MySQL Database Security: A 12-PointChecklist for 2026

Database misconfigurations are among the most common causes of data breaches — and most of them are preventable. The majority of MySQL security improvements are straightforward, do not require specialized security expertise, and take a matter of hours to implement. 

This checklist covers the essentials. Work through it on every MySQL instance you manage.

The 12-Point Checklist

1. Remove the Anonymous User and Test Database 

MySQL installs with defaults intended for initial setup convenience, not production security.

DELETE FROM mysql.user WHERE User = ”; 
DROP DATABASE IF EXISTS test; 
DELETE FROM mysql.db WHERE Db = ‘test’ OR Db = ‘test\\_%’; 
FLUSH PRIVILEGES;

These defaults represent unnecessary attack surface. Remove them from every production instanc

2. Run mysqlsecureinstallation

mysql_secure_installation

This guided utility covers root password, anonymous user removal, remote root login, and the test database. Run it on every new instance. Then continue through the rest of this checklist — it does not cover everything.

3. Disable Remote Root Login

Verify root accounts:

SELECT User, Host FROM mysql.user WHERE User = ‘root’;

Remove any root entry not restricted to localhost:

DELETE FROM mysql.user 
WHERE User = ‘root’ 
AND Host NOT IN (‘localhost’, ‘127.0.0.1’, ‘::1’); 
FLUSH PRIVILEGES;

Root access belongs on the server itself, through a secure session — not from a remote client.

4. Apply the Principle of Least Privilege

Every application gets its own dedicated account with only the permissions it actually needs.

CREATE USER ‘app_user’@’10.0.1.50’ IDENTIFIED BY ‘strong_password’; 
GRANT SELECT, INSERT, UPDATE, DELETE ON myapp_db.* 
TO ‘app_user’@’10.0.1.50’; 
FLUSH PRIVILEGES;

Audit user accounts quarterly and revoke anything no longer needed.

5. Restrict Host Access

Specifying the host when creating users limits where that user can connect from.

‘user’@’%’ is convenient in development. It should not exist in production.

6. Use Strong Authentication

MySQL 8.0 defaults to caching_sha2_password , which is stronger than the older  mysql_native_password . If older accounts still use the legacy plugin, upgrade them:

ALTER USER ‘app_user’@’host’ 
IDENTIFIED WITH caching_sha2_password BY ‘new_strong_password’;

Enforce strong passwords and rotate them on a defined schedule. For high-security environments, certificate-based authentication removes passwords from the equation entirely.

7. Enable SSL/TLS for All Connections

Without SSL/TLS, credentials and query data travel in plaintext across your network.

— Check SSL status 
SHOW VARIABLES LIKE ‘%ssl%’; 
— Require SSL for a specific user 
ALTER USER ‘app_user’@’host’ REQUIRE SSL;

To enforce SSL for all connections, add to my.cnf :

8. Bind MySQL to a Specific Network Interface

If the application and database are on the same server, restrict MySQL to localhost:

[mysqld] 
bind-address = 127.0.0.1

If MySQL must be remotely accessible, use a firewall to restrict which IP addresses can reach port 3306. Host-based user restrictions in MySQL are a second layer of defense — not a substitute for network-level controls.

9. Enable Audit Logging

Audit logs record who connected, from where, and what SQL they ran. Required for compliance (PCI-DSS, HIPAA, SOC 2) and invaluable for incident investigation.

— Check if audit logging is active 
SHOW PLUGINS LIKE ‘%audit%’;

At minimum, log all connection attempts, all DDL statements (CREATE, ALTER, DROP), and failed authentication. Failed auth attempts should trigger real-time alerts.

10. Keep MySQL Updated

Check your current version:

Subscribe to MySQL security advisories and plan patch windows before vulnerabilities are public.

11. Encrypt Data at Rest

Encrypt sensitive tables at the InnoDB level:

— New table with encryption 

CREATE TABLE sensitive_data ( 
id INT, 
ssn VARCHAR(11) 
) ENCRYPTION = ‘Y’; 

— Encrypt an existing table 
ALTER TABLE sensitive_data ENCRYPTION = ‘Y’;

Pair InnoDB encryption with full-disk encryption (LUKS on Linux, BitLocker on Windows) for defense in depth.

12. Monitor for Suspicious Activity

Security is not a one-time configuration. It is ongoing monitoring.

MONyog monitors connection patterns, authentication failures, and anomalous query activity continuously — alerting you when something looks wrong rather than after damage is done.

Your Security Score

Want continuous security monitoring for your MySQL databases? Try MONyog free and configure alerts for anomalies that matter most to your environment.

Frequently Asked Questions