WordPress database user privileges: how little is enough

For normal operation WordPress needs only SELECT, INSERT, UPDATE and DELETE on its database. You may revoke DROP, ALTER and GRANT, but the WordPress hardening guide warns that doing so can break updates that change the schema, so keep tested backups.

What the docs say

The hardening guide lists the four privileges needed for day to day use. It says you can revoke DROP, ALTER and GRANT, with the caution that some updates change the database structure and would then fail.

Why bother

If an attacker gets SQL injection through a plugin, the damage depends on what the database account may do. With fewer privileges, the same bug cannot drop tables or change structure. It can still read and change data, so this limits blast radius, it does not remove the bug.

A practical routine

1. Create the database user with the full set during install or major updates.
2. After the site is stable, reduce to the four everyday privileges if your host allows it.
3. Before a core or plugin update that may alter the schema, restore the privileges temporarily or test on staging first.
4. Keep backups, tested by actually restoring one.

This two-mode routine costs a few minutes per update, so decide whether the extra protection is worth the effort for your site. For a small brochure site on managed hosting, the tighter win is usually patching plugins fast.

Shared servers

The guide says to use a separate database and separate user for each blog on a shared server. Then one compromised site cannot read another site's tables through a shared account.

Other items from the same guide

• Use SFTP instead of FTP.
• Require HTTPS for administration.
• Download WordPress only from wordpress.org.
• Keep WordPress current, since older versions no longer receive security updates.

Quick check

Sources

• Hardening WordPress

Last reviewed: 19 October 2026.