WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?

share|improve this question
up vote 3 down vote accepted

If you did want to lock things down.... a normal wordpress site will usually only require the database user to have SELECT, INSERT, UPDATE and DELETE.

If you want to use the automatic update feature it will also require CREATE and ALTER.

Some plugins may require other permissions but most won't.

share|improve this answer

WordPress only uses one DB user for everything, and he'll need to have all permissions to the database. CREATE and ALTER are used when upgrading, sometimes. INSERT, UPDATE, and SELECT are used all the time.

share|improve this answer

I've asked a similar but a bit more detailed question lately: MySQL Database User: Which Privileges are needed?

The short installation instruction for WordPress ("5 Minutes") state that:

Create a database for WordPress on your web server, as well as a MySQL user who has all privileges for accessing and modifying it.

This is the minimum of privileges / permissions that are needed and next to those, others are not needed.

So if your user has more privileges than those, you can reduce them.

share|improve this answer

The answer is all privileges. This is taken straight from the wordpress install page here Look at the phpMyAdmin section and it states "Click Check All to select all privileges.

share|improve this answer

For a secure database, selecting ALL PRIVILEGES is definitely NOT the answer.

See the Codex: http://codex.wordpress.org/Hardening_WordPress

> 10 Database Security
>     10.1 Restricting Database User Privileges
share|improve this answer
    
This is a bad advice, many plugins assume they can create tables and will just fail if they can't. Core itself might need to introduce new table or alter existing ones. – Mark Kaplun Mar 30 at 9:42
    
As the codex explains, you have to know what you are doing and what is your purpose for doing it. Example 1: NO SECURITY If you want everything to work but do not care about security, then just enable everything and take your chances. Example 2: FULL SECURITY If you care about security, then read the codex article. When upgrading anything, you will need to REMEMBER to enable whatever privileges are required by the plugin or Wordpress upgrade. – Jerry9 Mar 30 at 19:02
    
Mark Kaplun is correct... The original poster's (op) question does in fact say he is "not trying to lock things down." So assigning ALL privileges to your database will allow any and all Wordpress upgrades to work - that's the good advice for him (the op). By the way, here's an article that shows CATEGORIES for permissions (Data, Structure, Admin), wpwhitesecurity.com/wordpress-security-hacks/…. – Jerry9 Mar 30 at 19:19
    
The only proper way to secure a WP DB is to have one per site, then you have one "root" user and you do not care much about permissions. But that is not what the OP asked. As for the article you point to... it is funny to discuss security when you have phpmyadmin installed and open to the web. What is the point of restricting the wordpress user when you have another that is not restricted (ok, there is a point, but still sloppy IMO). – Mark Kaplun Mar 30 at 19:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.