{"id":18997,"date":"2026-10-22T21:02:20","date_gmt":"2026-10-22T18:02:20","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/protect-website-database-phpmyadmin\/"},"modified":"2026-10-22T21:02:32","modified_gmt":"2026-10-22T18:02:32","password":"","slug":"protect-website-database-phpmyadmin","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-website-database-phpmyadmin\/","title":{"rendered":"Protecting Your Website Database and phpMyAdmin: Users, Privileges and Passwords"},"content":{"rendered":"<div class=\"hkb\" dir=\"ltr\">\n<div class=\"hkb-tldr\"><b>In short<\/b>The database holds everything: posts, users and customer orders. Protect it with a separate user per database and a strong password, open remote database access only to a specific address when needed, never leave SQL export files in your site folder, delete databases you no longer use, and back them up.<\/div>\n<figure class=\"hkb-fig\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/hkb-database-security.webp\" alt=\"Website database security: a database, a lock and a key\" width=\"1200\" height=\"630\" loading=\"lazy\" \/><\/figure>\n<p>Most site owners only open phpMyAdmin when something breaks, and rarely think about the database. Yet the most dangerous part of your site is not the files but the data: user accounts with hashed passwords, customer details and site settings. Whoever reaches the database can create an Administrator account for themselves without touching the login page.<\/p>\n<h2>How do attackers reach the database?<\/h2>\n<ul class=\"hkb-list\">\n<li>A <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/sql-injection\/\">SQL injection<\/a> flaw in a plugin or old code.<\/li>\n<li>The database password written in an exposed file, such as a copy of wp-config.php. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-wp-config\/\">protecting wp-config.php<\/a>.<\/li>\n<li>An SQL export left in the site folder and downloadable from a browser.<\/li>\n<li>Remote database access open to every address.<\/li>\n<li>The same user and password reused for several sites.<\/li>\n<\/ul>\n<h2>7 steps to protect the database<\/h2>\n<ol class=\"hkb-steps\">\n<li><b>A separate user per database:<\/b> Each site gets its own database and user. If one site is hacked, the attacker cannot reach the other databases in your account.<\/li>\n<li><b>A long, strong password:<\/b> Use the cPanel password generator when creating the user. You will not type it; the site reads it from its configuration file.<\/li>\n<li><b>Only the privileges the site needs:<\/b> WordPress needs read, write and table changes. A script that only reads data should get read access only.<\/li>\n<li><b>Keep remote access closed:<\/b> In cPanel\u2019s Remote MySQL, add no address unless you need an outside program to connect, then add only your own address and remove it afterwards.<\/li>\n<li><b>Never leave SQL files in the site folder:<\/b> If you export the database, download the file to your computer and delete it from public_html at once.<\/li>\n<li><b>Delete unused databases:<\/b> An old test site\u2019s database still holds users and passwords.<\/li>\n<li><b>Back up:<\/b> And test a restore at least once to make sure it works. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/import-export-mysql-database-phpmyadmin\/\">importing and exporting a database with phpMyAdmin<\/a>.<\/li>\n<\/ol>\n<div class=\"hkb-note\"><b>Example:<\/b> A site owner exported the database as backup.sql into the main folder to send it to a developer, and forgot to delete it. Anyone typing <span dir=\"ltr\">yoursite.com\/backup.sql<\/span> could download every user\u2019s data. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/exposed-sensitive-files-env-git-backups\/\">exposed sensitive files<\/a>.<\/div>\n<h2>What about phpMyAdmin?<\/h2>\n<p>On cPanel hosting you open phpMyAdmin from inside the control panel, so it is protected by your cPanel login. Do not install a separate copy of phpMyAdmin in your site folder, because it becomes an exposed login page. If you forget your WordPress password, you can change it from phpMyAdmin. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/reset-wordpress-password-phpmyadmin\/\">resetting a WordPress password from phpMyAdmin<\/a>.<\/p>\n<div class=\"hkb-note w\"><b>Changing the wp_ table prefix:<\/b> it is often mentioned as a security step, but its effect is limited and changing it on a live site can break it. The steps above matter far more.<\/div>\n<div class=\"hkb-hh\">\n<h2>How Hyyat Host protects your database<\/h2>\n<ul>\n<li>Databases accept outside connections only from addresses you add in Remote MySQL.<\/li>\n<li><strong>ModSecurity<\/strong> and <strong>Imunify360<\/strong> rules block known SQL injection attempts.<\/li>\n<li><strong>CloudLinux<\/strong> isolates every account, so other sites on the server cannot reach your databases.<\/li>\n<\/ul>\n<p style=\"margin:10px 0 0\">Learn more about <a href=\"https:\/\/www.hyyat.com\/en\/shared-hosting-2\/\">Hyyat Host shared hosting<\/a>.<\/p>\n<\/div>\n<h2>Frequently asked questions<\/h2>\n<div class=\"hkb-faq\">\n<details>\n<summary>Should I change the database password regularly?<\/summary>\n<p>Not if it is strong and has not leaked. Change it if you suspect a breach, then update it in the site\u2019s configuration file.<\/p>\n<\/details>\n<details>\n<summary>Is phpMyAdmin safe?<\/summary>\n<p>The cPanel copy is protected by your control panel login. The risk is in separate copies installed inside the site folder.<\/p>\n<\/details>\n<details>\n<summary>Can I connect to the database from my computer?<\/summary>\n<p>Yes, by adding your computer\u2019s IP address in Remote MySQL. Add only your address and remove it when finished.<\/p>\n<\/details>\n<\/div>\n<div class=\"hkb-rel\"><b>Related guides<\/b><\/p>\n<ul>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/sql-injection\/\">What Is SQL Injection and How to Protect Your Website Database<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-wp-config\/\">How to Protect wp-config.php in WordPress: 7 Steps to Secure Your Most Important File<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/exposed-sensitive-files-env-git-backups\/\">Exposed Sensitive Files on Your Site: .env, .git and Backups, and How to Hide Them<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/import-export-mysql-database-phpmyadmin\/\">How to Import or Export a MySQL Database with phpMyAdmin<\/a><\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/\">All website security guides \u2192<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In shortThe database holds everything: posts, users and customer orders. Protect it with a separate user per database and a strong password, open remote database access only to a specific address when needed, never leave SQL export files in your site folder, delete databases you no longer use, and back them up. Most site owners [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"doc_category":[2744],"doc_tag":[],"class_list":["post-18997","docs","type-docs","status-publish","hentry","doc_category-website-protection"],"year_month":"2026-10","word_count":667,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"ahmed fathy","author_nicename":"ahmed-fathy","author_url":"https:\/\/www.hyyat.com\/en\/author\/ahmed-fathy\/"},"doc_category_info":[{"term_name":"Website Security","term_url":"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/comments?post=18997"}],"version-history":[{"count":0,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18997\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media?parent=18997"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_category?post=18997"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_tag?post=18997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}