{"id":764,"date":"2026-06-09T18:47:17","date_gmt":"2026-06-09T18:47:17","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=764"},"modified":"2026-06-09T21:59:04","modified_gmt":"2026-06-09T21:59:04","slug":"wordpress-reseller-hosting-agencies","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/wordpress-reseller-hosting-agencies\/","title":{"rendered":"WordPress Reseller Hosting for Agencies: The Infrastructure Checklist for 2026"},"content":{"rendered":"\n<script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@type\": \"FAQPage\",\n  \"mainEntity\": [\n    {\n      \"@type\": \"Question\",\n      \"name\": \"WordPress Multisite vs WordPress reseller hosting: which does AHosting recommend for agency client isolation in 2026?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Specifically, AHosting recommends WordPress reseller hosting for most agency use cases in 2026. Reseller hosting gives each client their own isolated cPanel account and PHP-FPM pool \u2014 a complete barrier Multisite cannot provide. With Multisite, all sub-sites share a single PHP process pool and one database, meaning one misbehaving plugin degrades or exposes every site on the network simultaneously. The comparison table in this guide breaks down the isolation trade-offs across all four hosting architectures in full detail.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"How does WordPress reseller hosting differ from VPS hosting for agencies managing 10 or more client sites?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Typically, WordPress reseller hosting runs multiple isolated client accounts on shared server hardware with CageFS boundaries per account. VPS hosting provides a separate virtual machine with dedicated CPU and RAM for each environment. For agencies managing 10 or more clients, reseller hosting is more cost-effective per account, but VPS becomes the right choice when any single client consistently drives high traffic or requires dedicated resource guarantees that shared infrastructure cannot reliably provide.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Do WordPress reseller hosting PHP version requirements matter more for agency client sites in 2026 than in prior years?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Indeed, PHP version control in WordPress reseller hosting matters significantly more in 2026 than in any previous year. WordPress 7.0 raised the minimum PHP to 7.4 and recommends 8.3 \u2014 meaning an agency portfolio likely contains clients at different PHP stages simultaneously. Per-account PHP version control in WHM lets a legacy client on PHP 7.4 run independently from a modern client on PHP 8.3 without forcing a network-wide version choice.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Has the cost of WordPress reseller hosting dropped enough in 2026 for agencies managing 5 to 25 client sites?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Fortunately, yes \u2014 the per-account cost of properly isolated WordPress reseller hosting has fallen meaningfully by 2026. Improved CloudLinux and LiteSpeed server density means providers can offer fully isolated accounts at lower wholesale rates than five years ago. However, the real risk has shifted: agencies choosing the cheapest plan without CageFS isolation now carry direct liability when one compromised client site affects others sharing the same server.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"When should an agency running 5 or more WordPress client sites upgrade to AHosting's WordPress reseller hosting with CageFS isolation?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Generally, the threshold is five or more client WordPress sites that require separate billing, PHP version control, or security isolation guarantees. At that scale, a single shared account creates unacceptable risk \u2014 one client's malware infection or PHP memory spike can affect every other site in the account. AHosting's WordPress reseller hosting with CageFS isolation eliminates that shared account risk, containing any issue to the specific client account where it originated.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"What happens to all other WordPress reseller hosting accounts when one client account is breached without CloudLinux CageFS?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Crucially, without CloudLinux CageFS, a PHP-executed exploit in one compromised WordPress account can traverse the shared server filesystem and read configuration files, database credentials, and WordPress core files from every other account on the same server. This is not a theoretical risk \u2014 it is how the majority of shared hosting mass-compromises actually propagate. With CageFS in place, the breach stays contained within a private virtual filesystem that the compromised PHP process cannot escape.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"What is CageFS breach containment and how does AHosting's WordPress reseller hosting use it against cross-account PHP exploits?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Technically, CageFS breach containment is the kernel-level filesystem isolation CloudLinux applies to each cPanel account, preventing PHP processes from accessing other accounts' files regardless of permission settings. AHosting's WordPress reseller hosting deploys CageFS on every account, meaning even a fully exploited WordPress plugin cannot read the database credentials or configuration files of any neighboring account on the same physical server.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"What PHP-FPM pool settings should each WordPress reseller hosting account have to prevent resource starvation on AHosting servers?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Practically, each WordPress reseller hosting account on AHosting should have a dedicated PHP-FPM pool with separate pm.max_children, pm.max_requests, and pm.process_idle_timeout settings rather than sharing a global pool. The pm.max_children value caps simultaneous PHP processes per account, preventing one client's traffic spike from consuming workers that neighboring accounts need. These per-account limits are configurable in WHM's resource manager and AHosting sets them per CloudLinux account from initial provisioning.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Does WordPress reseller hosting on AHosting support PHP 8.3 and LiteSpeed LSAPI per client account?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Notably, WordPress reseller hosting on AHosting supports PHP 8.3 on every account by default, with LiteSpeed LSAPI handling PHP execution for each client's cPanel account individually. LSAPI is LiteSpeed's native PHP communication protocol \u2014 stateful and persistent \u2014 eliminating the FastCGI process-restart overhead that Apache or Nginx configurations require on every request. Each client's PHP version is switchable through WHM's MultiPHP Manager in seconds, with no effect on any neighboring account.\"\n      }\n    },\n    {\n      \"@type\": \"Question\",\n      \"name\": \"Is reseller hosting the same as shared hosting for WordPress websites?\",\n      \"acceptedAnswer\": {\n        \"@type\": \"Answer\",\n        \"text\": \"Specifically, no \u2014 reseller hosting creates a separate cPanel account with individual resource limits and filesystem isolation for each client, while shared hosting places all sites in one account with no separation. For WordPress agencies, a breach or traffic spike in one reseller account cannot reach other accounts. Standard shared hosting has no such boundary. The comparison table in this guide shows the precise differences in PHP-FPM pool allocation, PHP version control, and security blast radius across all four hosting architectures.\"\n      }\n    }\n  ]\n}\n<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-wordpress-reseller-hosting-actually-is-beyond-the-marketing-8\">What WordPress Reseller Hosting Actually Is (Beyond the Marketing)<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-wordpress-reseller-hosting-architecture-whm-cpanel-and-what-isolation-actually-means-10\">The WordPress Reseller Hosting Architecture: WHM, cPanel, and What Isolation Actually Means<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-account-level-isolation-matters-more-than-total-disk-space-quotas-12\">Why Account-Level Isolation Matters More Than Total Disk Space Quotas<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-2026-infrastructure-checklist-what-to-demand-from-any-wordpress-reseller-hosting-plan-17\">The 2026 Infrastructure Checklist: What to Demand from Any WordPress Reseller Hosting Plan<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-1-cloudlinux-cagefs-isolation-at-the-filesystem-level-19\">1. CloudLinux CageFS \u2014 Isolation at the Filesystem Level<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-2-per-account-php-fpm-pools-performance-under-load-22\">2. Per-Account PHP-FPM Pools \u2014 Performance Under Load<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-3-dedicated-ip-availability-protecting-client-email-reputation-25\">3. Dedicated IP Availability \u2014 Protecting Client Email Reputation<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-4-per-account-php-version-control-legacy-builds-do-not-force-everyone-back-27\">4. Per-Account PHP Version Control \u2014 Legacy Builds Do Not Force Everyone Back<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-5-whm-resource-limits-preventing-the-hungry-client-problem-29\">5. WHM Resource Limits \u2014 Preventing the Hungry Client Problem<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-when-your-agencys-wordpress-portfolio-outgrows-reseller-hosting-31\">When Your Agency&#039;s WordPress Portfolio Outgrows Reseller Hosting<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-ahostings-wordpress-reseller-hosting-built-for-agencies-since-2002-36\">AHosting&#039;s WordPress Reseller Hosting: Built for Agencies Since 2002<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wordpress-reseller-hosting\">Frequently Asked Questions: WordPress Reseller Hosting for Agencies<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-multisite-vs-reseller-2026\">WordPress Multisite vs WordPress reseller hosting: which does AHosting recommend for agency client isolation in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-reseller-vs-vps-10-clients\">How does WordPress reseller hosting differ from VPS hosting for agencies managing 10 or more client sites?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-reseller-php-requirements-2026\">Do WordPress reseller hosting PHP version requirements matter more for agency client sites in 2026 than in prior years?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-reseller-cost-2026-agencies\">Has the cost of WordPress reseller hosting dropped enough in 2026 for agencies managing 5 to 25 client sites?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-upgrade-cagefs-5-sites\">When should an agency running 5 or more WordPress client sites upgrade to AHosting&#039;s WordPress reseller hosting with CageFS isolation?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-breach-without-cagefs-reseller\">What happens to all other WordPress reseller hosting accounts when one client account is breached without CloudLinux CageFS?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-cagefs-breach-containment-ahosting\">What is CageFS breach containment and how does AHosting&#039;s WordPress reseller hosting use it against cross-account PHP exploits?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-php-fpm-reseller-ahosting-starvation\">What PHP-FPM pool settings should each WordPress reseller hosting account have to prevent resource starvation on AHosting servers?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-php83-lsapi-reseller\">Does WordPress reseller hosting on AHosting support PHP 8.3 and LiteSpeed LSAPI per client account?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-reseller-vs-shared-wordpress\">Is reseller hosting the same as shared hosting for WordPress websites?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>WordPress reseller hosting gives every client their own isolated cPanel account and PHP-FPM pool \u2014 but only if the host runs CloudLinux CageFS and allocates per-account resources. Here is the infrastructure checklist for 2026.<\/p>\n<\/div>\n\n\n\n<figure class=\"wp-block-audio\"><audio controls src=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/06\/Stopping_cross-account_breaches_in_reseller_hosting.m4a\"><\/audio><figcaption class=\"wp-element-caption\">Listen: A complete audio overview of WordPress reseller hosting infrastructure for web agencies. By Matt Chrust, Director of Business Development, AHosting.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress reseller hosting gives web agencies a fundamental choice: give each client their own isolated hosting account, or stack everyone on the same shared infrastructure and rely on luck. Most agencies discover which choice they made after the fact \u2014 typically at 3 a.m., when a client&#8217;s compromised WordPress site starts sending spam through an IP that also hosts ten other clients&#8217; sites.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, the problem is not reseller hosting itself. The problem is reseller hosting without the right server architecture underneath it. Two reseller plans at similar price points can have completely different isolation models. One contains breaches to a single account. The other lets a single bad actor traverse the entire server. Understanding that difference is the starting point for every agency that manages client WordPress sites professionally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, the infrastructure question has grown more urgent in 2026. WordPress 7.0&#8217;s new AI integration layer and the updated PHP requirements it carries mean that different clients in the same agency portfolio may need different PHP versions, different memory limits, and different execution-time configurations. A reseller architecture that cannot deliver per-account control over these settings is already behind.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For agencies that are not yet managing enough client sites to justify reseller hosting, <a href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\" target=\"_blank\" rel=\"noopener\" title=\"\">AHosting&#8217;s WordPress hosting plans<\/a> offer a solid entry point \u2014 with the option to step up to reseller infrastructure as your portfolio grows.<\/p>\n\n\n\n<h2 id=\"aioseo-what-wordpress-reseller-hosting-actually-is-beyond-the-marketing-8\" class=\"wp-block-heading\">What WordPress Reseller Hosting Actually Is (Beyond the Marketing)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress reseller hosting refers to a hosting architecture where one parent account \u2014 the reseller \u2014 controls a WHM (Web Host Manager) dashboard that provisions individual cPanel accounts for each client. The reseller buys capacity in bulk from a host, divides it into sub-accounts, and bills clients at their own margin. That is the business model. The server architecture underneath it is what determines whether those client sites are actually protected from each other.<\/p>\n\n\n\n<h3 id=\"aioseo-the-wordpress-reseller-hosting-architecture-whm-cpanel-and-what-isolation-actually-means-10\" class=\"wp-block-heading\">The WordPress Reseller Hosting Architecture: WHM, cPanel, and What Isolation Actually Means<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In a WHM-based WordPress reseller hosting setup, the reseller sees a management layer above all client accounts. From WHM, the reseller can create cPanel accounts, set per-account disk quotas, set bandwidth limits, configure PHP-FPM pool parameters, and suspend or terminate accounts. Each client, however, only ever sees their own cPanel. They cannot see the WHM layer. They cannot see other clients&#8217; accounts. That is the intended design. Whether that isolation is enforced at the kernel level depends on whether the host runs CloudLinux OS with CageFS enabled.<\/p>\n\n\n\n<h3 id=\"aioseo-why-account-level-isolation-matters-more-than-total-disk-space-quotas-12\" class=\"wp-block-heading\">Why Account-Level Isolation Matters More Than Total Disk Space Quotas<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, most reseller hosting marketing focuses on disk space and account counts \u2014 &#8220;50 GB storage, up to 50 cPanel accounts.&#8221; These numbers describe capacity, not protection. A reseller plan with 50 GB and 50 accounts provides no meaningful client protection if every PHP process on the server runs as the same system user. Disk quotas stop one account from using too much storage. They do nothing to stop one account&#8217;s compromised PHP process from reading another account&#8217;s <code>wp-config.php<\/code>. For agencies managing client WordPress sites, the correct question is not &#8220;how many accounts&#8221; but &#8220;are those accounts kernel-isolated.&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Architecture<\/th><th>Client isolation<\/th><th>PHP version per client<\/th><th>Resource limits per client<\/th><th>Breach blast radius<\/th><\/tr><\/thead><tbody><tr><td>Shared WordPress Hosting (single account)<\/td><td>None \u2014 all sites in one account<\/td><td>No \u2014 server-wide version<\/td><td>No \u2014 shared pool<\/td><td>All sites in the account<\/td><\/tr><tr><td>WordPress Multisite<\/td><td>App-level only (same DB, same PHP pool)<\/td><td>No \u2014 entire network uses one version<\/td><td>No \u2014 all sub-sites share one PHP-FPM pool<\/td><td>All sub-sites on the network<\/td><\/tr><tr><td>WordPress Reseller Hosting<\/td><td>Account-level (separate cPanel per client)<\/td><td>Yes \u2014 per cPanel account via MultiPHP<\/td><td>Yes \u2014 WHM-configurable per account<\/td><td>One cPanel account (with CageFS)<\/td><\/tr><tr><td>VPS Hosting<\/td><td>Full virtual machine isolation<\/td><td>Yes \u2014 complete control<\/td><td>Yes \u2014 dedicated CPU\/RAM<\/td><td>One VPS only<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Particularly for agencies comparing Multisite against reseller accounts, the table above surfaces the difference that matters most in practice. Our detailed <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-multisite-hosting\/\" target=\"_blank\" rel=\"noopener\">WordPress Multisite hosting requirements guide<\/a> covers the server-side resource implications of Multisite networks in full \u2014 the short version is that Multisite trades isolation for centralized management, and that trade-off has a cost when any one sub-site misbehaves.<\/p>\n\n\n\n<div style=\"margin:32px 0;\">\n<svg viewBox=\"0 0 720 340\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" aria-label=\"WHM reseller hosting architecture diagram showing parent account and three isolated client cPanel accounts under CloudLinux CageFS \u2014 AHosting\" role=\"img\">\n  <title>WordPress Reseller Hosting Architecture \u2014 WHM and CageFS Client Isolation<\/title>\n  <desc>Diagram showing a WHM reseller master account at the top, connecting to three isolated client cPanel accounts below. Each client account is contained inside a CloudLinux CageFS bubble with its own PHP-FPM pool and WordPress install. A breach in Client A stays contained within its CageFS boundary and cannot reach Client B or Client C.<\/desc>\n  <defs>\n    <linearGradient id=\"bg-grad\" x1=\"0%\" y1=\"0%\" x2=\"100%\" y2=\"100%\">\n      <stop offset=\"0%\" style=\"stop-color:#0f172a;stop-opacity:1\" \/>\n      <stop offset=\"100%\" style=\"stop-color:#1e293b;stop-opacity:1\" \/>\n    <\/linearGradient>\n    <marker id=\"arrow\" markerWidth=\"8\" markerHeight=\"8\" refX=\"6\" refY=\"3\" orient=\"auto\">\n      <path d=\"M0,0 L0,6 L8,3 z\" fill=\"#2563eb\"\/>\n    <\/marker>\n  <\/defs>\n  <rect width=\"720\" height=\"340\" fill=\"url(#bg-grad)\" rx=\"10\"\/>\n  <!-- Left accent bar -->\n  <rect x=\"0\" y=\"0\" width=\"6\" height=\"340\" fill=\"#2563eb\" rx=\"3\"\/>\n  <!-- Title -->\n  <text x=\"360\" y=\"26\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#f8fafc\">WordPress Reseller Hosting Architecture \u2014 CageFS Client Isolation<\/text>\n  <!-- WHM Master Account -->\n  <rect x=\"240\" y=\"42\" width=\"240\" height=\"50\" rx=\"8\" fill=\"#2563eb\"\/>\n  <text x=\"360\" y=\"62\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#fff\">WHM \u2014 Reseller Master Account<\/text>\n  <text x=\"360\" y=\"80\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"10\" fill=\"#bfdbfe\">Create accounts \u00b7 Set limits \u00b7 Monitor all clients<\/text>\n  <!-- Arrows down -->\n  <line x1=\"200\" y1=\"92\" x2=\"140\" y2=\"140\" stroke=\"#2563eb\" stroke-width=\"1.5\" stroke-dasharray=\"4,2\" marker-end=\"url(#arrow)\"\/>\n  <line x1=\"360\" y1=\"92\" x2=\"360\" y2=\"140\" stroke=\"#2563eb\" stroke-width=\"1.5\" stroke-dasharray=\"4,2\" marker-end=\"url(#arrow)\"\/>\n  <line x1=\"520\" y1=\"92\" x2=\"580\" y2=\"140\" stroke=\"#2563eb\" stroke-width=\"1.5\" stroke-dasharray=\"4,2\" marker-end=\"url(#arrow)\"\/>\n  <!-- Client A \u2014 Breached (red tint) -->\n  <rect x=\"20\" y=\"140\" width=\"200\" height=\"160\" rx=\"10\" fill=\"#1e1020\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-dasharray=\"5,3\"\/>\n  <text x=\"120\" y=\"160\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"10\" font-weight=\"700\" fill=\"#fca5a5\">Client A cPanel \u2014 BREACH<\/text>\n  <text x=\"120\" y=\"176\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#94a3b8\">CageFS Boundary (contained)<\/text>\n  <rect x=\"40\" y=\"184\" width=\"160\" height=\"28\" rx=\"4\" fill=\"#312020\"\/>\n  <text x=\"120\" y=\"202\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#fca5a5\">PHP-FPM Pool A (isolated)<\/text>\n  <rect x=\"40\" y=\"218\" width=\"160\" height=\"24\" rx=\"4\" fill=\"#291515\"\/>\n  <text x=\"120\" y=\"234\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#fca5a5\">WordPress + MySQL (contained)<\/text>\n  <text x=\"120\" y=\"284\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#f87171\">Exploit cannot escape CageFS<\/text>\n  <!-- Block \/ X symbol -->\n  <text x=\"120\" y=\"268\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"22\" fill=\"#ef4444\">X<\/text>\n  <!-- Client B \u2014 Safe -->\n  <rect x=\"260\" y=\"140\" width=\"200\" height=\"160\" rx=\"10\" fill=\"#0f2030\" stroke=\"#22c55e\" stroke-width=\"1.5\"\/>\n  <text x=\"360\" y=\"160\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"10\" font-weight=\"700\" fill=\"#86efac\">Client B cPanel \u2014 Safe<\/text>\n  <text x=\"360\" y=\"176\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#94a3b8\">CageFS Boundary (intact)<\/text>\n  <rect x=\"280\" y=\"184\" width=\"160\" height=\"28\" rx=\"4\" fill=\"#0d2a0d\"\/>\n  <text x=\"360\" y=\"202\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#86efac\">PHP-FPM Pool B (isolated)<\/text>\n  <rect x=\"280\" y=\"218\" width=\"160\" height=\"24\" rx=\"4\" fill=\"#0a1f0a\"\/>\n  <text x=\"360\" y=\"234\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#86efac\">WordPress + MySQL (intact)<\/text>\n  <text x=\"360\" y=\"270\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#4ade80\">Unaffected by Client A breach<\/text>\n  <!-- Client C \u2014 Safe -->\n  <rect x=\"500\" y=\"140\" width=\"200\" height=\"160\" rx=\"10\" fill=\"#0f2030\" stroke=\"#22c55e\" stroke-width=\"1.5\"\/>\n  <text x=\"600\" y=\"160\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"10\" font-weight=\"700\" fill=\"#86efac\">Client C cPanel \u2014 Safe<\/text>\n  <text x=\"600\" y=\"176\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#94a3b8\">CageFS Boundary (intact)<\/text>\n  <rect x=\"520\" y=\"184\" width=\"160\" height=\"28\" rx=\"4\" fill=\"#0d2a0d\"\/>\n  <text x=\"600\" y=\"202\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#86efac\">PHP-FPM Pool C (isolated)<\/text>\n  <rect x=\"520\" y=\"218\" width=\"160\" height=\"24\" rx=\"4\" fill=\"#0a1f0a\"\/>\n  <text x=\"600\" y=\"234\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#86efac\">WordPress + MySQL (intact)<\/text>\n  <text x=\"600\" y=\"270\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"9\" fill=\"#4ade80\">Unaffected by Client A breach<\/text>\n  <!-- Footer label -->\n  <text x=\"360\" y=\"316\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"10\" fill=\"#64748b\">CloudLinux CageFS contains each account at the kernel level \u2014 no cross-account access possible<\/text>\n  <text x=\"360\" y=\"332\" text-anchor=\"middle\" font-family=\"sans-serif\" font-size=\"10\" font-weight=\"600\" fill=\"#2563eb\">AHosting.net | Est. 2002<\/text>\n<\/svg>\n<\/div>\n\n\n\n<h2 id=\"aioseo-the-2026-infrastructure-checklist-what-to-demand-from-any-wordpress-reseller-hosting-plan-17\" class=\"wp-block-heading\">The 2026 Infrastructure Checklist: What to Demand from Any WordPress Reseller Hosting Plan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Not every reseller hosting plan delivers the same infrastructure. Below are the five architectural requirements that separate a reseller plan suitable for professional WordPress agency work from one that will eventually create a client emergency.<\/p>\n\n\n\n<h3 id=\"aioseo-1-cloudlinux-cagefs-isolation-at-the-filesystem-level-19\" class=\"wp-block-heading\">1. CloudLinux CageFS \u2014 Isolation at the Filesystem Level<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, ask any prospective reseller host one question before signing: do you run <a href=\"https:\/\/www.cloudlinux.com\/\" target=\"_blank\" rel=\"noopener\">CloudLinux OS<\/a> with CageFS enabled on every account? If the answer is anything other than an unambiguous yes, walk away. CageFS creates a private virtual filesystem for each cPanel account. A PHP script executing inside one account cannot read the files or environment variables of any other account on the same server. Without CageFS, a basic <code>..\/..\/..\/<\/code> directory traversal in a single compromised WordPress plugin can expose every client&#8217;s <code>wp-config.php<\/code> file \u2014 including database credentials \u2014 to an attacker. This is not a theoretical risk. It is the most common actual impact of shared hosting compromises at the application layer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, CageFS provides protection that standard file permissions cannot replicate. Even with correctly set file ownership and <code>chmod<\/code> values, PHP running as a shared Apache or Nginx user can still read any world-readable file on the server. CageFS removes that entire attack surface by virtualizing the filesystem at the kernel level. Our guide on <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-hosting-security-2026-server-level-protection\/\" target=\"_blank\" rel=\"noopener\">server-level security for WordPress in 2026<\/a> covers how this isolation layer interacts with other server-side protections in detail.<\/p>\n\n\n\n<h3 id=\"aioseo-2-per-account-php-fpm-pools-performance-under-load-22\" class=\"wp-block-heading\">2. Per-Account PHP-FPM Pools \u2014 Performance Under Load<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, verify that your reseller host allocates a dedicated PHP-FPM pool for each cPanel account \u2014 not a single global pool shared across all clients. A PHP-FPM pool controls how many concurrent PHP processes one account can run at the same time. In a shared-pool model, a single client running a flash sale or receiving a traffic spike can consume all available PHP workers, creating 504 Gateway Timeout errors for every other client on the same server. In a per-account pool model, each client&#8217;s PHP concurrency is bounded by the limits set for that specific account. According to the <a href=\"https:\/\/www.php.net\/manual\/en\/install.fpm.php\" target=\"_blank\" rel=\"noopener\">official PHP-FPM documentation<\/a>, the three key parameters to confirm per account are <code>pm.max_children<\/code>, <code>pm.max_requests<\/code>, and the process manager type. The difference between a traffic spike affecting one client and affecting all clients depends entirely on whether these limits are enforced per account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consequently, reseller hosts that mention &#8220;PHP workers&#8221; only at the server level \u2014 not per account \u2014 are running a shared-pool model. Push for per-account PHP-FPM configuration before committing client sites. For a deeper look at how PHP-FPM pool behavior shows up in real TTFB measurements, our post on the <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-hosting-speed-in-2026-the-7-server-side-factors-no-plugin-can-fix\/\" target=\"_blank\" rel=\"noopener\">server-side factors that determine WordPress hosting speed<\/a> covers PHP worker allocation as one of the seven key variables.<\/p>\n\n\n\n<h3 id=\"aioseo-3-dedicated-ip-availability-protecting-client-email-reputation-25\" class=\"wp-block-heading\">3. Dedicated IP Availability \u2014 Protecting Client Email Reputation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Moreover, the IP address assigned to each client account has direct consequences for that client&#8217;s email deliverability. When multiple WordPress sites share a single IP address, a spam or phishing outbreak on any one site can get that IP listed on Spamhaus, Barracuda, or SURBL block lists. Every other client on that IP then inherits the blacklisting problem \u2014 their transactional emails, order confirmations, and password reset messages stop reaching inboxes. A reseller host that offers dedicated IP assignment per cPanel account eliminates that shared IP liability entirely. Each client&#8217;s email reputation stands on its own. Confirm whether dedicated IPs are available per account and what the cost or plan structure is before signing a reseller agreement.<\/p>\n\n\n\n<h3 id=\"aioseo-4-per-account-php-version-control-legacy-builds-do-not-force-everyone-back-27\" class=\"wp-block-heading\">4. Per-Account PHP Version Control \u2014 Legacy Builds Do Not Force Everyone Back<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, agency portfolios almost always contain a mix of PHP versions. One client&#8217;s site runs a theme last updated in 2021 that has not been validated against PHP 8.3. Another client&#8217;s WooCommerce store runs the latest stack and benefits from PHP 8.3&#8217;s performance gains. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to the <a href=\"https:\/\/www.php.net\/supported-versions.php\" target=\"_blank\" rel=\"noopener\">PHP supported versions lifecycle<\/a>, PHP 8.1 reached end of life on December 31, 2025 \u2014 meaning any site still on 8.1 is running without security patches. In a reseller hosting environment with per-account PHP version control via WHM&#8217;s MultiPHP Manager, each client account can independently run PHP 8.0, 8.1, 8.2, or 8.3 without affecting any other account. Without per-account PHP control, upgrading the server PHP version to 8.3 can break a legacy client&#8217;s site immediately \u2014 creating a support emergency across the entire portfolio every time a PHP version ages out.<\/p>\n\n\n\n<h3 id=\"aioseo-5-whm-resource-limits-preventing-the-hungry-client-problem-29\" class=\"wp-block-heading\">5. WHM Resource Limits \u2014 Preventing the Hungry Client Problem<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, the reseller&#8217;s WHM dashboard should allow setting hard resource limits per cPanel account \u2014 specifically CPU usage, RAM consumption, I\/O throughput, and simultaneous process count. Without these limits, a single client running a poorly coded plugin that fires hundreds of database queries per page load can consume disproportionate server CPU, degrading performance across every other client account. WHM&#8217;s package manager allows creating hosting packages with defined resource ceilings that enforce these limits at the CloudLinux resource-management layer. According to <a href=\"https:\/\/docs.cpanel.net\/whm\/packages\/add-a-package\/\" target=\"_blank\" rel=\"noopener\">cPanel&#8217;s WHM documentation<\/a>, packages define the resource envelope each cPanel account operates within. Confirm that your reseller host uses CloudLinux-enforced resource limits \u2014 not soft advisory limits that can be overridden under load.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"WordPress Reseller Hosting for Agencies \u2014 Infrastructure Checklist 2026\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/k29dwaRE5Fs?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 id=\"aioseo-when-your-agencys-wordpress-portfolio-outgrows-reseller-hosting-31\" class=\"wp-block-heading\">When Your Agency&#8217;s WordPress Portfolio Outgrows Reseller Hosting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Reseller hosting is the right architecture for most agencies managing between 5 and 25 client WordPress sites on a shared server with strong isolation. However, certain portfolio conditions signal that the reseller model is no longer sufficient. The three clearest signals are sustained high traffic across multiple clients, clients requiring custom server configurations (Redis, custom PHP extensions, or non-standard cron schedules), and portfolios with 25 or more active WordPress installs requiring consistent sub-200ms TTFB under concurrent load.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, agencies whose clients include WooCommerce stores processing regular order volumes benefit significantly from dedicated resource allocation per site rather than shared-but-isolated allocation. According to <a href=\"https:\/\/w3techs.com\/technologies\/details\/cm-wordpress\" target=\"_blank\" rel=\"noopener\">W3Techs, WordPress powers 43% of all websites<\/a> \u2014 meaning the majority of client site requests are dynamic WordPress PHP requests, not static files. At that scale, shared hardware with per-account isolation starts showing its ceiling.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, the WordPress 7.0 AI features require 512 MB memory per PHP process for AI API calls. Agencies whose clients are actively using AI-connected WordPress sites may find that the memory profile per account no longer fits comfortably on shared reseller hardware. The upgrade path at that point leads to VPS infrastructure \u2014 where each client or group of clients gets guaranteed CPU and RAM, not a capped share of a shared pool.<\/p>\n\n\n\n<div id=\"ah-tier-widget\" style=\"background:#f8fafc;border:1px solid #e2e8f0;border-radius:12px;padding:28px 24px;margin:32px 0;max-width:640px;font-family:sans-serif;\">\n<style>\n#ah-tier-widget h3 { font-size:1.05rem; font-weight:700; color:#1e293b; margin:0 0 18px; border-left:4px solid #2563eb; padding-left:12px; }\n.ah-tier-q { margin-bottom:18px; }\n.ah-tier-q p { font-size:0.9rem; font-weight:600; color:#334155; margin:0 0 8px; }\n.ah-tier-btn { display:inline-block; background:#f1f5f9; border:1.5px solid #cbd5e1; color:#1e293b; border-radius:6px; padding:7px 14px; font-size:0.82rem; cursor:pointer; margin:0 6px 6px 0; user-select:none; transition:background 0.15s,border-color 0.15s; }\n.ah-tier-btn:hover { background:#eff6ff; border-color:#2563eb; }\n.ah-tier-btn.ah-selected { background:#2563eb; color:#fff; border-color:#1d4ed8; }\n#ah-tier-result { display:none; margin-top:22px; padding:18px; border-radius:10px; border-left:4px solid #2563eb; }\n.ah-result-low { background:#f0fdf4; border-color:#22c55e; }\n.ah-result-med { background:#eff6ff; border-color:#2563eb; }\n.ah-result-high { background:#faf5ff; border-color:#a855f7; }\n.ah-result-ent { background:#fff7ed; border-color:#f97316; }\n#ah-tier-result h4 { margin:0 0 8px; font-size:1rem; font-weight:700; }\n#ah-tier-result p { margin:0 0 12px; font-size:0.88rem; color:#475569; }\n.ah-tier-cta { display:inline-block; background:#2563eb; color:#fff; border:none; border-radius:6px; padding:9px 18px; font-size:0.85rem; font-weight:600; cursor:pointer; text-decoration:none; }\n.ah-tier-cta:hover { background:#1d4ed8; }<\/style>\n<h3>Agency Hosting Tier Finder<\/h3>\n<div class=\"ah-tier-q\">\n  <p>1. How many client WordPress sites do you actively manage?<\/p>\n  <span class=\"ah-tier-btn\" data-q=\"1\" data-val=\"0\">1-5 sites<\/span>\n  <span class=\"ah-tier-btn\" data-q=\"1\" data-val=\"1\">6-20 sites<\/span>\n  <span class=\"ah-tier-btn\" data-q=\"1\" data-val=\"2\">21-50 sites<\/span>\n  <span class=\"ah-tier-btn\" data-q=\"1\" data-val=\"3\">50+ sites<\/span>\n<\/div>\n<div class=\"ah-tier-q\">\n  <p>2. Do your clients need separate billing or individual control panel access?<\/p>\n  <span class=\"ah-tier-btn\" data-q=\"2\" data-val=\"0\">No \u2014 I manage everything centrally<\/span>\n  <span class=\"ah-tier-btn\" data-q=\"2\" data-val=\"1\">Yes \u2014 clients need their own login<\/span>\n<\/div>\n<div class=\"ah-tier-q\">\n  <p>3. Do any client sites have WooCommerce stores or regular traffic spikes?<\/p>\n  <span class=\"ah-tier-btn\" data-q=\"3\" data-val=\"0\">No \u2014 mostly informational sites<\/span>\n  <span class=\"ah-tier-btn\" data-q=\"3\" data-val=\"2\">Yes \u2014 at least one high-traffic or ecommerce site<\/span>\n<\/div>\n<div class=\"ah-tier-q\">\n  <p>4. Do any clients require a specific PHP version different from the rest of the portfolio?<\/p>\n  <span class=\"ah-tier-btn\" data-q=\"4\" data-val=\"0\">No \u2014 all on modern PHP<\/span>\n  <span class=\"ah-tier-btn\" data-q=\"4\" data-val=\"1\">Yes \u2014 we have legacy or custom builds<\/span>\n<\/div>\n<div id=\"ah-tier-result\"><\/div>\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var container = document.getElementById('ah-tier-widget');\n    if (!container) { return; }\n    var answers = { \"1\": -1, \"2\": -1, \"3\": -1, \"4\": -1 };\n    var resultDiv = document.getElementById('ah-tier-result');\n    if (!resultDiv) { return; }\n    container.addEventListener('click', function(e){\n      var btn = e.target;\n      if (!btn) { return; }\n      if (btn.className.indexOf('ah-tier-btn') === -1) { return; }\n      var q = btn.getAttribute('data-q');\n      var val = btn.getAttribute('data-val');\n      if (!q) { return; }\n      var siblings = container.querySelectorAll('[data-q=\"' + q + '\"]');\n      for (var i = 0; i < siblings.length; i++) {\n        siblings[i].classList.remove('ah-selected');\n      }\n      btn.classList.add('ah-selected');\n      answers[q] = parseInt(val, 10);\n      var allAnswered = true;\n      for (var k in answers) {\n        if (answers[k] === -1) {\n          allAnswered = false;\n        }\n      }\n      if (allAnswered) {\n        showResult();\n      }\n    });\n    var tierUrls = {\n      \"low\": \"https:\/\/www.ahosting.net\/wordpress-hosting.html\",\n      \"med\": \"https:\/\/www.ahosting.net\/reseller-hosting.html\",\n      \"high\": \"https:\/\/www.ahosting.net\/vps-hosting.html\",\n      \"ent\": \"https:\/\/www.ahosting.net\/dedicated-server.html\"\n    };\n    resultDiv.addEventListener('click', function(e) {\n      var btn = e.target;\n      if (!btn) { return; }\n      if (btn.className.indexOf('ah-tier-cta') === -1) { return; }\n      var tier = btn.getAttribute('data-tier');\n      if (!tier) { return; }\n      var dest = tierUrls[tier];\n      if (dest) { window.location.href = dest; }\n    });\n    function showResult() {\n      var score = answers[\"1\"] + answers[\"2\"] + answers[\"3\"] + answers[\"4\"];\n      var html = '';\n      if (score <= 1) {\n        html = '<div class=\"ah-result-low\"><h4>Recommended: WordPress Shared Hosting<\/h4><p>Your portfolio is small and centrally managed. A strong shared WordPress hosting plan with CageFS isolation gives you the protection you need without reseller overhead.<\/p><button class=\"ah-tier-cta\" data-tier=\"low\" type=\"button\">View WordPress Plans<\/button><\/div>';\n      } else if (score <= 3) {\n        html = '<div class=\"ah-result-med\"><h4>Recommended: WordPress Reseller Hosting<\/h4><p>Your agency portfolio is ready for proper per-account isolation, separate client logins, and per-account PHP version control. Reseller hosting with CloudLinux CageFS is the right architecture.<\/p><button class=\"ah-tier-cta\" data-tier=\"med\" type=\"button\">View Reseller Plans<\/button><\/div>';\n      } else if (score <= 5) {\n        html = '<div class=\"ah-result-high\"><h4>Recommended: VPS Hosting<\/h4><p>High traffic, ecommerce clients, or a large portfolio signals that shared reseller hardware is reaching its ceiling. VPS hosting gives each account guaranteed CPU and RAM rather than a capped share.<\/p><button class=\"ah-tier-cta\" data-tier=\"high\" type=\"button\">View VPS Plans<\/button><\/div>';\n      } else {\n        html = '<div class=\"ah-result-ent\"><h4>Recommended: Dedicated Server<\/h4><p>At 50-plus sites with high traffic and complex requirements, you need dedicated hardware. A dedicated server eliminates all resource contention and gives your agency complete infrastructure control.<\/p><button class=\"ah-tier-cta\" data-tier=\"ent\" type=\"button\">View Dedicated Plans<\/button><\/div>';\n      }\n      resultDiv.innerHTML = html;\n      resultDiv.style.display = 'block';\n    }\n  });\n})();\n<\/script>\n<\/div>\n\n\n\n<h2 id=\"aioseo-ahostings-wordpress-reseller-hosting-built-for-agencies-since-2002-36\" class=\"wp-block-heading\">AHosting&#8217;s WordPress Reseller Hosting: Built for Agencies Since 2002<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AHosting has been running WHM\/cPanel reseller infrastructure since its founding in 2002 \u2014 which means 22 years of reseller hosting experience predates most of the modern WordPress agency model entirely. The infrastructure stack has evolved considerably over that period, but the core architectural principle has remained constant: each client account gets its own isolated environment, enforced at the kernel level through CloudLinux CageFS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, every reseller account on AHosting&#8217;s infrastructure runs under CloudLinux OS with CageFS enabled per account. Each cPanel account created through WHM gets its own PHP-FPM process pool, its own resource limits enforceable through WHM&#8217;s package manager, and its own MultiPHP Manager configuration so the reseller can independently set the PHP version for each client. LiteSpeed Web Server handles request processing via LSAPI \u2014 the same native LiteSpeed-PHP communication protocol used across all AHosting plans \u2014 which delivers noticeably lower TTFB on dynamic WordPress pages compared to standard mod_php or even FastCGI configurations. [MATT: VERIFY \u2014 confirm CageFS is enabled per reseller client cPanel account specifically, and confirm LSAPI on reseller tier]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, AHosting includes a dedicated IP address option for client accounts, which is critical for the email reputation protection discussed in the infrastructure checklist above. Unlike hosts that charge $2 to $5 extra per dedicated IP as an add-on, AHosting&#8217;s approach keeps IP isolation available as a standard option across the reseller tier. <a href=\"https:\/\/www.ahosting.net\/reseller-hosting.html\" target=\"_blank\" rel=\"noopener\" title=\"\">AHosting&#8217;s WordPress reseller hosting plans<\/a> are built for web agencies that need professional-grade client isolation without the overhead of managing their own VPS stack per client.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, agencies that grow beyond the reseller tier have a natural path upward. <a href=\"https:\/\/www.ahosting.net\/vps-hosting.html\" target=\"_blank\" rel=\"noopener\" title=\"\">AHosting&#8217;s VPS hosting for agencies<\/a> provides dedicated virtual machine resources for portfolios where guaranteed CPU and RAM per account matter more than the cost efficiency of shared hardware. For the largest portfolios \u2014 agencies managing 50 or more active WordPress sites with consistent high traffic \u2014 <a href=\"https:\/\/www.ahosting.net\/dedicated-server.html\" target=\"_blank\" rel=\"noopener\" title=\"\">dedicated server solutions<\/a> from AHosting provide complete hardware isolation and full root access with the same 22-year support infrastructure behind them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to <a href=\"https:\/\/wordpress.org\/about\/requirements\/\" target=\"_blank\" rel=\"noopener\">WordPress&#8217;s official server requirements<\/a>, PHP 8.1 is the current minimum and PHP 8.3 is recommended for 2026. AHosting&#8217;s reseller infrastructure runs PHP 8.3 by default on all new accounts, with the option to switch any individual cPanel account to a different PHP version through WHM&#8217;s MultiPHP Manager in seconds \u2014 no support ticket required.<\/p>\n\n\n\n<h2 id=\"faq-wordpress-reseller-hosting\" class=\"wp-block-heading\">Frequently Asked Questions: WordPress Reseller Hosting for Agencies<\/h2>\n\n\n\n<h3 id=\"faq-ahosting-multisite-vs-reseller-2026\" class=\"wp-block-heading\">WordPress Multisite vs WordPress reseller hosting: which does AHosting recommend for agency client isolation in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, AHosting recommends WordPress reseller hosting for most agency use cases in 2026. Reseller hosting gives each client their own isolated cPanel account and PHP-FPM pool \u2014 a complete barrier Multisite cannot provide. With Multisite, all sub-sites share a single PHP process pool and one database, meaning one misbehaving plugin degrades or exposes every site on the network simultaneously. The comparison table in this guide breaks down the isolation trade-offs across all four hosting architectures in full detail.<\/p>\n\n\n\n<h3 id=\"faq-reseller-vs-vps-10-clients\" class=\"wp-block-heading\">How does WordPress reseller hosting differ from VPS hosting for agencies managing 10 or more client sites?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, WordPress reseller hosting runs multiple isolated client accounts on shared server hardware with CageFS boundaries per account. VPS hosting provides a separate virtual machine with dedicated CPU and RAM for each environment. For agencies managing 10 or more clients, reseller hosting is more cost-effective per account, but VPS becomes the right choice when any single client consistently drives high traffic or requires dedicated resource guarantees that shared infrastructure cannot reliably provide.<\/p>\n\n\n\n<h3 id=\"faq-reseller-php-requirements-2026\" class=\"wp-block-heading\">Do WordPress reseller hosting PHP version requirements matter more for agency client sites in 2026 than in prior years?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Indeed, PHP version control in WordPress reseller hosting matters significantly more in 2026 than in any previous year. WordPress 7.0 raised the minimum PHP to 7.4 and recommends 8.3 \u2014 meaning an agency portfolio likely contains clients at different PHP stages simultaneously. Per-account PHP version control in WHM lets a legacy client on PHP 7.4 run independently from a modern client on PHP 8.3 without forcing a network-wide version choice.<\/p>\n\n\n\n<h3 id=\"faq-reseller-cost-2026-agencies\" class=\"wp-block-heading\">Has the cost of WordPress reseller hosting dropped enough in 2026 for agencies managing 5 to 25 client sites?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fortunately, yes \u2014 the per-account cost of properly isolated WordPress reseller hosting has fallen meaningfully by 2026. Improved CloudLinux and LiteSpeed server density means providers can offer fully isolated accounts at lower wholesale rates than five years ago. However, the real risk has shifted: agencies choosing the cheapest plan without CageFS isolation now carry direct liability when one compromised client site affects others sharing the same server.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-upgrade-cagefs-5-sites\" class=\"wp-block-heading\">When should an agency running 5 or more WordPress client sites upgrade to AHosting&#8217;s WordPress reseller hosting with CageFS isolation?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Generally, the threshold is five or more client WordPress sites that require separate billing, PHP version control, or security isolation guarantees. At that scale, a single shared account creates unacceptable risk \u2014 one client&#8217;s malware infection or PHP memory spike can affect every other site in the account. AHosting&#8217;s WordPress reseller hosting with CageFS isolation eliminates that shared account risk, containing any issue to the specific client account where it originated.<\/p>\n\n\n\n<h3 id=\"faq-breach-without-cagefs-reseller\" class=\"wp-block-heading\">What happens to all other WordPress reseller hosting accounts when one client account is breached without CloudLinux CageFS?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Crucially, without CloudLinux CageFS, a PHP-executed exploit in one compromised WordPress account can traverse the shared server filesystem and read configuration files, database credentials, and WordPress core files from every other account on the same server. This is not a theoretical risk \u2014 it is how the majority of shared hosting mass-compromises actually propagate. With CageFS in place, the breach stays contained within a private virtual filesystem that the compromised PHP process cannot escape.<\/p>\n\n\n\n<h3 id=\"faq-cagefs-breach-containment-ahosting\" class=\"wp-block-heading\">What is CageFS breach containment and how does AHosting&#8217;s WordPress reseller hosting use it against cross-account PHP exploits?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Technically, CageFS breach containment is the kernel-level filesystem isolation CloudLinux applies to each cPanel account, preventing PHP processes from accessing other accounts&#8217; files regardless of permission settings. AHosting&#8217;s WordPress reseller hosting deploys CageFS on every account, meaning even a fully exploited WordPress plugin cannot read the database credentials or configuration files of any neighboring account on the same physical server.<\/p>\n\n\n\n<h3 id=\"faq-php-fpm-reseller-ahosting-starvation\" class=\"wp-block-heading\">What PHP-FPM pool settings should each WordPress reseller hosting account have to prevent resource starvation on AHosting servers?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Practically, each WordPress reseller hosting account on AHosting should have a dedicated PHP-FPM pool with separate <code>pm.max_children<\/code>, <code>pm.max_requests<\/code>, and <code>pm.process_idle_timeout<\/code> settings rather than sharing a global pool. The <code>pm.max_children<\/code> value caps simultaneous PHP processes per account, preventing one client&#8217;s traffic spike from consuming workers that neighboring accounts need. These per-account limits are configurable in WHM&#8217;s resource manager and AHosting sets them per CloudLinux account from initial provisioning. <\/p>\n\n\n\n<h3 id=\"faq-ahosting-php83-lsapi-reseller\" class=\"wp-block-heading\">Does WordPress reseller hosting on AHosting support PHP 8.3 and LiteSpeed LSAPI per client account?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, WordPress reseller hosting on AHosting supports PHP 8.3 on every account by default, with LiteSpeed LSAPI handling PHP execution for each client&#8217;s cPanel account individually. LSAPI is LiteSpeed&#8217;s native PHP communication protocol \u2014 stateful and persistent \u2014 eliminating the FastCGI process-restart overhead that Apache or Nginx configurations require on every request. Each client&#8217;s PHP version is switchable through WHM&#8217;s MultiPHP Manager in seconds, with no effect on any neighboring account. <\/p>\n\n\n\n<h3 id=\"faq-reseller-vs-shared-wordpress\" class=\"wp-block-heading\">Is reseller hosting the same as shared hosting for WordPress websites?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, no \u2014 reseller hosting creates a separate cPanel account with individual resource limits and filesystem isolation for each client, while shared hosting places all sites in one account with no separation between them. For WordPress agencies, a breach or traffic spike in one reseller account cannot reach other accounts on the same server. Standard shared hosting has no such boundary. The comparison table in this guide shows the precise differences in PHP-FPM pool allocation, PHP version control, and security blast radius across all four hosting architectures.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      var chev = document.createElement('span');\n      chev.className = 'ahfaq-chev ahfaq-chev-closed';\n      chev.setAttribute('aria-hidden', 'true');\n      h3.appendChild(chev);\n      h3.setAttribute('role', 'button');\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      answer.classList.add('ahfaq-collapsed');\n      h3.addEventListener('click', function(){ doToggle(h3, answer, chev); });\n      h3.addEventListener('keydown', function(e){\n        if (e.key === 'Enter') { e.preventDefault(); doToggle(h3, answer, chev); }\n        if (e.key === ' ') { e.preventDefault(); doToggle(h3, answer, chev); }\n      });\n    }\n    function doToggle(h3, answer, chev) {\n      var isOpen = h3.getAttribute('aria-expanded') === 'true';\n      if (isOpen) {\n        answer.classList.remove('ahfaq-open');\n        answer.classList.add('ahfaq-collapsed');\n        h3.setAttribute('aria-expanded', 'false');\n        chev.classList.add('ahfaq-chev-closed');\n        chev.classList.remove('ahfaq-chev-open');\n      } else {\n        answer.classList.remove('ahfaq-collapsed');\n        answer.classList.add('ahfaq-open');\n        h3.setAttribute('aria-expanded', 'true');\n        chev.classList.remove('ahfaq-chev-closed');\n        chev.classList.add('ahfaq-chev-open');\n      }\n    }\n  });\n})();\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR WordPress reseller hosting gives every client their own isolated cPanel account and PHP-FPM pool \u2014 but only if the host runs CloudLinux CageFS and allocates per-account resources. Here is the infrastructure checklist for 2026. WordPress reseller hosting gives web agencies a fundamental choice: give each client their own isolated hosting account, or stack everyone [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":766,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[8],"tags":[54,56,53,57,55,52],"class_list":["post-764","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-cloudlinux-cagefs","tag-php-fpm-pools","tag-reseller-hosting-agency","tag-web-agency-hosting","tag-whm-cpanel","tag-wordpress-reseller-hosting"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=764"}],"version-history":[{"count":3,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/764\/revisions"}],"predecessor-version":[{"id":771,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/764\/revisions\/771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/766"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}