Virtual hosting

Virtual hosting works by directing each incoming request to a configured site or service on the same machine. In ordinary HTTP, the client sends a Host header containing a domain name and, optionally, a port; the server compares that value with its virtual-host configurations.³ A single IP address can therefore serve example.com, example.org, and many other names. DNS normally maps those names to the shared address, but DNS itself does not choose the website: the application server makes that decision after receiving the request.

Two principal forms are recognized. Name-based hosting distinguishes sites by hostname, while address-based hosting assigns separate IP addresses to different sites. Port-based arrangements use different TCP ports, although they are less transparent to users. Apache HTTP Server and nginx both support name-based configurations, with a default site handling unmatched or missing names.¹²

Virtual hosting extends beyond web pages to any service whose protocol exposes a routing signal or can be assigned a distinct address or port. HTTP servers commonly combine DNS, the Host header, and listener settings; mail servers may route domains from envelope information, while a reverse proxy can dispatch requests to separate application processes on the same host.

HTTPS introduced an additional ordering problem: the server may need to choose a certificate before it can decrypt the HTTP request and read its Host header. Server Name Indication (SNI), an extension to Transport Layer Security, allows the client to send the intended hostname during the TLS handshake, enabling certificate selection for name-based HTTPS hosting.⁴ Certificates still must cover the requested names, and automated certificate authorities such as Let’s Encrypt support the operational side of obtaining and renewing them.⁵

Virtual hosting reduces infrastructure cost and simplifies management by sharing CPU, memory, storage, and network capacity among sites. It is common in shared hosting, development environments, small business deployments, and platforms that place a reverse proxy in front of many applications. Separate configuration files, document roots, logs, permissions, and process identities can preserve useful administrative boundaries without requiring a separate server for every domain.

Those boundaries are not complete isolation. A traffic surge or vulnerable application can consume shared resources or expose the host, so administrators use quotas, rate limits, sandboxing, patching, and least-privilege service accounts. A misordered configuration can also send an unknown hostname to the wrong default site. HTTPS certificates, redirects, cookies, access-control rules, and absolute URLs must be checked per domain; otherwise a technically valid shared deployment can leak content or create confusing security behavior.¹³

Virtual hosting can operate without unique public IP addresses, but address-based hosting remains useful when legacy clients, special protocols, or certificate and policy constraints require it. The first configured virtual host may become the fallback for unmatched requests, making default-site design a security and troubleshooting concern rather than a mere convenience.¹

IPv6 adds another addressing dimension: one server may receive traffic over both IPv4 and IPv6, and each address family needs consistent listeners and virtual-host rules. Proxies introduce a further edge case because the backend may see an internal address or rewritten hostname; trusted forwarding headers must be handled deliberately. HTTP/2 and HTTP/3 allow multiple requests to share a connection, but hostname and certificate rules still govern which origin the connection represents. Thus newer transports improve efficiency without eliminating the identity problem that virtual hosting solves.

Name-based virtual hosting

Serving different sites from one address by matching the requested hostname.

Address-based virtual hosting

Using distinct IP addresses to select different sites or services on one server.

Host header

An HTTP request field identifying the hostname and, optionally, port requested by the client.

Server Name Indication

A TLS extension that sends the intended hostname early enough for certificate and connection selection.