There are many security settings and plugins for WordPress that you can use to protect your WordPress installation. It’s not a good idea to ignore security as hackers continue to target WordPress websites every day. Installing these plugins and following the best security practices or guidelines is a great way to keep your WordPress installation safe. Give WordPress MySQL users the minimum permissions needed to access the WordPress database.
Most of the time, the MySQL user used to connect to the MySQL database server and access the WordPress database (the user defined in the WordPress wp-config.php configuration file) has full access to the WordPress MySQL database, or even worse, to the entire MySQL database server. There should be a limit on the MySQL user’s access to the WordPress MySQL database. The MySQL user who accesses the WordPress MySQL database should only have the privileges needed to do so (database permissions).
Why restrict MySQL user privileges?
Imagine if you accidentally install a bad plugin that has a back door or trojan software or if a malicious user gets the login information for the MySQL user that WordPress uses. Keeping the MySQL user’s rights restricted to only the MySQL WordPress database can minimize damage in both cases.
But if the MySQL user has complete access to the MySQL WordPress database, including structure privileges, the malicious user can modify more than just the data in the database. They can also change the structure of the database. Worse still, if the MySQL user that WordPress uses has access to other databases, the malicious user can get into the other MySQL databases and steal information from them or change them. If a malicious user has access to the shopping cart MySQL database linked to your WordPress installation, they can steal sensitive information about your customers.
Why secure WordPress database privileges are essential even when hacked
Many WordPress webmasters think that once their site has been hacked, it’s over. This is a big mistake. It’s also very important to think about how to limit the damage a hacker can do to your website once they’ve gotten in. It’s much easier to restore the data in a WordPress database than to restore the whole WordPress database, a shopping cart database, re-integrate the shopping cart, etc. If you hire a WordPress expert, it will be much cheaper to just restore the data in your WordPress database and then reinstall the whole website.
WP White Security.com Security Tip: You must back up your WordPress site. Even if you secure your WordPress installation, you should still back up your site.
Security guidelines for WordPress MySQL databases
- In WordPress, you should never use the MySQL root (MySQL super user).
- Use a different MySQL user for each website you’ve set up.
- Always give the MySQL user just enough access to the database.
- Make sure the name of a new MySQL user is difficult to guess.
- Set up a very strong password for the MySQL user.
