Most site owners only open phpMyAdmin when something breaks, and rarely think about the database. Yet the most dangerous part of your site is not the files but the data: user accounts with hashed passwords, customer details and site settings. Whoever reaches the database can create an Administrator account for themselves without touching the login page.
How do attackers reach the database? #
- A SQL injection flaw in a plugin or old code.
- The database password written in an exposed file, such as a copy of wp-config.php. Read protecting wp-config.php.
- An SQL export left in the site folder and downloadable from a browser.
- Remote database access open to every address.
- The same user and password reused for several sites.
7 steps to protect the database #
- A separate user per database: Each site gets its own database and user. If one site is hacked, the attacker cannot reach the other databases in your account.
- A long, strong password: Use the cPanel password generator when creating the user. You will not type it; the site reads it from its configuration file.
- Only the privileges the site needs: WordPress needs read, write and table changes. A script that only reads data should get read access only.
- Keep remote access closed: In cPanel’s Remote MySQL, add no address unless you need an outside program to connect, then add only your own address and remove it afterwards.
- Never leave SQL files in the site folder: If you export the database, download the file to your computer and delete it from public_html at once.
- Delete unused databases: An old test site’s database still holds users and passwords.
- Back up: And test a restore at least once to make sure it works. Read importing and exporting a database with phpMyAdmin.
What about phpMyAdmin? #
On cPanel hosting you open phpMyAdmin from inside the control panel, so it is protected by your cPanel login. Do not install a separate copy of phpMyAdmin in your site folder, because it becomes an exposed login page. If you forget your WordPress password, you can change it from phpMyAdmin. Read resetting a WordPress password from phpMyAdmin.
How Hyyat Host protects your database #
- Databases accept outside connections only from addresses you add in Remote MySQL.
- ModSecurity and Imunify360 rules block known SQL injection attempts.
- CloudLinux isolates every account, so other sites on the server cannot reach your databases.
Learn more about Hyyat Host shared hosting.
Frequently asked questions #
Should I change the database password regularly?
Not if it is strong and has not leaked. Change it if you suspect a breach, then update it in the site’s configuration file.
Is phpMyAdmin safe?
The cPanel copy is protected by your control panel login. The risk is in separate copies installed inside the site folder.
Can I connect to the database from my computer?
Yes, by adding your computer’s IP address in Remote MySQL. Add only your address and remove it when finished.
