Take the 2-minute tour ×

I checked out my apache logs, and, whooooaaa, there are a lot of bots trying to exploit phpmyadmin. The first thing i did was to change the directory name to something more obscure.

But, are there any other tips to secure phpmyadmin?

(The database itself is only available from the local network)

share|improve this question
The database itself may be accessible only locally but if its management interface (phpMyAdmin) is publicly available that makes no difference. –  John Gardeniers Oct 27 '09 at 21:09
The best way to secure phpMyAdmin is to learn how to use the MySQL command-line client and then uninstall phpMyAdmin. –  MDMarra Mar 4 '13 at 21:07
add comment

8 Answers

up vote 13 down vote accepted

We do a combination of things:

  • Protect phpMyAdmin via .htaccess or Apache configuration which requests a HTTP username/password login.
  • Protect phpMyAdmin via .htaccess or Apache configuration to only allow access from certain trusted IP addresses
  • Put phpMyAdmin in it's own VirtualHost and run it on a non-standard port
  • Only allow HTTPS connections to phpMyAdmin, and not regular HTTP
  • Only allow connections to it from the LAN (use a VPN to get through your firewall, and only allow connections if you're on that LAN/VPN)
  • Don't name the directory it's in something obvious like /phpMyAdmin/

You could also use SSH port forwarding to utilize SSH keys. See http://stackoverflow.com/a/3687969/193494

share|improve this answer
add comment

Add a .htaccess which only allows local IP access to the phpmyadmin folder.

share|improve this answer
What if it's meant for clients to use? Many webhosts use PHPMyAdmin. –  Luc Jan 5 '13 at 18:28
add comment

Make phpmyadmin available on a vhost that is only accessible from localhost and require users to use ssh and port forwarding to get access to it.

share|improve this answer
add comment

Use .htaccess

We just toss up an .htaccess file with username/password protection and (depending on the circumstances) IP address.

This allows US to get to the resource quickly and easily from trusted computers but keeps the hackers out.

One other note... don't use the SAME username/password for your .htaccess as you do for PHPMyAdmin... that would be silly. :-)

Hope this helps.

share|improve this answer
add comment

I agree with htaccess (/w password) and https.

You might also consider adding a second IP to that server, and creating an IP based Apache virtualhost for phpmyadmin. This could just be a local network IP, so it would be protected by the firewall ( and you might not even have a nat rule for it).

The more layers (ie htaccess + https + Virtualhost), the better I think. Ideally, the bots should not be able to reach it in the first place.

You can of course always put phpmyadmin on a different box too.

share|improve this answer
add comment

In addition to the answers provided, we also use the open source OSSEC to monitor our web logs and alert/block these scans.

It is very simple to install and by default it will find your web logs and start monitoring them.

Link: http://www.ossec.net

share|improve this answer
add comment

Move phpmyadmin into a directory whose name is obscured the way one would expect a password to be ie: combination of mixed case letters as well as numbers (PhP01mY2011AdMin , for example) and similarly "securely" password protecting the directory with .htpasswd should pretty much do the trick.

Then again, if the security of your mysql databases are vital to your business, one has to ask "whatcha doing making an admin tool like phpmyadmin accessible to the internet in the first place?" But hey, everybody has their reasons for living.

share|improve this answer
add comment
  • Make it reachable only via VPN/SSH tunnel

phpmyadmin is too much of a beast to secure. You'd need mod_security and a week of time debugging the alerts just to disable half of the rules to ensure the functionality of phpmyadmin. Conclusion: Don't make it publicly accessible.

share|improve this answer
add comment

Your Answer


