Preventing one compromise becoming several.
THE PROBLEM
If every site on your server runs as the same user, a vulnerability in one gives access to all of them. This is how a single outdated plugin takes down twelve client sites.
THE SOLUTION
Run each site under its own system user, with file ownership matching. PHP-FPM pools can be configured per user.
Control panels do this automatically. Manual configurations frequently do not, because the default is simpler.
DATABASE ISOLATION
A separate database and database user per application, with privileges only on its own database.
A shared database user with access to everything means one application's SQL injection exposes all of them.
FILE PERMISSIONS
No site's files should be writable by another site's user. Check this explicitly rather than assuming.
FURTHER ISOLATION
Containers or separate virtual machines provide stronger boundaries, at the cost of complexity and resources.
For most deployments, per-user separation is sufficient and achievable.
TESTING IT
From one site's user account, try to read another site's configuration file. If you can, the isolation is not working.
