|
sherryMNVC
|
March 28, 2016 at 4:23 pm
In order to install EE I had to “turn on” all SQL User permissions. I feel that leaving these settings on opens up my site to hacking.
To make sure my database stays secure – What are the minimum user permissions settings that EE needs to function properly?
Thanks!
|
|
Josh
|
March 28, 2016 at 4:35 pm
Hi there,
At a minimum to use Event Espresso, the MySQL database user only needs data read and data write privileges to the MySQL database; SELECT, INSERT, UPDATE and DELETE.
The minimum user permissions change for updating though, because with many updates it will require database structural changes, such as adding new tables or a change the schema.
In such case, before installing new add-on plugins or updating the software, you will need to temporarily allow the database user the required privileges you used when you installed the plugin. Attempting updates without having these privileges can cause problems when database schema changes occur. Therefore, it is not recommended to revoke these privileges.
If you do feel the need to do this for security reasons, then please make sure that you have a solid backup plan in place first, with regular whole database backups which you have tested are valid and that can be easily restored. A failed database upgrade can usually be solved by restoring the database back to an old version, granting the proper permissions, and then letting Event Espresso try the database update again. Restoring the database will return it back to that old version and the WordPress administration screens will then detect the old version and allow you to run the necessary SQL commands on it.
|
|
sherryMNVC
|
March 28, 2016 at 5:08 pm
Thank you for your fast reply!
Yes, on first installation I kept getting the database error so I enabled all permissions and then the installation worked.
Let me make sure I understand correctly— I can set it back to only have these enabled? SELECT, INSERT, UPDATE and DELETE
But if when I make any upgrades I will need to enable ALL permissions before upgrading and then after a successful upgrade I can change it back to only have these 4 enabled?
|
|
Lorenzo Orlando Caum
|
March 29, 2016 at 9:12 am
Hello Sherry,
That sounds like a good plan with increasing the database permissions prior to updating. That should prevent any errors.
You might consider looking at a managed WordPress hosting solution like WP Engine as they’ll take care of website security for you.
—
Lorenzo
|
