There are many WordPress security plugins and recommended security settings you can apply to secure your WordPress installation. Since hacking is on the rise, and WordPress websites are being hacked daily, WordPress security is not something that should be overlooked. It is highly recommended to install such plugins and follow the security best practises, or security guidelines to secure your WordPress installation. Unfortunately there is one commonly overlooked WordPress security guideline; assign the minimum required WordPress database privileges to the MySQL user used by WordPress.
Most of the time the MySQL user used to connect to the MySQL database server and access the WordPress database (the user defined in the WordPress wp-config.php configuration file) has full access to the WordPress MySQL database, or even worse, to the whole MySQL database server. The MySQL user’s WordPress database privileges should be restricted; the MySQL user accessing the WordPress MySQL database should be assigned the minimum required database privileges (database permissions).
Why restrict MySQL user privileges?
Imagine if by mistake you install a malicious plugin which contains a back door or trojan software, or if a malicious user manages to get his hands on the credentials of the MySQL user used by WordPress. In both cases, if the MySQL user privileges are limited only to the data in the MySQL WordPress database, the damage can be limited and such issue can easily be fixed.
Though if the MySQL user has full access to the MySQL WordPress database, i.e. including structure privileges, the malicious user can also modify the structure of the database and not just the data inside it. Even worse, if the MySQL user being used by WordPress has access to other databases, the malicious user will access the other MySQL databases and steal data or modify them. If the MySQL user used by WordPress has access to the shopping cart MySQL database which is integrated with your WordPress installation, the malicious user can steal your customer’s sensitive information.
Why secure WordPress database privileges are important even when hacked
Many WordPress webmasters think that once the website has been hacked, it is over. This is very wrong. It is of utmost important to also think how to limit the damage a hacker can do to your website once it has been hacked. Restoring the data in a WordPress database is much easier than restoring the whole WordPress database, a shopping cart database, re-integrate the shopping cart etc. If you are hiring a WordPress professional, it will cost much less to just restore the data of your WordPress database, then re-install the whole website.
WP White Security.com Security Tip: WordPress backups are a must. Securing your WordPress installation does not mean you should not backup your website.
Security guidelines for WordPress MySQL databases
- Never use the MySQL root (MySQL super user) in WordPress
- Use a different MySQL user for each web application you have installed
- Always assign the minimum required database privileges to the MySQL user
- When creating a new MySQL user, use a non predictable username
- Configure a very strong MySQL user password.
