adminMySQL User Host Access Control Checklist
MySQL users are defined by username and host. The same username from localhost and from a remote IP can have different permissions. Understanding user@host is essential for secure database access.
Core principle
Database access is identity plus origin. A user is not only a name; it is a name from a host with specific grants.
Checklist
- List database users and host values.
- Identify application database user.
- Check whether users are localhost-only or remote.
- Remove wildcard host access when not needed.
- Check grants for each user@host.
- Confirm application config uses the intended user.
- Restrict remote database access with firewall rules.
- Rotate passwords for unknown users.
- Test application after access changes.
- Document database access map.
Reusable lesson
This applies to WordPress database users, remote apps, cloud database separation, staging environments, automation tools and least privilege design.
When to Use This Checklist
Use this checklist when hardening MySQL users, remote database access or application database credentials.
Required Tools
MySQL admin access, application config, firewall access, SSH access, password manager
Before You Start
Do not allow remote wildcard database access unless there is a clear architecture and firewall policy.
Structured Checklist Steps
- List users and hosts.
- Identify app user.
- Check localhost users.
- Check remote users.
- Review wildcard hosts.
- Check grants.
- Review firewall.
- Rotate unknown passwords.
- Test app.
- Document access map.
Verification Steps
- Application user is known.
- Remote access is intentional.
- Wildcard host access is removed or justified.
- Grants match least privilege.
- Application still connects successfully.
Rollback Plan
If access tightening breaks the application, restore only the minimum required user@host grant instead of granting broad remote access.
Common Mistakes
- Ignoring host part of MySQL users.
- Using '%' wildcard unnecessarily.
- Opening port 3306 publicly.
- Using root for applications.
- No database access inventory.
Related Commands
mysql -u root -p -e "SELECT user,host FROM mysql.user;"
mysql -u root -p -e "SHOW GRANTS FOR 'app_user'@'localhost';"
mysql -u root -p -e "SHOW GRANTS FOR 'app_user'@'%';"
sudo ss -tulpn | grep 3306
sudo ufw status numbered