WordPress Multisite (WPMU) Network Setup Guide: Subdomains, Mapping & DNS

Managing dozens of independent WordPress installations for an agency, enterprise brand, educational institution, or international franchise introduces immense administrative overhead. Updating plugins, renewing SSL certificates, monitoring database health, and backing up individual hosting accounts across 50+ sites consumes hundreds of engineering hours every month.

WordPress Multisite (WPMU) transforms a standard WordPress installation into a centralized website network. From a single unified administrative dashboard, super administrators can deploy hundreds of networked sites sharing a single codebase, unified database, and shared plugin repository while granting individual site owners custom domain names and administrative autonomy. Deploying WPMU on a high-performance Linux VPS provides unmatched operational leverage and server efficiency.

1. Choosing Your Network Structure: Subdomains vs Subdirectories

When initializing WordPress Multisite, you must choose between two network architectures:

• Subdomain Networks (site1.network.com, site2.network.com): Ideal for SaaS platforms, client portals, and multi-tenant hosting. Supports independent domain mapping (e.g., mapping clientbrand.com directly to client.network.com). Requires wildcard DNS and wildcard SSL certificates.
• Subdirectory Networks (network.com/site1/, network.com/site2/): Ideal for multilingual blogs, corporate department sites, and international regional hubs (e.g., /es/, /de/, /fr/). Does not require wildcard DNS records.

2. Activating Multisite in wp-config.php

To enable the multisite setup wizard in your WordPress administrative dashboard, open wp-config.php and insert the multisite enablement flag immediately above the /* That's all, stop editing! */ line:

/* Enable WordPress Multisite Feature */
define('WP_ALLOW_MULTISITE', true);

Save the file and log in to your WordPress dashboard. Navigate to Tools > Network Setup. Deactivate all active plugins temporarily, select your preferred network structure (Subdomains or Subdirectories), and enter your Network Title and Super Admin email.

3. Finalizing Network Configuration Constants

The network wizard will provide two code snippets to finalize the installation. Update wp-config.php with the generated constants:

/* Multisite Network Constants */
define('MULTISITE', true);
define('SUBDOMAIN_INSTALL', true);
define('DOMAIN_CURRENT_SITE', 'network.yourdomain.com');
define('PATH_CURRENT_SITE', '/');
define('SITE_ID_CURRENT_SITE', 1);
define('BLOG_ID_CURRENT_SITE', 1);

/* Enable Native Domain Mapping */
define('COOKIE_DOMAIN', '');

4. Nginx Server Configuration for Subdomain Multisite

Apache supports Multisite rewrite rules via .htaccess, but high-concurrency production networks require Nginx. Configure your Nginx server block to handle dynamic subdomain routing and WordPress Multisite rewrite mechanics:

server {
    listen 80;
    listen 443 ssl http2;
    server_name network.yourdomain.com *.network.yourdomain.com;

    # Wildcard SSL Certificates
    ssl_certificate /etc/letsencrypt/live/network.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/network.yourdomain.com/privkey.pem;

    root /var/www/wordpress;
    index index.php index.html;

    # Multisite global media rewrites
    if (!-e $request_filename) {
        rewrite /wp-admin$ $scheme://$host$uri/ permanent;
        rewrite ^/(wp-.*) /$1 last;
        rewrite ^/(.+?)/(wp-.*) /$2 last;
        rewrite ^/(.+?)/([_0-9a-zA-Z-]+/)?(.*\.php)$ /$3 last;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
        expires max;
        log_not_found off;
    }
}

5. Wildcard DNS & Automated Let’s Encrypt SSL Certificates

For subdomain networks to provision new customer sites dynamically without requiring manual DNS additions, configure a Wildcard DNS A Record in your domain registrar or DNS management panel:

Type: A
Name: *.network.yourdomain.com
Value: YOUR_VPS_PUBLIC_IP

Generate a Let’s Encrypt Wildcard SSL certificate using Certbot with the DNS-01 validation challenge:

sudo certbot certonly --manual --preferred-challenges dns -d "network.yourdomain.com" -d "*.network.yourdomain.com"

Certbot will instruct you to add a temporary _acme-challenge TXT record to verify domain ownership, generating a single unified certificate that encrypts every child subdomain automatically.

6. Custom Domain Mapping in WordPress 6+

Since WordPress 4.5+, Domain Mapping is natively integrated into WordPress core without requiring legacy third-party plugins. To map an external client domain (e.g., clientbrand.com) to a network child site:

1. Ask the client to point their domain’s DNS A record to your VPS IP address.
2. In the Super Admin dashboard, go to Sites > All Sites and click Edit under the target child site.
3. In the Site Address (URL) field, simply replace the subdomain with the custom domain: https://clientbrand.com.
4. Save changes. WordPress automatically updates the database routing tables, serving the child site under the client’s custom domain name with zero cookie conflicts.

WordPress Multisite Scalability: Database Sharding & Cookie Isolation

As an agency multisite network scales past 50 active client sites, operational tuning is essential to prevent database contention and cross-site session bleeding:

• Isolating Cookies Across Subdomains: In subdomain networks, ensure authentication cookies do not leak across distinct child accounts. Enforce strict cookie scoping in wp-config.php:

  define('ADMIN_COOKIE_PATH', '/');
  define('COOKIEPATH', '');
  define('SITECOOKIEPATH', '');
  define('COOKIE_DOMAIN', $_SERVER['HTTP_HOST']);

• Database Sharding with LudicrousDB / HyperDB: Standard multisite stores all child site tables in a single MariaDB database (e.g., wp_2_posts, wp_3_posts). For networks with hundreds of client sites, drop ludicrousdb or hyperdb into wp-content/db.php to distribute tables across separate read-replica database nodes dynamically.
• Automating Wildcard SSL Renewals via Certbot DNS API: Avoid manual renewal of Let’s Encrypt wildcard certificates by utilizing Cloudflare or RFC2136 DNS plugins:

  sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/cloudflare.ini   -d "network.yourdomain.com" -d "*.network.yourdomain.com"

  Certbot automates TXT record validation and reloads Nginx seamlessly every 60 days via systemd timer.

• Monitoring Network-Wide Plugin Upgrades: Never update mission-critical plugins network-wide without testing. Test updates on a dedicated child sandbox site (e.g., sandbox.network.yourdomain.com) before executing network-wide activation.