Create MySQL User

The Problem

You need a new database user — for an application, a team member, or a reporting tool — but getting the privileges and host restrictions right (not too open, not too restrictive) takes a bit more care than it first appears.

About this problem

A new database user should generally only have access to exactly what it needs — a single database, specific privilege types, and ideally restricted to connect only from where it's actually needed (localhost, or a specific IP) rather than from anywhere on the internet.

This comes up whenever a new application needs database access, or when granting a team member or reporting tool read access without exposing broader administrative capability.

What's Included

• Creating the user account with an appropriately restricted host specification
• Granting only the specific privileges actually needed for the intended purpose
• Setting a strong, unique password (or recommending key-based auth where supported)
• Testing that the new user can connect and perform exactly the actions intended, nothing more

What's NOT Included

• Creating the database itself if it doesn't already exist (separate service)
• Ongoing user management after initial creation
• Application-level authentication beyond the database user itself

How It Works

1. Determine exactly what privileges and database scope the new user genuinely needs.
2. Create the user with an appropriate host restriction (localhost, a specific IP, or % only if genuinely necessary).
3. Grant only the specific privileges required (e.g. SELECT-only for a reporting user, full CRUD for an application).
4. Set a strong, unique password and flush privileges.
5. Test connecting as the new user and confirm it can perform intended actions but not anything beyond its scope.

In practice: you buy the service, send over whatever access or details the job needs, I investigate and do the work, and you confirm it's resolved before we call it done.

Frequently Asked Questions

Why shouldn't I just use the root MySQL user for everything?

Using root everywhere means any single compromised application or credential leak gives full access to every database on the server — a dedicated, scoped user limits the blast radius significantly.

What does the host field mean when creating a MySQL user?

It restricts where that user can connect from — localhost for same-server-only access, a specific IP for a known remote source, or % for anywhere, which should be used sparingly.

Can a MySQL user have access to multiple databases?

Yes, privileges can be granted per-database to the same user, though a dedicated user per application is generally considered better practice for isolation.

What privileges does a read-only reporting user need?

Typically just SELECT on the relevant database or tables, with no INSERT, UPDATE or DELETE privileges granted at all.

How do I see what privileges a MySQL user currently has?

The SHOW GRANTS FOR command run against that specific user lists exactly what privileges and scope they currently hold.

Is it safe to allow a MySQL user to connect from any IP?

Only if that user also has a strong password and ideally is combined with other protections (firewall rules, SSL requirements) — an open host with a weak password is a serious risk.