nginx server_name and root first. If PHP returns a gateway error, check the socket path, FPM service status and socket permissions. If uploads fail, inspect ownership and the specific uploads directory rather than making the entire tree writable.

Add HTTPS and operational controls

Use your distribution’s supported ACME client to issue certificates, redirect HTTP to HTTPS, and monitor renewal. HTTPS protects WordPress logins and visitor traffic; certificate issuance is separate from the per-user filesystem design but should be completed before normal use.

• Keep per-site access, PHP-FPM, Nginx and database logs available for investigation.
• Back up databases and files off the VPS, with a retention policy that lets you recover an individual site.
• Test restores instead of assuming that a completed backup is usable.
• Patch WordPress core, plugins, themes, PHP, Nginx and the database promptly.
• Review writable directories after plugin or theme changes.
• Monitor disk space, memory, FPM worker saturation, certificate expiry and failed logins.
• Document which administrator or deployment process owns updates for each site.

When a site is suspected of compromise, isolate its account and pool, preserve logs, rotate that site’s database and administrator credentials, inspect writable files, and assess the whole host rather than assuming the other sites are unaffected.

Common mistakes and targeted fixes

All sites run as one account

Symptom: a plugin process can read every document root. Fix: create a distinct Unix account, ownership tree and PHP-FPM pool for each site, then check parent-directory traversal permissions.

Nginx points every domain at one socket

Symptom: PHP code executes under the wrong site’s identity or changes appear in the wrong installation. Fix: compare each server_name, root and fastcgi_pass line with its intended account and socket.

The socket is inaccessible

Symptom: Nginx returns a FastCGI connection error after a pool restart. Fix: verify that the socket exists, that listen.owner, listen.group and listen.mode permit the Nginx worker to connect, and that the pool loaded without a syntax error.

Best Value

Sale

HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs

• Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
• Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
• Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
• Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
• Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.

$59.98

Buy on Amazon

Updates fail after hardening

Symptom: WordPress asks for FTP credentials or cannot write an update. Fix: reconcile file ownership with the chosen update process. Make only the required paths writable by the site account or deploy updates through an approved administrative process; do not solve the error with chmod 777.

One database account is reused

Symptom: a stolen wp-config.php credential grants access to several sites. Fix: create separate databases, users and passwords, grant each user only its own database, and rotate credentials for the affected site.

FastCGI is published publicly

Symptom: a network scan finds a PHP-FPM port. Fix: switch to a local Unix socket or bind the service only to a protected local interface and firewall it. PHP-FPM’s FastCGI endpoint must not be an Internet service.

Copied Nginx restrictions break a site—or leave a hole

Symptom: legitimate files return forbidden responses, or sensitive files are downloadable. Fix: review each include and location rule for the specific site, test normal pages and uploads, and explicitly deny hidden configuration files such as .ht*.

Pre-launch checklist

• Every domain resolves to the VPS and has exactly one intended Nginx server block.
• Every site has a separate non-login Unix account and document root.
• Every PHP-FPM pool uses the matching account and a unique local socket.
• Nginx can traverse the path and connect to the socket, but site accounts cannot read one another’s trees.
• Each site has its own database, least-privilege database user and unique password.
• wp-config.php is restricted and its ownership agrees with the update workflow.
• nginx -t passes before reloads.
• HTTPS, renewal monitoring, backups, restore tests, logs and patching are operating.
• Permalinks, uploads, wp-admin and scheduled tasks work independently for every site.

Bottom line

For unrelated WordPress sites on one LEMP VPS, pair each domain with its own Unix user, document root, PHP-FPM pool and socket, Nginx server block, database and database credentials. That design prevents routine cross-site reads when permissions are correct and gives you a smaller incident blast radius. It does not isolate the kernel or shared services, so disciplined patching, HTTPS, monitoring, backups and tested restores remain essential.

Quick Recap

SaleBestseller No. 1

Gaoye Blue Light Blocking Glasses

$9.99

Bestseller No. 2

Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)

$6.59

SaleBestseller No. 3

LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men

$9.99

Bestseller No. 4

Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack

$9.99

SaleBestseller No. 5

HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs

$59.98

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.