Remote MySQL

A database client lets you connect to a database hosted on your hosting account from your own computer, without working from cPanel or phpMyAdmin.

The MySQL connection details for this kind of application are:

• Server: the server's hostname, its IP or a domain that points directly to the hosting
• Port: 3306
• User: the MySQL user
• Password: the MySQL user's password
• Database: the database name (the user must have privileges on it)

An application hosted in the same account must use localhost as its MySQL server and does not need remote access. The authorisation described below is only needed when the connection comes from another server, an office or your own computer.

Do not use as the server a domain that points to another platform or sits behind a proxy such as Cloudflare: that traffic is not forwarded to the hosting's port 3306. In that case, use the server's hostname or its IP.

Authorise a remote MySQL connection

Even when the details are correct, the server will reject an external connection if its source address is not authorised.

To allow remote access, go to Remote Database Access in cPanel and add the IP you connect from. In older versions of cPanel this section was called Remote MySQL.

Then check that the MySQL user is assigned to the database and has only the privileges it needs. Authorising an IP lets that source attempt to connect, but it does not replace the username and password.

Can MySQL port 3306 be closed?

On our cloud hosting plans, MySQL is a managed service shared across the node and the firewall is configured at server level. For that reason it is not possible to close port 3306 for a single account, change it or apply a custom network rule from cPanel.

The list of authorised sources in Remote Database Access controls the access you manage from the account. The server may have authorisations added by our administrators: if you see an unknown entry, or one that reappears after you delete it, ask support. A port that responds does not prove that a user can authenticate or access a database.

If your project's security policy requires the port not to be reachable from the internet, a dedicated firewall or full control over MySQL, you will need infrastructure you manage yourself, such as a VPS or a dedicated server. Hostsuar does not currently offer those services; you can read about the differences between a VPS and our cloud hosting before choosing your environment.

Security recommendations

Authorise only the exact public IP you will connect from and remove authorisations you no longer use. If you need a corporate range, first confirm the format supported by your MySQL and cPanel versions: not all of them accept the same notation. Do not use %: it would expose MySQL access to attempts from any source and leave the password as the only barrier.

If your IP is dynamic or several computers need access, connect first through a VPN with a fixed exit IP or create an SSH tunnel, rather than authorising each computer in Remote Database Access. Also use a separate user for each application or person, limited to the database and operations strictly needed, and remove the remote authorisation when the work is finished.

Test the connection and protect the traffic

Authorising an IP does not encrypt the connection. Use TLS with certificate verification when the server and your client support it, or the SSH tunnel for MySQL.

If you get a timeout, check your network's outbound access, the host and the public IP you connect from. If you see Access denied, check the user's full name, its password and the source authorisation. If it connects but cannot see the database, check the assignment and privileges in cPanel. Do not widen the authorisation to % to fix a credentials error.