2

I'm aware that multi-site exists but I've never used it.

Could I use it in a type of reseller mode, where I ran one install of WordPress but provided completely separate sites for separate users? Such that the users didn't even know the other sites existed, they just saw their site?

Every time I search I keep finding articles about the opposite: letting users work across multiple sites, not keeping them inside one site.

2

No, in a multisite, all sites have the same users table and user meta.

Keep in mind if you did manage this though, it would be trivial for them to find out it was a multisite based on code, and they could very easily break out of their site.


As an aside, you could run filters to strip out everything that makes multisite multisite, and make the user tables separate, but:

  • now the only benefit is that creating sites is easier
  • Network admin roles and capabilities will be broken
  • Any plugins or themes that do anything remotely related to multisite will reveal the truth, unavoidably
  • The entire setup would require ongoing updates and maintenance to fix issues
  • Plugin compatibility problems and bugs
  • Issue with cookies and domains
  • The Network admin user panel would be useless if not broken
  • Any plugin that uses switch_to_blog could cause data corruption, including navigation in the network admin
  • A lot of additional code would need writing to setup new users etc, and create the existing tables with the new prefixes
  • Every user related API would need modifying

I estimate at least a months worth of work from an experienced developer, with an extended maintenance contract. Longer for the average developer, with no guarantee it will work well.

Or you could write a script that lists WP instances and lets you download and install new ones. Better yet, use WP docker images and provision them automatically.

This is a classic XY problem. You have a problem "How do I spin up WP installs quickly so I can resell them", but rather than ask that question, you devised a solution and asked how to implement the solution instead

5
  • > all sites have the same users table and user meta Thank you. That doesn't actually tell me that I can't do what I want though. When users log in, would they see a "my sites" menu listing all the sites on that server? Even if they were only able to use some of them? May 16 '18 at 1:59
  • @AmbroseChapel Yes, by default "my sites" menu entry would appear. Though this can be hidden by filtering it. Also check out blog posts like this one. - Tom, could you link to what you mean by "easily break out of their site"?
    – kero
    May 16 '18 at 7:43
  • You always see a my sites menu, even if only 1 site is listed. Try it out for yourself, grab a local dev environment and test it. What you want could probably be done, in the same way you can cook food with a blender. It' possible but it's not a good idea, and the effort required and ongoing maintenance I extreme. I could write an answer that does what you want but it would take you several days of testing and work to setup, and the end result would be incredibly hacky/fragile, undoing all of the benefits of having a multisite in the first place, coupled with major compatibility problems
    – Tom J Nowell
    May 16 '18 at 11:37
  • On the other hand, scripting thing to just setup a brand new WP instance is orders of magnitude easier, with zero additional maintenance cost. If you think that you can do this and make things easy for yourself, you're very much mistaken. Down this path is only pain and misery
    – Tom J Nowell
    May 16 '18 at 11:38
  • @kero nope, any API that uses multisite would reveal the ruse and the existence of the other sites in the network. is_multisite() would be all that's needed to reveal the truth. What's more, what happens when they want to convert their install to a multisite install?
    – Tom J Nowell
    May 16 '18 at 11:45
0

I don't know if there is a way to have fully separate users (where you can create a new user with a username already taken on another website) but it is possible to not reveal other websites to your users. However the users of a website are not used on another website (except the administrator) unless you use the feature "Add Existing User", so it is not possible to know users of other websites by using a URL like /author/username.

By default, WordPress leaks other websites which is not good for privacy I think. I had to configure the password reset link to stop leaking the primary website, see Password Reset for Users on a Multisite Subsite.

Also I used the plugin WP Mail SMTP to configure the From email address of the default PHP mailer to use the website domain name because it was leaking the primary website domain name.

And when using BuddyPress, I had to uncheck the option "Show the Toolbar for logged out users" because the WordPress logo was leaking the primary website URL. However BuddyPress will display users of other websites even if you did not add them to your website (if they tried to log in on your website), when visiting the URL /members.

It is also recommended to disable directory listing on your web server, otherwise people will see all the files of other websites in your uploads directory (this does not prevent people from guessing and finding uploaded files of other websites).

If you successfully log in to a website with the username only used on another website or both websites, it will disclose the other website URL in the menu My Sites. But if your username is not added to the website, you will not see other websites.

An advantage of using multisite is that you will not have WordPress core files duplicated for several websites. To avoid people finding other websites on your multisite installation, I would recommend checking after each update if there is no leak. In the end, it is like using the VirtualHost feature of Apache, there is always a risk that a hacker getting unauthorized access to one website, gets access to other websites on the same server.

Here are other interesting questions about having multiple websites with the same WordPress core without using the multisite feature:

Can we use one WordPress installation for multiple databases, domains and content directories

https://stackoverflow.com/questions/8794063/leaving-wordpress-core-files-untouched-shared-between-multiple-blog-installation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.