White Label Hosting for Agencies: A Practical Guide

What white label hosting actually means

For an agency, white label means your client only ever deals with you: your name on the invoice, your support desk, often your branding in the control panel and your own nameservers. The infrastructure provider is real, but it works for you and does not talk to your clients.

Two honest caveats. First, white label is not invisibility. A technically curious client can trace the provider through an IP WHOIS lookup (regional registries such as the RIPE NCC publish who networks are registered to), reverse DNS or email headers. White labelling protects the commercial relationship, not a technical secret. Second, reselling does not offload responsibility. To your client, you are the host. When the site goes down, they call you.

Still, for many agencies it is the right call. Site, care plan and hosting sit in one relationship, clients stop buying the cheapest plan they can find and then asking you to fix it, and a cost line becomes recurring revenue.

Three models: WHM reseller, managed multi-account, dedicated cloud

“Agency hosting” covers very different products. The difference that matters is who touches what.

WHM/cPanel reseller

You get a WHM account and create a separate cPanel account for each client, with packages and quotas you define inside the limits your provider sets. According to the cPanel documentation, resellers can use their own nameservers (say, ns1.youragency.com) while individual cPanel accounts cannot, and the provider can enable cPanel interface customisation for resellers: logo, favicon, menu colour, documentation and help links. That branding does not extend to WHM itself. The server still belongs to the provider, so the OS, available PHP versions and server-level backups are its job.

Managed multi-account hosting

The provider creates and administers a separate account for each of your clients. You get logins and delegated access, and you open tickets on the agency's behalf. No WHM, no package setup: you ask, they do. It suits agencies where nobody wants to be the sysadmin, at the cost of some autonomy on routine tasks.

Dedicated cloud (VPS or server with a panel)

Your own machine, with a panel you install and accounts you create. Full freedom over versions, caching, cron jobs and configuration, but patching, monitoring, backups and licences become yours. On licences: cPanel is now sold in tiers based on the number of accounts (reseller accounts count too), with a per-account fee above the top tier. The bill grows with your client base, so budget for it from day one.

Protecting your client relationships

The classic fear: “if the provider can see my clients, sooner or later it will poach them.” The fix is not trust. It is a contract, backed by a few operational choices.

• Non-solicitation: the provider commits in writing not to market services to your end clients, directly or through third parties, for the life of the agreement and a defined period afterwards.
• Direct contact handling: if your client contacts the provider, the request is routed back to you, not handled. Put it in writing rather than relying on good manners.
• Confidentiality: domains, email addresses and contacts the provider sees for technical reasons are not used for anything else.
• Two-tier billing: the provider invoices only the agency, and the agency invoices its clients at prices it sets.
• Clean exit: export formats and timelines for files, databases and mailboxes if the relationship ends.

One more rule that looks like it cuts the other way but protects you too: register domains in the client's name. ICANN states that registrants must provide accurate information for WHOIS and assume sole responsibility for the registration and use of their domain; country-code domains add their own registry rules. A domain held in the agency's name is the most common trigger for ugly offboardings, and clients who know they can leave freely tend to stay longer.

GDPR and DPAs: controller, processor, sub-processor

If you host sites for clients in the EU or EEA, personal data on those sites (contact forms, orders, user accounts) flows through a chain. The client is usually the controller; your agency, running the service on its behalf, is a processor; the infrastructure provider is a sub-processor. The EDPB's Guidelines 07/2020 use exactly this case: a hosting service storing data for a company is a processor, and an Article 28 GDPR agreement is required. The UK applies its own version, the UK GDPR.

• Art. 28(2): you cannot engage another processor without the controller's prior written authorisation, specific or general. Under a general authorisation you must tell the client about additions or replacements so they can object.
• Art. 28(4): the sub-processor must take on, in substance, the same data protection obligations you have, and you remain liable to the controller for its performance.
• Art. 28(3)(g): when the service ends, the data must be deleted or returned, at the controller's choice.

In practice: ask your provider for its DPA and its sub-processor list, including where data is stored, and mirror both in your agreement with each client. The GDPR does not require data to stay in a particular country; it requires you to know where it is and on what basis it leaves the EEA, if it does.

Margins and the real cost of support

Margin on the plan price is easy to calculate and almost always misleading. The real cost of resold hosting is time: emails landing in spam, certificates to sort out, PHP upgrades, the client who “can't see the site” after editing their own DNS.

Monthly margin per client =
    price charged to the client
  - share of the plan (plan cost / active clients)
  - domains, licences and add-ons
  - support hours x internal hourly cost
  - allowance for bad debt and surprises

Support hours usually decide the outcome, and email is the textbook case. Since February 2024, Google has required everyone sending to personal Gmail accounts to use SPF or DKIM, valid PTR records and TLS; senders above 5,000 messages a day need both SPF and DKIM, plus DMARC, From-domain alignment and one-click unsubscribe on marketing mail. A client with half-configured DNS keeps opening tickets until someone fixes it, and that someone is you.

• Bundle hosting into a care plan or retainer with a written scope (updates, backups, restores, included hours) instead of a standalone line item clients compare with bargain offers.
• Bill annually in advance where you can: fewer late payments, less admin.
• Standardise: same packages, same DNS and email setup, same onboarding and handover process for everyone.
• Measure: log support hours per client for a few months. Your own numbers will shape pricing more than any benchmark.

Provider checklist for agencies

1. Per-account limits in writing: CPU, RAM, I/O, inodes, processes. If they are not written down, you will find them during a traffic spike.
2. Overselling: in WHM a provider can allow total quotas above the real capacity. Ask whether it does and how it manages it.
3. Backups: frequency, retention, storage location, per-account restores and regular restore tests.
4. Custom nameservers and panel branding: included or not, and who enables them.
5. Non-solicitation and direct-contact handling written into the contract.
6. An Article 28 DPA, a sub-processor list and the data regions.
7. B2B support: channels, stated hours, first-response times, escalation path and language.
8. Available PHP versions and the policy for end-of-life versions.
9. A status page with incident history, and an SLA with defined service credits, read in full.
10. Exit terms: full export, no lock-in on domains, help migrating elsewhere.
11. Billing: currency, cycle and invoice format. If the provider is in another country, ask your accountant how VAT or sales tax applies.

Common mistakes and how to avoid them

• One cPanel account for every client: one vulnerable plugin or traffic spike affects everyone, and you cannot hand over one site without handing over all of them.
• Domains registered to the agency: convenient today, a dispute tomorrow.
• Promising clients more availability than your provider commits to you. Your client SLA must fit inside the one you receive.
• Reselling without DPAs, upstream or downstream.
• Choosing a WHM reseller plan to save money, then having nobody who can actually run WHM.
• No renewals register: an expired domain is the fastest way to lose a client.
• Treating email as an afterthought: half-configured SPF, DKIM and DMARC generate tickets for months.

Where to start

With a handful of clients and nobody who wants to look after servers, start with managed multi-account hosting. If someone on your team knows cPanel, a WHM reseller plan gives you autonomy at predictable cost. A dedicated cloud server makes sense when you have specific technical requirements and someone who will genuinely maintain it. In every case, the contract, your processes and how you track support time matter more than the spec sheet.

If you would like a second opinion, we are happy to look at your client portfolio with you and suggest which model fits, with non-solicitation written into the contract, even if the answer is that you do not need anything from us.