Database user privileges: one hacked site shouldn't open the others
On many servers the same MySQL user serves several sites, sometimes with rights on the whole server. One flaw in one site's plugin is then enough to read every other database.
One user for every database multiplies the damage.
It happens on VPSs run by the agency: to save time, the same user is reused, or a user with GRANT ALL on .. Everything works, until one site gets hacked.
With an SQL injection or a configuration file read from outside, the attacker gets those rights. If they reach other databases, the problem is no longer one site.
What the agent checks.
Global rights
The agent reads the user's GRANTs. Any global right beyond USAGE, such as ALTER, CREATE or INDEX, and WITH GRANT OPTION trigger the check.
Other databases
It checks whether the user can see databases other than the site's own.
Same rule everywhere
Since agent 0.24.0 the rule is identical on WordPress, Joomla, Drupal and PrestaShop.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Do database credentials reach the platform?
No. The agent sends the result of the check, not the password or the configuration file.
Does it work with PostgreSQL?
The check is written for MySQL and MariaDB, which nearly all WordPress, Joomla and PrestaShop sites use. Backups also need MySQL or MariaDB today: on a site with PostgreSQL, SQLite or SQL Server the platform says so and doesn't start them.
Goes well with
- 169 automatic configuration checks for WordPress, Joomla, Drupal and PrestaShopHidden admins, risky settings, exposed databases and files, with what to do.
- WordPress hardening, checked on every site, every dayFile editor, security keys, debugging, XML-RPC and forgotten tools.
- Security checks for Drupal: settings, modules and permissionstrusted_host_patterns, hash_salt, development modules and risky permissions.
- Encrypted WordPress and Joomla backups, straight from your client's serverEncrypted on the site before they leave, and locked against deletion.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.