One Site, One Database User

What this check and mySites.guru tool looks at on your site

Joomla connects to your database server using the username and password stored in configuration.php. This check uses that same connection to ask the database server how many separate databases those credentials are permitted to see, and flags any site where the answer is more than one.

This is not the same question as whether Joomla’s configuration deliberately references more than one database; Joomla itself only ever expects to work with one. What this check measures is what the credentials are capable of reaching, regardless of what Joomla intends to use, because capability is what matters if those credentials end up in the wrong hands. It sits alongside the wider set of automated checks covered in how to check Joomla database security.

How one shared credential exposes every site on the account

The database credentials Joomla uses are not scoped by Joomla itself. They are scoped by whoever created the MySQL user on the server, and that is entirely a hosting-account decision, not something Joomla’s Global Configuration controls. If the same MySQL user was reused across several databases, perhaps because one hosting account runs multiple sites and it was quicker to set up one shared user at the start, then every one of those databases is reachable through the credentials sitting in this one site’s configuration.php file.

That single file becomes far more valuable to an attacker than it should be. Read access to one site’s configuration, through a misconfigured backup, a path disclosure, or a vulnerable extension with a local file read flaw, does not just expose that site’s data. It exposes every database the same user can reach, including sites that were never themselves vulnerable to anything. A perfectly secure site can end up compromised purely because it shares a database user with a less careful neighbour on the same account.

This is the same underlying risk as connecting as the MySQL root user, just at a smaller scale. Root exposes every database on the whole server; a shared but non-root user exposes every database that one user happens to have been granted access to. Both turn a single leaked credential into a multi-site incident instead of a single-site one.

It also complicates cleanup after any single site is compromised. If a shared user’s credentials leak from one site and you only reset the password on that one site’s database, the same old password may still be sitting in configuration.php on every other site that shared it, quietly still working until you go and check each one individually. Agencies running several client sites on one hosting account are the group this affects most, precisely because it is the setup where reusing one MySQL user across several databases feels like the fastest way to get a new site online.

You can check this for yourself without any tooling. Connect to the database with the credentials from your site’s configuration.php, whether through phpMyAdmin or the command line, and run SHOW DATABASES;. If the result lists more than the one database your site actually uses, this check is failing.

One database, one user

A one-to-one relationship between database and database user. Each site’s Joomla installation connects using its own MySQL user, and that user has privileges on that site’s database only. If you manage several Joomla sites on one hosting account, that means creating one MySQL user per site, not one MySQL user for the account.

This is a different question from whether the database user is running as root, even though the two checks often fail together. A non-root user that can still see three other databases is not a superuser problem; it is a scoping problem, and it is fixed by narrowing the grants on an existing style of account rather than by avoiding a specific username.

How to fix it

1. In your hosting control panel’s MySQL Databases section, check how many databases the user configured in your site’s configuration.php currently has access to.
2. Create a new MySQL user, unique to this site, with privileges granted on this site’s database only.
3. Update configuration.php in the site’s root folder with the new $user and $password values; this has to be edited directly in the file rather than through Joomla’s Global Configuration screen.
4. Log in to https://yoursite.com/administrator and confirm the site still connects correctly.
5. Once the new, scoped user is working, remove the old shared user’s access to this database, or delete it entirely if nothing else still depends on it.
6. Repeat for any other sites that were sharing the same MySQL user, one at a time, so you always have a working site to compare against.

What mySites.guru does about it

We connect using your site’s own configured credentials on every snapshot and check how many databases they can see. There is no one-click fix for this, because creating a new, scoped MySQL user is a hosting-account change, so we flag it clearly and leave the fix to you.

This check pairs with three others in the same family: whether your database prefix is still the guessable default, whether your database user is running as root, and whether leftover installer backup tables are sitting in your live database.