[{"data":1,"prerenderedAt":251},["ShallowReactive",2],{"seo-verification":3,"blog-shared-hosting-or-vps-for-agency-client-site-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-shared-hosting-or-vps-for-agency-client-site-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":178,"ctaBody":179,"ctaButton":180,"ctaUrl":181,"relatedPosts":182},528,"shared-hosting-or-vps-for-agency-client-site",{"fr":12,"en":10,"ar":13,"es":14},"choisir-vps-ou-mutualise-site-client-agence","استضافة-مشتركة-أم-vps-لموقع-عميل-الوكالة","hosting-compartido-o-vps-para-sitio-de-cliente-agencia","VPS or shared hosting for a client site: a decision grid","Shared hosting or VPS for a client site: comparison table, monthly maintenance hours, a five-question grid and the signals that call for a migration.",9,0,false,"2026-10-29T00:00:00+00:00","2026-10-29T15:45:55+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},5,"Comparison","comparatif","bg-info\u002F10 text-info",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fchoisir-vps-ou-mutualise-site-client-agence-poster.svg","Every new client site forces the agency to choose: shared hosting or a VPS. A VPS promises power and root access, but it also makes the agency the client's system administrator: kernel, PHP, firewall, backups, on-call duty. The 2026 vulnerabilities make the point, from PHP2Shell on 21 October 2026 to Fragnesia in May 2026. This guide compares both models criterion by criterion, puts a number on maintenance in hours per month under an explicit assumption, offers a five-question decision grid and lists the signals that justify migrating, in either direction.",[34,38,78,81,84,87,90,117,136,139,150,171,175],{"type":35,"title":36,"body":37},"h2","The real criterion: who applies the patches","The question \"which one is more powerful?\" almost always leads to the VPS. The useful question for an agency is a different one: when a critical flaw is disclosed on a Tuesday evening, who patches this client's server? On cPanel shared hosting, the host does. The kernel, the PHP interpreter, the server firewall and the monitoring of the machine are not your job, and you keep the relationship with the client. On a VPS, all of that becomes your scope from the first minute, weekends included. That is not a defect of the VPS: it is the price of the freedom it offers, with root, persistent services and a custom stack. The table below sets each criterion against the person who handles it, because that line, far more than the RAM figures, changes your workload. Here we reason in responsibilities, not raw performance.",{"type":39,"title":40,"headers":41,"rows":45},"comparison","Shared hosting and VPS, criterion by criterion",[42,43,44],"Criterion","Shared hosting (who handles it)","VPS (who handles it)",[46,50,54,58,62,66,70,74],[47,48,49],"Root access","No, bounded cPanel accounts: the host","Yes, full: the agency",[51,52,53],"Isolation between sites","cPanel accounts isolated from each other: the host","One VPS per client, or a shared blast radius if several sites live together: the agency",[55,56,57],"Kernel updates","Applied on the shared machine: the host","Planned update then reboot: the agency",[59,60,61],"PHP updates","Patches pushed to the server: the host","Packages to update and test: the agency",[63,64,65],"Firewall","Server firewall: the host","To configure and keep current: the agency",[67,68,69],"Backups","Depends on the plan, weekly on entry plans and daily on Pro and Agency: the host","Strategy to define and test: the agency",[71,72,73],"Monitoring","Machine monitored by the host, site watched by you: shared","Availability, disk, certificates, services: the agency",[75,76,77],"Scaling","Per-account limits, then a higher plan or a VPS: the host and the agency","Resources adjusted on demand, architecture in your hands: the agency",{"type":35,"title":79,"body":80},"PHP2Shell: the PHP patch, on shared hosting and on a VPS","On 21 October 2026, the PHP project published the advisory for CVE-2026-109619, nicknamed PHP2Shell, a remote code execution rated critical and fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. On shared hosting, the host applies the patch; on a VPS, you must update PHP on each machine, then reload PHP-FPM. The dedicated PHP2Shell article details the inventory and the mitigations.",{"type":35,"title":82,"body":83},"Fragnesia: when the kernel is the agency's","Fragnesia (CVE-2026-46300) is a Linux kernel flaw allowing local privilege escalation to root. On shared hosting, the host schedules the kernel update; on a VPS, the kernel is the agency's, so its maintenance window and its reboot, since a VPS that is never rebooted keeps the old kernel in memory. Check the running kernel with `uname -r`. The dedicated Fragnesia article details the flaw and the mitigations.",{"type":35,"title":85,"body":86},"Isolation and backups: what protects a client from the others","On shared hosting, each site lives in an isolated cPanel account: a compromised site does not, in principle, give access to the neighbour's files. On a VPS, isolation depends on how you split things. One VPS per client draws a clear boundary, but multiplies the machines to keep current. Several sites mixed on one VPS lower the bill, but share a common blast radius: a vulnerable plugin on one site exposes all the others, and stolen root access takes them all. For backups, do not generalise. On shared hosting, the frequency depends on the plan: weekly on entry plans, daily on the Pro and Agency plans. Check the plan sheet before promising a restore frequency to a client. On a VPS, nothing is decided for you: the backup strategy, its off-machine destination and above all the restore test are for the agency to define and verify. A backup that has never been restored is still a hypothesis.",{"type":35,"title":88,"body":89},"How many maintenance hours per month and per site","The figures in the table below are not a benchmark: they are this article's assumptions, to be replaced by your own measurements. They assume one standard Linux VPS per client, run by a competent person, against a site on a shared account whose host runs the machine. The total gives the order of magnitude: about 0.75 h per month and per site on shared hosting, against about 4.5 h per month and per VPS. For twelve clients, that is 9 h against 54 h per month. Compare with your internal hourly rate: if the hours gap, valued at that rate, exceeds the monthly price gap, for the same billing period, between 799 DH\u002Fyear and 99 DH\u002Fmonth, the VPS costs more than its listed price. Grouping several sites on one VPS divides the hours per site, but enlarges the blast radius. The VPS administration option can move part of these hours to ServOrbit; check its scope on the VPS page. The blog guides are provided, without support coverage.",{"type":39,"title":91,"headers":92,"rows":96},"The article's assumption: maintenance hours per month",[93,94,95],"Task","Shared (per site)","VPS (per server)",[97,101,104,106,109,112,114],[98,99,100],"Kernel and reboots","0 h","0.5 h",[102,99,103],"PHP and system packages","1 h",[105,99,100],"Firewall and hardening",[107,108,103],"Backups and restore test","0.25 h",[110,108,111],"Monitoring and alerts","0.75 h",[113,108,111],"Incidents and on-call",[115,111,116],"Total","4.5 h",{"type":118,"title":119,"steps":120},"steps","Decision grid: five yes or no questions",[121,124,127,130,133],{"title":122,"body":123},"Does traffic durably exceed the plan's limits?","No: shared hosting is enough. Yes, sustained and not a one-off spike: go to question 2. A one-off spike is handled first with caching and a higher plan.",{"title":125,"body":126},"Does the client have several sites or heavy services?","No: stay on shared hosting as long as the process limits hold. Yes: a VPS becomes credible, go to question 3.",{"title":128,"body":129},"Do you need root or persistent services?","No: shared hosting remains the default choice. Yes, for a daemon, a job queue, a specific database engine or a non-standard stack: the VPS is justified, go to question 4.",{"title":131,"body":132},"Must this client be isolated from the others?","Yes, for sensitive data or a contractual requirement: plan a VPS dedicated to this client. No: the per-account cPanel isolation of shared hosting is already enough.",{"title":134,"body":135},"Do you have the administration skills and the on-call cover?","No: do not open a VPS without planned administration, stay on shared hosting or look at the VPS administration option. Yes: the VPS is validated, and you budget the hours from the previous table.",{"type":35,"title":137,"body":138},"The signals that justify changing model","A hosting model is not chosen once and for all. Two families of signals trigger a migration, in either direction. Towards the VPS, they are technical constraints that keep recurring: the same ceiling hit every month, a service that shared hosting does not allow. Towards shared hosting, it is the opposite: the machine costs more time than it earns. Note the date and cause of every incident tied to limits or administration. A practical rule of this article: a single incident is an accident, three in a quarter are a signal.",{"type":140,"title":141,"items":142},"ul","Seven migration signals",[143,144,145,146,147,148,149],"**Towards the VPS: limited processes or memory** — limit errors keep returning despite optimising the site, the plan's ceiling is reached.","**Towards the VPS: root or persistent services** — the project requires a daemon, a worker, a search engine or a system version that shared hosting does not offer.","**Towards the VPS: sustained load** — the load stays high for several weeks, not only during a one-off campaign.","**Towards the VPS: specific firewall or stack** — a network rule, a reverse proxy or a precise runtime becomes a client requirement.","**Towards shared hosting: low traffic** — the site fits comfortably in a shared plan and the VPS sits idle most of the time.","**Towards shared hosting: no admin skills available** — nobody on the team can apply a kernel or PHP patch within the day.","**Towards shared hosting: on-call load above the value** — the maintenance hours exceed what the client pays for the site.",{"type":118,"title":151,"steps":152},"Migrating with minimal downtime: six steps",[153,156,159,162,165,168],{"title":154,"body":155},"Back up the source","Take a full backup of the files and the database, then check that it restores on a test machine before touching anything.",{"title":157,"body":158},"Lower the DNS TTL","At least 24 to 48 hours before the switch, bring the record TTL down to 300 seconds, then check with `dig +short your-domain.com`.",{"title":160,"body":161},"Build the target","Install the stack on the VPS, or create the cPanel account, copy the files and the database, then reproduce the PHP configuration and scheduled tasks.",{"title":163,"body":164},"Test before the switch","Test the target without touching DNS using `curl -I --resolve your-domain.com:443:IP_CIBLE https:\u002F\u002Fyour-domain.com\u002F`, then walk through forms, payment and mail sending.",{"title":166,"body":167},"Switch over","Freeze writes on the source if the site receives any, make a final copy of the database, then change the A record. Keep the TTL short during the switch.",{"title":169,"body":170},"Monitor and close out","Watch the logs for 48 hours, keep the source untouched for a few days, then raise the TTL again and remove the old environment.",{"type":172,"title":173,"body":174},"tip","A tie-break rule for a portfolio","Start from shared hosting for every new client site, and move to a VPS only on a written signal: a limit reached, a need for root, an isolation requirement. Keep a table per client with the model, the date of the last kernel and PHP update, and the last tested restore. A VPS whose row is out of date is a debt you carry in the client's place.",{"type":35,"title":176,"body":177},"The official documentation","PHP2Shell security advisory (GitHub, PHP project) : https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp\n\nDebian entry for Fragnesia : https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-46300\n\nSecurity Affairs coverage of Fragnesia : https:\u002F\u002Fsecurityaffairs.com\u002F192145\u002Fsecurity\u002Flinux-kernel-bug-fragnesia-allows-local-root-access-attacks.html\n\nSupported PHP versions : https:\u002F\u002Fwww.php.net\u002Fsupported-versions.php","Leave the infrastructure to ServOrbit for sites without root","For client sites that do not need root, cPanel web hosting leaves the infrastructure and its patches to ServOrbit: you keep the client relationship. Plans start at 199 DH\u002Fyear.","See web hosting","\u002Fhebergement-web",[183,205,221,238],{"id":184,"slug":185,"slugs":186,"title":190,"excerpt":191,"readTime":192,"views":193,"isPinned":19,"publishedAt":194,"updatedAt":195,"category":196,"categories":202,"featuredImage":29,"bgImage":30,"posterImage":204,"relatedSolution":29},489,"php2shell-cve-2026-109618-109619-patch-php",{"fr":187,"en":185,"ar":188,"es":189},"php2shell-cve-2026-109618-109619-mettre-a-jour-php","php2shell-cve-2026-109618-109619-تحديث-php","php2shell-cve-2026-109618-109619-actualizar-php","PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619","PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.",16,1,"2026-10-22T00:00:00+00:00","2026-10-27T23:58:43+00:00",{"id":197,"name":198,"slug":199,"color":200,"icon":201},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[203],{"id":197,"name":198,"slug":199,"color":200,"icon":201},"\u002Fblog\u002Fcovers\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php-poster.svg",{"id":206,"slug":207,"slugs":208,"title":212,"excerpt":213,"readTime":214,"views":18,"isPinned":19,"publishedAt":215,"updatedAt":216,"category":217,"categories":218,"featuredImage":29,"bgImage":30,"posterImage":220,"relatedSolution":29},521,"monthly-security-audit-checklist-client-vps-agency",{"fr":209,"en":207,"ar":210,"es":211},"checklist-audit-securite-mensuel-vps-clients-agence","قائمة-تدقيق-أمان-vps-شهرية-للعملاء-للوكالات","auditoria-seguridad-mensual-vps-clientes-agencia-checklist","Monthly client VPS security audit: a 45-minute checklist","Seven checks to run every month on a client VPS: updates, kernel, SSH accounts, ports, certificates, backups, logs. Includes a dated one-page report.",10,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:22+00:00",{"id":197,"name":198,"slug":199,"color":200,"icon":201},[219],{"id":197,"name":198,"slug":199,"color":200,"icon":201},"\u002Fblog\u002Fcovers\u002Fchecklist-audit-securite-mensuel-vps-clients-agence-poster.svg",{"id":222,"slug":223,"slugs":224,"title":228,"excerpt":229,"readTime":214,"views":18,"isPinned":19,"publishedAt":215,"updatedAt":216,"category":230,"categories":235,"featuredImage":29,"bgImage":30,"posterImage":237,"relatedSolution":29},520,"end-of-life-calendar-2027-hosting-agencies",{"fr":225,"en":223,"ar":226,"es":227},"calendrier-fins-de-vie-hebergement-2027-agence","جدول-نهاية-الدعم-2027-استضافة-الوكالات","calendario-fin-de-vida-2027-hosting-agencias","2027 end-of-life calendar: PHP, PostgreSQL, Node.js, Ubuntu","Dated calendar from November 2026 to end of 2027: PostgreSQL 14, PHP 8.2, Node.js 22, Ubuntu 22.04. Sources, actions and a method to group work by client.",{"id":231,"name":232,"slug":233,"color":234,"icon":233},3,"Deployment","deploiement","bg-success\u002F10 text-success",[236],{"id":231,"name":232,"slug":233,"color":234,"icon":233},"\u002Fblog\u002Fcovers\u002Fcalendrier-fins-de-vie-hebergement-2027-agence-poster.svg",{"id":239,"slug":240,"slugs":241,"title":245,"excerpt":246,"readTime":214,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":247,"categories":248,"featuredImage":29,"bgImage":30,"posterImage":250,"relatedSolution":29},524,"fragnesia-cve-2026-46300-linux-kernel-php2shell",{"fr":242,"en":240,"ar":243,"es":244},"fragnesia-cve-2026-46300-noyau-linux-php2shell","ثغرة-fragnesia-cve-2026-46300-نواة-لينكس-php2shell","fragnesia-cve-2026-46300-kernel-linux-php2shell","Fragnesia CVE-2026-46300: patch the Linux kernel (PHP2Shell)","Fragnesia (CVE-2026-46300), chained with PHP2Shell, leads to root. Fixed kernels by distribution, esp4\u002Fesp6\u002Frxrpc workaround, checks and traces.",{"id":197,"name":198,"slug":199,"color":200,"icon":201},[249],{"id":197,"name":198,"slug":199,"color":200,"icon":201},"\u002Fblog\u002Fcovers\u002Ffragnesia-cve-2026-46300-noyau-linux-php2shell-poster.svg",1793289285014]