MySQL users and least privilege

A MySQL user is a login name, a host, a password, and a short list of privileges on one or more schemas. Least privilege means one user per application, grants only on that schema, and no extra rights such as FILE or GRANT OPTION. On shared hosting you create these users in cPanel without root access, and you keep remote host wildcards off unless you truly need them.

Why one shared login is a bad default

Using a single MySQL user for every database feels simple until something leaks. A plugin bug, a copied wp-config.php, or an open phpMyAdmin session can then reach every schema on the account. cPanel prefixes exist so one hosting account can hold many databases without sharing one login. Create each user under cPanel → MySQL Databases, attach it to one schema, and stop there. WordPress needs SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, and DROP on its own database. It does not need FILE, PROCESS, SUPER, or GRANT OPTION.

Host values that open more than you meant

user@localhost is the right shape when PHP runs on the same server as MySQL. user@% means any host on the internet that can reach port 3306. On shared hosting, remote MySQL is a panel option plus a host you explicitly allow. Checking that box and then using % because a desktop client complained is how scanners find you. Prefer the actual client IP, or use an SSH tunnel and leave 3306 closed to the public internet.

How to check what you granted

In phpMyAdmin or the mysql client, run the grants check for the account your app actually uses:

SHOW GRANTS FOR ‘user’@’localhost’;

You want rights on that one schema only, not on *.*, and you do not want GRANT OPTION. When a contractor leaves, drop their MySQL user the same day you revoke their cPanel login. Changing a password you never document is not the same as removing access. A tight user still will not fix a missing index; see indexes that actually help when the complaint is speed rather than access.