MySQL User for WordPress: The Right Permissions

WordPress needs its own MySQL database and user. Give it full rights on its own database and nothing else, so a hacked plugin cannot reach your other sites.

1. Create the database

utf8mb4 supports every character, including emoji.

CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

2. Create the WordPress user

CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'a-long-random-password';

3. Grant rights on its own database

WordPress core and plugin updates change tables, so it needs more than read and write.

GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';

4. Put the details in wp-config.php

define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', 'a-long-random-password' );
define( 'DB_HOST', 'localhost' );

5. Verify

SHOW GRANTS FOR 'wpuser'@'localhost';
mysql -u wpuser -p wordpress -e 'SHOW TABLES;'

6. Troubleshooting

Error establishing a database connection: the name, user, password or host in wp-config.php does not match, or MySQL is down (sudo systemctl status mysql).

FAQ

Can several WordPress sites share one MySQL user?

They can, but they should not. One user and database per site keeps a hacked site from reaching the others.

Does WordPress need GRANT OPTION or SUPER?

No. ALL PRIVILEGES on its own database is enough.

Further reading: DigitalOcean: create a new user and grant permissions in MySQL