How to create a limited-privilege database user in cPanel

You will create a new database user and grant access to a specific database only. This process runs entirely within the cPanel interface without requiring root shell access. The steps target cPanel version 118.x and later.

Prerequisites

• cPanel account with access to the MySQL Databases section.
• Access to the Files area to create or manage database files.
• Knowledge of the database name and the desired username for the new user.
• A secure password for the new database user.

Step 1: Log in to cPanel

Navigate to your hosting provider's login page and enter your cPanel credentials. Click Log In to access the dashboard. Locate the MySQL Databases icon in the Developer Tools or Databases section of the interface. Click the icon to open the database management page.

Step 2: Create a new database

Scroll down to the Manage Databases section. Click the Create New Database button. Enter a unique name for the database in the Database Name field. Do not use the default database name provided by the host. Click Create to finalize the database creation.

Step 3: Create a new database user

Locate the Add New User button within the same Manage Databases section. Click Add New User. Enter the desired username in the Username field. Enter a strong password in the Password field. Confirm the password if prompted. Click Create User to save the new account.

Step 4: Assign database privileges

Click the newly created username in the list below the Manage Databases section. This opens the Assign Permissions page. Find the database you created in the previous step. Ensure the dropdown menu for the database is set to the specific database name. Check the boxes for the specific privileges you want to grant, such as SELECT, INSERT, UPDATE, and DELETE. Do not check GRANT OPTION or ALL PRIVILEGES. Click Assign Permissions to apply the settings.

Step 5: Restrict user scope

Review the Privileges column for the new user. Ensure that ALL PRIVILEGES is unchecked. Verify that GRANT OPTION is also unchecked. This ensures the user cannot create other users or modify server settings. Click Save or Apply if a confirmation dialog appears. The user now has access only to the specific database and the selected rows.

Verify the installation

Click the MySQL Databases icon again to return to the main dashboard. Locate the new user in the list and click the username. Scroll to the Privileges section. You should see a list of specific permissions like SELECT, INSERT, UPDATE, and DELETE next to your database name. The ALL PRIVILEGES row should be empty or unchecked. This confirms the user is restricted to the intended scope.

Troubleshooting

Error: "User already exists"
The system reports that a user with the same name is already registered. Check the MySQL Databases section for existing users. If the user exists but has the wrong permissions, click the username and change the privileges. If the user is unnecessary, delete the user first before creating a new one with the same name.

Error: "Permission denied: SELECT on 'database_name'"
The application cannot read data from the database. Verify that the user has the SELECT privilege assigned in Step 4. Ensure the user is not restricted to a different database. Check that the database name in the application matches the name in cPanel exactly, including case sensitivity on some systems.

Error: "Cannot add user: Access denied"
The cPanel session lacks permission to create new users. Ensure you are logged in with a full cPanel account, not a reseller or limited account. Check that you are not using a restricted API token that blocks user creation. Log out and log back in to refresh your session tokens.

Error: "User cannot connect to database"
The user exists but cannot connect. Verify that the password entered in the application matches the one set in cPanel. Ensure the database engine (MySQL or MariaDB) supports the user's host settings. If using a specific host (e.g., localhost), ensure the application configuration file allows connections from the server's internal host.

Tip: Resetting user access
If the user is locked out, delete the user and recreate it. This clears any corrupted password hashes or permission flags. Always run the steps in order: create database, create user, assign privileges. Do not skip the privilege assignment step, as the default user is often created with no access.

Best Practice: Regular Audits
Review the Privileges list every time you add a new user. Remove unused databases to reduce the attack surface. Never grant GRANT OPTION to application users. This prevents a compromised application from creating backdoor accounts.

Best Practice: Password Rotation
Change the user password every 90 days. Store the password in a secure password manager, not in plain text files. If the hosting provider rotates their root passwords, update the application connection string immediately.