Most hosting plans permit additional domains on the same account, which is convenient and means the sites share resources, a security boundary, and an account. That is fine for a staging copy or a small second venture, and a poor arrangement for anything you would not want taken down by a problem with the other.
How it works
Adding a domain to an existing account creates a folder inside your hosting and points that domain at it. Both sites run from the same account, using the same allocation of resources.
Most panels distinguish a few types. An addon domain is a separate site with its own domain. A subdomain is a section of your existing domain, useful for staging. A parked domain points a second domain at the same site, which is what you use for a .ca and .com pair.
The mechanics are the same in each case, and the implications differ.
What the sites share
| Shared | Consequence |
|---|---|
| Resources | A busy period on one site slows the other |
| Storage and file count | One site's growth consumes the other's headroom |
| The account login | Anyone with access to one has access to both |
| The server address | Both sites are on the same address |
| Security boundary | A compromise of one can reach the other |
| Suspension | An account suspended for any reason takes both sites down |
The last two are the ones that matter. Files on the same account are frequently reachable from each other, which means a vulnerable installation on the neglected second site is a route into the first.
When sharing is fine
- A staging copy of your main site, which is the best use of a subdomain.
- A small second venture of your own, where a problem affecting both is inconvenient rather than serious.
- A parked domain pointing at your main site, which is not really a second site at all.
- A temporary project you intend to remove.
When they should be separate
- A client's site. Hosting a client on your own account means your problem is their outage, and their compromise is your exposure.
- Anything with different security requirements, such as a site handling personal information.
- A site you might sell or hand over, since separating it later is considerably more work than starting separate.
- Anything with meaningful traffic, which will consume the resources the other site needs.
- A site you will not maintain, which is the specific case that creates the security problem.
That last one deserves emphasis. The risk is rarely the main site. It is the abandoned second site running an outdated installation nobody has updated in three years, which is the route in.
The abandoned second site problem
The most common way this arrangement causes damage.
A second site is added for a project, a test, or a venture that did not proceed. It runs software that stops being updated. Two years later it is compromised through a known vulnerability, and because it shares the account, the main site is reachable.
The prevention is simple and rarely done: if a second site is no longer needed, remove it rather than leaving it. Files that do not exist cannot be exploited.
Worth looking at your own hosting for anything you do not recognise, since installations from old projects accumulate quietly.
Email, which surprises people
Adding a domain usually lets you create mailboxes at it, on the same account.
That is convenient and it means both domains' mail depends on one account. It also means a sending reputation problem caused by one domain can affect the other, since they share a server address.
For a business where email matters, which is all of them, that is an argument for keeping anything experimental well away from the domain your invoices go out from.
What to check before adding one
- Whether your plan allows it, and how many.
- Whether resources are shared or allocated, which differs between hosts.
- Whether backups cover both sites and can be restored independently.
- Whether the second site will actually be maintained.
- Whether you would mind both being down together.
That last question settles most cases. If the answer is that it would be a serious problem, the sites belong on separate accounts, and the cost of a second small plan is considerably less than the cost of finding out the hard way.
The staging case, specifically
The one arrangement worth setting up deliberately.
A subdomain holding a copy of your site, password protected so nobody else can reach it, gives you somewhere to test updates and changes before they go live. It shares the account, which is fine, since it is a copy of the site it sits beside.
That is two minutes in the control panel and it is what makes testing before deploying practical rather than theoretical, which is the habit that prevents most self-inflicted outages, as covered in what a hosting control panel lets you do.
Frequently asked questions
Can I host more than one website on the same plan?
Most plans allow it. The sites then share resources, storage, the account login, the server address, and a security boundary.
What is the risk of hosting two sites together?
A compromise of one can reach the other, since files on the same account are often mutually reachable, and an account suspension for any reason takes both sites down at once.
When is sharing an account fine?
For a staging copy, a small second venture of your own, a parked domain pointing at the main site, or a temporary project you intend to remove.
Should I host a client's site on my account?
No. Your problem becomes their outage and their compromise becomes your exposure. Anything you might sell or hand over should also start on its own account.
What causes most problems with second sites?
Abandoned ones. A site added for a project that did not proceed, running software nobody updates, becomes the route into the main site two years later.
What is the best use of a second domain slot?
A password-protected staging subdomain holding a copy of your site, which makes testing updates before they go live practical rather than theoretical.
West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.
Old projects sitting on your hosting account?
We audit what is actually installed, remove what is abandoned, and separate anything that should not share a security boundary with your main site.
Start a Conversation