So, for a multi user web app, what is better:




I would like to get feedback about security, scalability and maintenance specifically, app is php based, so it is .htaccess based for url rewriting.


As with any high level question such as this one, the answer will largely depend on your requirements.

The first question I should ask though (since it was not specified in your question) is why are you concerned with a subdomain or subfolder at all? Will these be for "vanity" URLs? If not and you are only serving up content based on a user logging in, then you would only need your base URL (no need for a folder or subdomain). Once you authenticate a user, you will know who they are and what they should have access to and can serve up content based on their login.

If you are looking to use this for vanity URLs, then here are a few pros/cons of each:


  • Better option for SEO. Search engines will see each subdomain as a separate website and will not give as much weight to the root domain. Using subfolders will help to improve SEO rankings.
  • Your code will most likely have some kind of rewrite involved if you are planning to only have a single code base.
  • Will still need to take into account what a user is allowed to see based on their login.
  • As JamesRyan mentioned, if users are generating any code, then cookies could be a concern since they are all on the same domain.
  • If you are planning to use SSL (which you should be if you have users providing passwords or other private data), then you would only need a single certificate. You can use a single wildcard certificate for subdomains, but those tend to be much more expensive.


  • Better option if you are looking to create separate web sites (i.e. different webroot, different apache instance, different ssl certificate for each site, etc.)
  • Wouldn't necessarily have any rewrites to take into account (although you still could). Your code could be written to check the host header to determine what content to serve up.
  • Would require either a wildcard DNS record or you will need to manually create DNS records for each subdomain you create. Depending on the number of subdomains being created, this could require a lot of effort. Wildcard DNS records would for sure be the way to go.
  • As with the subfolder option, if you are using the same code base to serve up each site, you still need to authenticate users and check what they are authorized to see.

At the end of the day, it really comes down to what your requirements are. I've only listed a few things to keep in mind with either option. If you would like to refine your question to be more specific I'm sure you would probably get a few more specific answers.


Using folders is definitely, definitely, definitely easier to manage and much more scalable.

For subdomains, you have to create a new server-instance for each one. With folders, you just make a new folder.

Subdomains win on security, but if the content on the profile in managed, then you should go with folders.

If it's something that users have complete control over, then use subdomains.

  • 1
    not at all. You can create a single wildcard instance and then return appropriate content based on the domain almost identically to the way you would treat subfolders programatically
    – JamesRyan
    May 23 '11 at 12:21
  • @JamesRyan Good to know.
    – McKayla
    May 23 '11 at 23:42

Cookies apply to domains so would be shared if you used folders but with subdomains could apply to the whole domain or individual sub domains.

If you host user generated content you would need to be careful to avoid XSS attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.