WHM Reseller vs Multi-Site Hosting: What Agencies Get

A genuine WHM/cPanel reseller gives you least-privilege WHM access to create a separate cPanel account for each client, within written quotas. Multi-site hosting usually means several sites inside one account, or accounts that only the provider can create. Before you buy, check three things: one account per client, an ACL profile without root or All Features, and quotas you can actually read.

lubemy technical team · Published on 14 October 2026

Plenty of agency hosting plans use “reseller” and “multi-site” as if they meant the same thing. They don't. You find out the difference the day a client leaves, a site gets compromised or a badly written plugin pins the CPU: with one account per client the damage stays contained; with ten client sites in a single account, it doesn't. This guide explains what separates the two models, which WHM privileges you actually need and which ones a responsible provider should never hand out, with references to cPanel's own documentation.

What a genuine WHM/cPanel reseller is

In cPanel's own terms, a reseller is a cPanel account owner who also sells cPanel accounts to other users. The reseller buys resources from a hosting provider and divides them among the accounts it creates, using a restricted version of WHM, the server administration interface.

That gives you a three-tier hierarchy. The provider runs the server as root. Your agency manages its own reseller scope in WHM. Each client gets a separate cPanel account with its own login, home directory, mailboxes, databases and quotas. You can create, suspend or terminate client accounts without raising a ticket, but you can't see other resellers' accounts or touch the server configuration.

One detail that shows up in pricing: cPanel licences are counted per account, and the reseller account itself counts as one. If a reseller offer doesn't say how many accounts are included and what each extra one costs, it isn't telling you the full price.

“Multi-site hosting” can mean three different products

“Multi-site” isn't a cPanel term, and hosts use it for very different setups. Before you compare prices, find out which one you're actually buying.

Several domains in one cPanel account (addon domains). This is the most common version. cPanel describes addon domains as completely different websites hosted inside the same account, splitting that account's resources; their files sit in subfolders of the same home directory. If one site is compromised, every other site in that account is exposed.
WordPress Multisite. This is a WordPress feature, not a hosting model: sites share the same core files and can share plugins and themes, with separate tables in one database. It suits networks of similar sites (a franchise, a university), much less a set of unrelated clients who may one day want to move elsewhere.
Several separate cPanel accounts created by the provider. Each client has its own account, but only the provider can create one, within the plan's quotas. Separation is good, autonomy is limited. It isn't WHM reselling, and a straightforward offer will say so.

When multi-site is enough

For a handful of your own sites, or several sites belonging to one client, a single account with multiple domains is perfectly reasonable and easier to run. For a portfolio of independent clients, aim for at least one account per client.

The models side by side

	Domains in one account	Separate accounts created by the provider	WHM/cPanel reseller
One account per client	No, a single account	Yes	Yes
Who creates accounts	Nobody: you add domains	The provider	Your agency, in WHM
Client cPanel login	Shared or none	Yes, separate	Yes, separate
Per-client quotas	No, one shared quota	Yes, per account	Yes, via packages
Handing a client over	Site must be extracted by hand	Transfer the account	Transfer the account
Branded nameservers	Usually not	Depends on the provider	Yes, if the provider sets them up

WHM privileges (ACLs): what you need and what you don't

WHM grants reseller permissions through Access Control Lists (ACLs), set in the “Edit Reseller Nameservers and Privileges” interface. cPanel groups them into categories. Here's how they look from an agency's side of the table.

Initial and standard privileges: creating, suspending and terminating accounts, changing passwords, managing DNS zones and SSL for your own accounts. This is the day-to-day work of a reseller.
Package privileges: building your own resource packages and assigning them to accounts. Useful, within the guardrails described below.
Global privileges: server information and service management, up to restarting services. On a server shared by several resellers, you shouldn't need these.
Super privileges: account, quota and bandwidth modification, DNS clustering. cPanel recommends against granting them, because they let resellers create accounts without packages and get around resource limits.
Root Access (“All Features”): full access to every function on the server.

Three things a responsible provider won't grant

Root or the “All Features” profile: cPanel says it carries the same privileges as root, overrides account creation limits and lets the reseller see every account on the server, including other people's. Nested resellers (resellers creating resellers): the system allows it, but cPanel doesn't support or test it and strongly recommends against it. Super privileges over quotas and accounts: they let a reseller exceed the limits you agreed.

If a reseller plan advertises root access or sub-reseller creation as a perk, read it the other way round. Either the server is dedicated to you, which makes it a different product (a VPS or server with its own cPanel/WHM licence), or your clients are sharing a machine with someone who can see their accounts. For a technical check, these are the ACL names from cPanel's documentation that shouldn't appear in a reseller profile on a shared server:

Root Access        all              (All Features)
Super Privileges   edit-account     (Account Modification)
                   limit-bandwidth  (Bandwidth Limit Modification)
                   quota            (Quota Modification)
                   rearrange-accts  (Rearrange Accounts)
                   clustering       (DNS Clustering)
Global Privileges  restart          (Restart Services)

Quotas, packages and overselling

WHM can cap a reseller in three ways: total number of accounts, combined disk and bandwidth, and the packages the reseller may use (optionally with a per-package account cap). Resource limits only apply to accounts assigned to a package, so the provider has to force resellers to use packages, which means leaving the super privileges switched off.

Each package sets disk quota, monthly bandwidth, the number of mailboxes and databases, subdomains, addon domains, and an hourly per-domain email sending limit. Some of those fields default to no cap at all if nobody sets them, so ask how the starter packages are configured. What cPanel packages don't cover is CPU, memory or process limits: those need operating-system level tooling, such as CloudLinux's per-user limits.

Then there's overselling: a per-resource option that lets the quotas assigned to accounts add up to more than the total purchased. It isn't wrong in itself, since few sites use every megabyte they're given, but it should be disclosed. The question is always the same: what happens when the disk really fills up?

Isolation: what really keeps one client away from another

Separate accounts are where isolation starts, not where it ends. On a shared server, cPanel accounts draw on the same CPU and memory and often send mail from the same IP address. There are three layers worth checking.

File system: each account has its own home directory. Tools such as CloudLinux CageFS add a virtualised file system per user, in which an account can't see other users, their processes or the server's configuration files.
Resources: per-account limits on CPU, memory, I/O and process count, so a traffic spike or a broken plugin on one site doesn't slow everyone else down.
Email: hourly per-domain sending limits, so a compromised account pumping out spam doesn't wreck the reputation of the IP everyone shares.

Isolation limits the blast radius of a problem; it doesn't make problems impossible. Ask the provider which tools they run and how they check them, not just whether isolation is “in place”.

Checklist: vetting a reseller plan before you buy

Ask whether you get WHM access or just more domains or accounts. If the answer is “a multi-site control panel”, it isn't a reseller plan.
Get the assigned ACL profile in writing, with the categories included and excluded. Root Access and super privileges should be off.
Confirm nested resellers aren't available, either to you or to other customers on the same server.
Read your scope limits: number of accounts, disk, bandwidth, allowed packages and whether overselling is enabled.
Ask how CPU, memory, I/O and processes are capped per account, and which tool isolates the file system.
Check the per-account licence cost and whether the reseller account counts towards it.
Ask whether you can use nameservers on your own domain (for example ns1.youragency.com) and who creates the records they need.
Make sure backups can be restored per account: restoring one client without touching the others is part of isolation.
Ask about the exit: transferring cPanel accounts to another server, timelines and data formats.
Once you're live, log in to WHM and confirm you only see your own accounts and no server administration features.

Which model should you choose?

If you look after a few sites and don't want to deal with account creation, separate accounts created by the provider are the simplest option and already give each client its own boundary. If you create and close accounts often, want your own packages and branded nameservers, you need a WHM reseller with least-privilege access. And if you're offered root or “All Features” on a shared server, that isn't a bonus: it's a risk for your clients and for everyone else's.

If you'd like a second opinion on which model fits your portfolio, we at lubemy can start from your list of sites and tell you what you actually need, even when the answer is that you don't need a reseller at all.