# One Site, One Database User 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Database integrity](https://mysites.guru/tools/database-integrity/) 4. One Site, One Database User # One Site, One Database User ![One Site, One Database User](https://mysites.guru/_astro/database-user-sees-other-databases.DYIQ_e9M_Z1NIPPi.webp) If your Joomla database user can see other databases on the server, one compromised site's credentials can expose every site that shares that hosting account. Article Contents - [What the shared database user check reads](#what-the-shared-database-user-check-reads) - [How one shared credential exposes every site on the account](#how-one-shared-credential-exposes-every-site-on-the-account) - [One database, one user](#one-database-one-user) - [Restricting a user to one database](#restricting-a-user-to-one-database) - [Checking database grants on every snapshot](#checking-database-grants-on-every-snapshot) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) ## What the shared database user check reads Joomla connects to your database server using the username and password stored in `configuration.php`. This check uses that same connection to ask the database server how many separate databases those credentials are permitted to see, and flags any site where the answer is more than one. This is not the same question as whether Joomla’s configuration references more than one database; Joomla itself only ever expects to work with one. What this check measures is what the credentials are capable of reaching, regardless of what Joomla intends to use, because capability is what matters if those credentials end up in the wrong hands. It sits alongside the wider set of automated checks covered in [how to check Joomla database security](https://mysites.guru/blog/how-to-check-joomla-database-security/). ## How one shared credential exposes every site on the account The database credentials Joomla uses are not scoped by Joomla itself. They are scoped by whoever created the MySQL user on the server, and that is entirely a hosting-account decision, not something Joomla’s Global Configuration controls. If the same MySQL user was reused across several databases, perhaps because one hosting account runs multiple sites and it was quicker to set up one shared user at the start, then every one of those databases is reachable through the credentials sitting in this one site’s `configuration.php` file. That single file becomes far more valuable to an attacker than it should be. Read access to one site’s configuration, through a misconfigured backup, a path disclosure, or a vulnerable extension with a local file read flaw, does not just expose that site’s data. It exposes every database the same user can reach, including sites that were never themselves vulnerable to anything. A perfectly secure site can end up compromised purely because it shares a database user with a less careful neighbour on the same account. This is the same underlying risk as [connecting as the MySQL root user](https://mysites.guru/tools/database-integrity/database-user-is-root/), just at a smaller scale. Root exposes every database on the whole server; a shared but non-root user exposes every database that one user happens to have been granted access to. Both turn a single leaked credential into a multi-site incident instead of a single-site one. It also complicates cleanup after any single site is compromised. If a shared user’s credentials leak from one site and you only reset the password on that one site’s database, the same old password may still be sitting in `configuration.php` on every other site that shared it, still working until you go and check each one individually. Agencies running several client sites on one hosting account are the group this affects most, because it is the setup where reusing one MySQL user across several databases feels like the fastest way to get a new site online. You can check this for yourself without any tooling. Connect to the database with the credentials from your site’s `configuration.php`, whether through phpMyAdmin or the command line, and run `SHOW DATABASES;`. If the result lists more than the one database your site actually uses, this check is failing. ## One database, one user A one-to-one relationship between database and database user. Each site’s Joomla installation connects using its own MySQL user, and that user has privileges on that site’s database only. If you manage several Joomla sites on one hosting account, that means creating one MySQL user per site, not one MySQL user for the account. This is a different question from whether the database user is [running as root](https://mysites.guru/tools/database-integrity/database-user-is-root/), even though the two checks often fail together. A non-root user that can still see three other databases is not a superuser problem; it is a scoping problem, and it is fixed by narrowing the grants on an existing style of account rather than by avoiding a specific username. ## Restricting a user to one database 1. In your hosting control panel’s MySQL Databases section, check how many databases the user configured in your site’s `configuration.php` currently has access to. 2. Create a new MySQL user, unique to this site, with privileges granted on this site’s database only. 3. Update `configuration.php` in the site’s root folder with the new `$user` and `$password` values; this has to be edited directly in the file rather than through Joomla’s Global Configuration screen. 4. Log in to `https://yoursite.com/administrator` and confirm the site still connects correctly. 5. Once the new, scoped user is working, remove the old shared user’s access to this database, or delete it entirely if nothing else still depends on it. 6. Repeat for any other sites that were sharing the same MySQL user, one at a time, so you always have a working site to compare against. ## Checking database grants on every snapshot We connect using your site’s own configured credentials on every snapshot and check how many databases they can see. There is no one-click fix for this, because creating a new, scoped MySQL user is a hosting-account change, so we flag it clearly and leave the fix to you. This check pairs with three others in the same family: whether your database prefix is [still the guessable default](https://mysites.guru/tools/database-integrity/default-database-prefix/), whether your [database user is running as root](https://mysites.guru/tools/database-integrity/database-user-is-root/), and whether [leftover installer backup tables](https://mysites.guru/tools/database-integrity/leftover-backup-tables/) are sitting in your live database. ## [One Site, One Database User](https://mysites.guru/free-audit/?check=joomla/databaseintegrity/accessonedb) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/databaseintegrity/accessonedb) ## Further Reading - [Official MySQL: Adding User Accounts](https://dev.mysql.com/doc/refman/5.5/en/adding-users.html) - [Wikipedia: SQL injection](https://en.wikipedia.org/wiki/SQL_injection) ## Frequently Asked Questions Show all Why would one database user have access to more than one database? Usually because the hosting account was set up with a single shared MySQL user years ago, before separate sites were added, and nobody created scoped users for each new database as they were added. It is a convenience shortcut at setup time that turns into a liability later. My database credentials are in a plain text file. Does that matter if the user can only see one database? It matters less than if the user could see several, but it still matters. Joomla has to store the database username and password in plain text in configuration.php so it can connect on every page load. Scoping the user to one database limits the blast radius if that file is ever read by someone who should not have it. I run several sites on one hosting account. What should I do? Create a separate MySQL user for each database, with privileges limited to that one database only. It takes a few extra minutes per site when you are already in your hosting control panel, and it is the difference between one compromised site and every site on the account being exposed together. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [What the shared database user check reads](#what-the-shared-database-user-check-reads) - [How one shared credential exposes every site on the account](#how-one-shared-credential-exposes-every-site-on-the-account) - [One database, one user](#one-database-one-user) - [Restricting a user to one database](#restricting-a-user-to-one-database) - [Checking database grants on every snapshot](#checking-database-grants-on-every-snapshot) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fdatabase-integrity%2Fdatabase-user-sees-other-databases%2F&text=One%20Site%2C%20One%20Database%20User)[](https://bsky.app/intent/compose?text=One%20Site%2C%20One%20Database%20User%20https%3A%2F%2Fmysites.guru%2Ftools%2Fdatabase-integrity%2Fdatabase-user-sees-other-databases%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fdatabase-integrity%2Fdatabase-user-sees-other-databases%2F) Topics [Database integrity](https://mysites.guru/tools/database-integrity/)Joomla [ ★★★★★ > "Brilliant service. At a time when I needed a view all sites and their activity and security. This service is invaluable. I would recommend this service and can do lots more than I use it for. Keep up the good work." ![Barry Bet-hall](https://mysites.guru/images/reviews/barry-bet-hall.webp) Barry Bet-hallDesigner. ](https://mysites.guru/reviews/) ## More checks in [Database integrity](https://mysites.guru/tools/database-integrity/) - [ ### Your Database User Should Not Be root Only 0.1% of sites get this wrong, but the failure is total. A root database user means one SQL injection reaches every database on the server. ](https://mysites.guru/tools/database-integrity/database-user-is-root/) - [ ### The Default Database Prefix A jos\_ Joomla database prefix isn't a vulnerability by itself. It's a force multiplier for one, and a sign the site started life on a much older Joomla version. ](https://mysites.guru/tools/database-integrity/default-database-prefix/) - [ ### Backup Tables Left In The Database Joomla's installer renames old tables to bak\_ instead of deleting them. They sit in your live database, readable by anything that reaches your data. ](https://mysites.guru/tools/database-integrity/leftover-backup-tables/) ## More from the blog [ ![How to Check Your Joomla Database Security with mySites.guru](https://mysites.guru/_astro/joomla-database-security.Bmo7ySy7_22Qlsd.webp) ### How to Check Your Joomla Database Security with mySites.guru Your Joomla database might be running with the default jos\_ prefix, a root user, or excessive privileges. Here's how to flag each issue and fix it. ](https://mysites.guru/blog/how-to-check-joomla-database-security/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [What the shared database user check reads](#what-the-shared-database-user-check-reads) [How one shared credential exposes every site on the account](#how-one-shared-credential-exposes-every-site-on-the-account) [One database, one user](#one-database-one-user) [Restricting a user to one database](#restricting-a-user-to-one-database) [Checking database grants on every snapshot](#checking-database-grants-on-every-snapshot) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)