Guide: many sites, one server
How to host multiple websites on Windows Server IIS
One Windows Server can host dozens of websites on the same IP address. IIS tells them apart by host name, and each site should have its own folder, application pool, database account and certificate, so one hacked or runaway site cannot take the others with it. Here is how to set that up properly, by hand or with one form in ServerMaid.
Server setup £99 £49.50 plus Websites and SSL £79, £39.50 per server for twelve months, unlimited websites. 30-day money-back promise.
The manual route
Setting up each website by hand
- Point the domain at the server. An A record for
example.comandwww.example.comto the server's IP address. Every site on the server can share that one address. - Create a folder per site. For example
D:\Sites\example.com\wwwroot, with a private folder beside it (not inside it) for configuration, logs and backups the web must never serve. - Create an application pool per site. Each pool runs as its own identity (
IIS AppPool\example.com), in its own worker process. A memory leak or crash in one site recycles that pool only. - Set permissions per site. Give the pool identity read access to its own folder and write access only where the application uploads (for WordPress,
wp-content\uploads). No site's identity should be able to read another site's folder. - Add the site with host-name bindings. In IIS, add a website with that folder and pool, and bindings for
example.comandwww.example.comon port 80. IIS routes each request by the Host header. - Add HTTPS with SNI. Get a certificate covering both names, bind port 443 for each host name with Require Server Name Indication ticked. SNI lets every site on the one IP address present its own certificate. Then redirect HTTP to HTTPS and pick www or bare domain as the one address.
- Give each site its own database. A database and an account with rights on that database only. A shared account means one compromised site can read every site's data.
- Retire the Default Web Site. Stop it or remove its bindings, so a request for an unknown name does not show the IIS welcome page or the wrong website.
- Repeat for every site, and keep a record. Renew each certificate before it expires, back each site up separately, and write it all down.
Why sites should be kept apart
The same job, by hand and with ServerMaid
By hand
- Nine steps per website, in three different tools
- Sites dropped into the DefaultAppPool and
C:\inetpub\wwwrootbecause it is quicker - One database account shared by every site
- A certificate that expires because its renewal was set up by hand
- A new site's binding that clashes with an old one and takes it offline
With ServerMaid
- One form: domain, www or not, PHP version, database yes or no
- Its own folder, private folder, application pool and least-privilege permissions
- Its own database and account, with the details in the site's private folder
- Free SSL for both names, bound with SNI and renewed automatically
- A preview of every change first, and a clash check against existing bindings
How it works
Add a website in one form, as many times as you like
Fill in the form
The domain, whether to include www, the PHP version and whether it needs a database. ServerMaid checks the domain points at this server before asking for a certificate.
Preview, then add
A checklist shows every step it will take. Press Add website and watch each one tick off: folder, pool, permissions, database, bindings, certificate, redirect.
Upload and go live
Upload the site as a zip with its database, or import it from your old server. Each site then has its own row on the Websites page, with backups and repair per site.
How many websites can one server host?
ServerMaid does not count websites: Websites and SSL covers as many as the server can carry. In practice the limit is memory. A small brochure site uses very little; a busy WooCommerce shop can use a gigabyte or more. A 4 GB VPS typically hosts a dozen or more small PHP sites comfortably, and the health score tells you when memory or disk is getting tight.
Hosting sites for clients? See Windows hosting for web agencies for Agency licences across several servers.
Questions about hosting several websites on IIS
Do I need a separate IP address for each HTTPS website?
No. With Server Name Indication (SNI), supported by every current browser, each site on one IP address presents its own certificate. ServerMaid binds every site with SNI.
Can different websites use different PHP versions?
Yes, with the Multiple PHP lines module: each website chooses its PHP line, so an older application and a new one share the server.
What stops one website affecting the others?
Separate application pools (processes), separate identities with folder permissions per site, and separate database accounts. A crash, leak or break-in stays inside one site.
Can I host ASP.NET sites alongside?
IIS can, but ServerMaid manages PHP websites. Sites you created yourself are listed as unmanaged and left untouched.
Is there a limit on websites?
No. Websites and SSL is £79 £39.50 per server for twelve months with unlimited websites and free certificates for each. See pricing.
Unlimited websites, each one kept apart
Own folder, pool, database and free SSL for every site, from one form.