Nowadays, most web applications use databases in order to store all information and data required for a website or blog to run efficiently and dynamically. These databases often contain configuration settings as well as confidential information, such as user passwords. In order to restrict access to a database, it is common to maintain an administrative account, or ‘root account’.
A root account allows website owners complete access to all databases hosted on a server. If a user has access to a root account, they have full privileges over all the databases related to your website. Therefore, using a root account to access a specific database is a bad security practice and should be avoided.
A lot of users use the root account credentials in their wp-config.php file – if a hacker was to access this file, they could use these credentials to access the root account and therefore have complete access to all other databases. It would not be difficult for a hacker to infect your databases with malware and even destroy your entire website.
Obviously, this is an important website security issue that should not be overlooked. We recommend a dedicated account with minimum privileges be created and used for each individual database, rather than the root account. This way, as each database will be accessed using a different account, should one get compromised, the web application security breach is contained and damage is minimized.
Get the latest content on web security
in your inbox each week.
THE AUTHOR
