Hosting several domains on one machine is normal and efficient. What decides whether it is safe is how separate they are: separate directories, separate database users, and ideally separate system users.

The layout

/var/www/\n  site-one/    public/  storage/\n  site-two/    public/  storage/\n  site-three/  public/  storage/

Each document root points at its own public directory. Nothing above it is reachable from the web, so configuration and storage sit outside where a URL could ever land.

One server block per domain

server {\n    listen 443 ssl;\n    server_name one.example;\n    root /var/www/site-one/public;\n    include snippets/php.conf;\n}

Keep the databases apart

CREATE DATABASE site_one CHARACTER SET utf8mb4;\nCREATE USER 'site_one'@'localhost' IDENTIFIED BY '...';\nGRANT ALL PRIVILEGES ON site_one.* TO 'site_one'@'localhost';
One database user with access to every database means a single compromised site reads and writes all of them. This is the most common mistake on a multi-site server and it turns one incident into all of them at once.

Separate PHP pools, if you can

A pool per site, each running as its own user, means one site cannot read another's files even though they share a machine. It also stops one site's traffic exhausting the workers everybody else needs.

; /etc/php/8.3/fpm/pool.d/site-one.conf\n[site-one]\nuser = site-one\ngroup = site-one\nlisten = /run/php/site-one.sock\npm = ondemand\npm.max_children = 10

Certificates

sudo certbot --nginx -d one.example -d www.one.example\nsudo certbot --nginx -d two.example -d www.two.example
Separate certificates rather than one covering everything. Renewal for one domain then cannot take the others down, and the certificate does not publish the list of every site you host.