Probably, yes: on shared hosting your site sits on the same server as hundreds of others, and some of them will be hacked at some point. Whether that touches you depends on isolation. A well-run host walls each account off so a neighbour’s malware, spam or traffic spike stays their problem. A crowded, poorly isolated server lets it spill over to your files, your email and your speed.
Key takeaways
- Sharing a server or an IP address is normal, and Google says it doesn’t hurt your rankings.
- The real risk is poor isolation: if sites share one account or one file owner, malware can spread between them.
- Email is the weak spot. A neighbour’s spam can get a shared sending address blocklisted, and your emails bounce with theirs.
- Ask your host how accounts are separated, how outgoing mail is sent and what each account’s resource limits are.
What does sharing a server actually mean?
Shared hosting puts many websites on one physical or virtual server. They share its processors, memory, disk and network, and often a single IP address. That’s how hosting stays affordable, and it’s fine for most small sites.
Sharing an address on its own isn’t a problem. Asked whether sharing an IP with 129 sites, many of them spammy, could hurt a site, Google’s John Mueller replied “tldr: no”, adding that “this is how CDNs work, it’s also how shared hosting works” (Search Engine Roundtable, April 2024). The real question is what happens when a neighbour goes bad.
And neighbours do go bad. Wordfence found just under one million infected WordPress sites during 2024 (Wordfence). On a server with hundreds of sites, an infected one nearby is likely, not rare.
Can a hacked site on the same server infect mine?
It can, if the server isn’t set up to stop it. WordPress’s own hardening guide warns that on a shared server, if “a website on the same server is compromised, your website can potentially be compromised too” (WordPress Developer Resources).
Sucuri calls this cross-site contamination. The usual cause is that several sites run under the same file owner, so code running in one site can write to the others. Sucuri’s fix is to give every site its own account or user, with its PHP process running as that user (Sucuri).
In practice, the risk sits in two places:
- Your own extra sites. An old campaign site or test copy in your account shares your files’ owner, making it the likeliest neighbour to infect you.
- Cheap servers with weak walls. Some budget setups don’t separate accounts properly, so one compromised account can see or change others.
Proper secure web hosting closes both gaps by giving each site its own user, files and processes.
Will a neighbour’s spam get my email blocked?
This is the risk owners feel first. When a hacked site on your server sends spam, blocklists record the IP address it came from. If your website’s contact forms and order emails go out from that same address, they’re blocked too.
Spamhaus, which runs some of the best-known email blocklists, is blunt about it. It names “shared hosting farms”, where many sites share one address, as the most common grey zone, and says they “should not be allowed to email directly” (Spamhaus, June 2024).
The fix is to keep your important mail off the shared web server. Send it through a proper email service or an authenticated mail relay, with SPF, DKIM and DMARC set up. If your site is the one sending spam, our guide to a website sending spam emails walks through the clean-up.
Can a busy neighbour slow my site down?
Yes, on servers without firm limits. If one site is hit by a flood of bots or runs a heavy import, it can soak up processor time and memory the rest of the server needs.
Good hosts cap each account’s share, so a neighbour can only use what it’s paid for. Your own site can be the noisy one too. Our guide to bot traffic on your website shows how to spot and block that load.
How do I check whether my host isolates sites properly?
Ask your host these questions and judge the answers:
- Does each site run as its own user? You want each site, or at least each account, to have its own files and its own PHP process.
- How is outgoing email sent? Look for a monitored relay or a separate email service, not mail straight off a shared web server.
- What are my account’s resource limits? A clear figure for CPU and memory beats “unlimited”.
- What happens when a neighbour is hacked? A good host isolates the infected account quickly and tells you if yours was affected.
- What filters attacks before they reach my site? A server-level WordPress firewall stops a lot of automated scanning early.
On your side, remove old sites from your account, keep every install updated and use website security monitoring so you hear about trouble before your customers do.
When is shared hosting fine, and when should I pay for more isolation?
Well-run shared hosting is fine for a brochure site, a portfolio or a small blog. Isolation comes from good setup, not a high price.
Pay for more separation when the site holds data your clients expect you to protect, takes payments, or sends email your business can’t afford to lose. For professional firms, our guide to website hosting for accountants covers what clients expect. A VPS gives you your own reserved resources and operating system, so no other customer shares your server’s software.
How we approach shared hosting
Ask us the same questions. Across our hosting plans, here’s what we can say plainly:
- Every plan sets out its CPU cores, memory and disk, from Personal Essentials (1 core, 2 GB memory, 5 GB disk) up to VPS Ultimate (8 cores, 12 GB, 400 GB).
- VPS plans start at $457 a month + GST for sites that need their own server resources.
- Hosting runs in NEXTDC data centres in Brisbane and Melbourne, with free SSL and free migration on every plan.
Frequently asked questions
Is shared hosting secure enough for a small business?
It can be. What matters is whether each account is isolated, whether the host filters attacks and scans for malware, and how outgoing email is handled. Cheap shared hosting with weak separation is the risk, not shared hosting itself.
Does sharing an IP address with spam sites hurt my SEO?
No. Google’s John Mueller has said shared IP addresses are normal and that sharing one with spammy sites doesn’t harm your search rankings. Your own content and security matter far more.
How do I check if my server’s IP is blocklisted?
Find your site’s IP address in your hosting dashboard, then look it up on the Spamhaus checker or a multi-list lookup tool. If it’s listed and you didn’t send spam, contact your host. On shared hosting, the host usually has to request removal.
Can I get a dedicated IP address on shared hosting?
Some hosts sell one. It mainly helps email reputation if your site sends mail directly. For most businesses, sending email through a proper email service with SPF, DKIM and DMARC does more than a dedicated web server IP.
Should I move to a VPS to avoid bad neighbours?
Only if you need it. A VPS gives you reserved resources and your own operating system, which suits busy stores and sites holding sensitive data. Well-isolated shared or business hosting is enough for most brochure sites.
Sources
- Google: Sharing IP Addresses On Shared Servers Is Normal & Fine For SEO, Search Engine Roundtable, 4 April 2024
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Hardening WordPress, WordPress Developer Resources
- What is cross-site contamination?, Sucuri, January 2020
- The Policy Blocklist: what is it, and why should you be on it?, Spamhaus, 11 June 2024