MySQL Security Hardening Checklist

Securing a MySQL installation goes beyond user privileges. A hardened MySQL server limits the attack surface and protects against both external attacks and internal misuse.

Essential Hardening Steps

Run mysql_secure_installation after every fresh install to set the root password, remove anonymous users, and disable remote root login.
Disable remote root access — the root user should only connect from localhost.
Remove the test database — it is accessible to all users by default.
Bind to localhost — set bind-address = 127.0.0.1 in my.cnf if no remote connections are needed.
Enable the audit log plugin — records all queries for compliance and forensics.
Keep MySQL updated — security patches are released regularly.
Use a firewall — only allow port 3306 from trusted IP addresses.

Checking for Anonymous Users

Query the mysql.user table to find and remove anonymous accounts and accounts with empty passwords.

Example

-- Find users with no password
SELECT user, host, authentication_string
FROM mysql.user
WHERE authentication_string = '' OR authentication_string IS NULL;

-- Remove anonymous users
DELETE FROM mysql.user WHERE user = '';

-- Remove remote root access
DELETE FROM mysql.user WHERE user = 'root' AND host != 'localhost';

-- Remove test database
DROP DATABASE IF EXISTS test;

FLUSH PRIVILEGES;

SQL

Full Editor

Pro Tip

Run mysql_secure_installation immediately after every MySQL installation — it handles the most critical hardening steps automatically.

Related Resources

MySQL Reference

Complete tag & property list

MySQL How-To Guides

Step-by-step practical guides

MySQL Exercises

Practice what you've learned