True user isolation, explained

“Shared hosting” usually means shared risk: dozens of sites running as the same web user, in world-readable directories, behind one PHP process pool. Break into one, and you can often read — or write — the others. CorePanel is built so that doesn’t happen.

A separate Linux user per account

Every account is a real system user with its own home directory at 0700, with files written 0600. There is no shared web user, and no group- or world-readable path between accounts. The operating system’s own permission model does the enforcing — not a convention we hope everyone follows.

drwx------ alice alice  /home/alice
drwx------ bravo bravo  /home/bravo

alice cannot list, read, or write anything under bravo, and vice versa. The web server serves each site by reading its files as that account’s own user, so the private 0700/0600 permissions never need to be loosened for the web to work.

A dedicated PHP-FPM pool per user

Each account gets its own PHP-FPM pool, running as that account’s system user. A PHP exploit in one site executes with that user’s permissions and nothing more — it can’t reach into another account’s files or processes.

This is the difference between “one site got hacked” and “the whole server got hacked.”

Why it matters for you

If you host clients, isolation is the line between an incident and a catastrophe. If you host your own projects, it means a vulnerable plugin on a side project can’t compromise your main site.

True isolation ships in every edition, including Personal — it’s a foundation, not an upsell.