| docs

Appearance

Remote MySQL ​

Remote MySQL is one screen with two halves. The top holds the server-wide policy for remote database access; the rest lists every host that hosting accounts have allowed to reach their databases from outside the server. Accounts allow individual hosts themselves on their Remote MySQL page; this screen limits what they are allowed to allow, and lets you revoke what they allowed.

Overview ​

URL: /admin/settings/remote-mysql

Navigate to Settings > Databases > Remote MySQL.

Remote MySQL with the access policy above the list of allowed hosts

Access policy ​

Allow access from any host (%) decides whether accounts may use the % wildcard, which opens the database port to the whole internet.

  • Off (default) - accounts may only allow specific addresses, ranges (/8, /16, /24), and patterns such as 203.0.113.%. An attempt to add % is refused with an explanation.
  • On - accounts may additionally allow %.

Use Save changes to apply the policy.

The policy applies to the whole server. Hosts allowed before you turn the policy off keep working until they are removed, so switching it off is not retroactive. Use the host list below to find and revoke the wildcard entries that predate the change.

Warning: Leave this off unless you have a concrete reason. A % entry exposes a customer's databases to every address on the internet, and the password becomes the only thing protecting them.

Allowed hosts ​

The lower half lists every host allowed across all accounts. Rows are only ever created by account owners on their Remote MySQL page, so there is nothing to add here. A server where nobody has allowed a host shows No remote hosts allowed.

ColumnMeaning
AccountThe hosting account that allowed the host.
Allowed hostThe address, range, or pattern. A % entry, meaning any host, is highlighted.
DescriptionThe label the account owner gave it.
AddedWhen the entry was created.

The list is sorted newest first, and can be searched by account, host, or description. The Any host (%) only filter narrows it to the wildcard entries, which is the fastest way to audit the server after turning the wildcard policy off.

Revoke ​

Revoke on a row, or Revoke selected for several at once, removes database access from that host immediately. The database permissions are dropped and the firewall opening is removed, unless another account still allows the same host, in which case the opening stays for that account.

Revoking is not a warning to the customer: connections from that host stop working at once. Tell the account owner what changed, or ask them to remove the entry themselves.

Making the feature available ​

Whether an account sees the client page at all is decided per hosting plan, not here. Grant or withdraw the Remote MySQL feature on the Hosting Plans page. This screen only governs what accounts that already have the feature may do.

What happens on the server ​

Allowing a host does two things: it creates the matching database permissions for that account's database users at that host, and it opens the database port to that source in the firewall. Removing the host reverses both. The port stays closed for every source nobody has allowed.