WordPress Database Privileges for Extra Security

I believe I’m well practiced in website security these days, especially having had to manage hundreds of client WordPress sites for years now! So I’m familiar with the standard security precautions of having everything kept up to date (WordPress core, plugins and themes), deleting any unused plugins or themes, having the correct file permissions on the site etc.. But one thing I normally discount is “Database Privileges” which is basically the allowances you give the database user to interact with the database that WordPress needs to run on.

Having done some research on the matter it appears that WordPress itself only requires the following privileges to run properly:

  • DELETE
  • SELECT
  • INSERT
  • UPDATE

And possibly the following if you plan on using the auto updater or installing plugins etc:

  • ALTER
  • CREATE

Some plugins or themes might require more privileges but you’ll quickly find that out on install and you can change privileges to suit.

Here’s the privileges I’ve settled on anyway. You can set these up while creating a new database and adding a user to it in Cpanel or go back and re-add the user to the database to change privileges if everything is already setup:

WordPress Database Privileges

Here’s a fairly comprehensive article on WordPress security from WordPress themselves:

codex.wordpress.org/Hardening_WordPress

Advertisements

Published by

Leon Quinn

Multimedia Design company in Leitrim, Ireland specializing in WordPress Website Design, Photoshop and Graphics. www.reverbstudios.ie

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s