Problem: the database is on the internet
Is your MySQL server listening to the whole internet?
A database installed with the defaults on Windows Server listens on every network interface, and the installer helpfully offers to open the firewall port so you can reach it from your desktop. That is the same as opening it to everyone. Bots scan for port 3306 the way they scan for Remote Desktop, and a root password chosen in a hurry is all that stands between them and every website's data.
Part of the Server setup module, £99 £49.50 per server for twelve months. 30-day money-back promise.
Check in one minute
From a PC that is not on the server's network, open PowerShell and test the port, replacing the address with your server's:
Test-NetConnection your.server.address -Port 3306If TcpTestSucceeded says True, the database is reachable from the internet. MariaDB uses the same port. On the server itself, run netstat -an | findstr 3306: a line showing 0.0.0.0:3306 means it is listening on every interface, while 127.0.0.1:3306 means local only.
Close it by hand
- In my.ini under [mysqld] set bind-address=127.0.0.1 and restart the MySQL service.
- Remove or disable the firewall rule the installer added for port 3306.
- Set a long root password, remove anonymous accounts and the test database, and give each website its own account with rights on its own database only.
- Change every application that was using root to its own account.
Each step is simple. Together they are the part of a server setup most often skipped, because the site worked before they were done.
What ServerMaid does
Local only, from the first minute
Bound to localhost
MySQL or MariaDB is installed listening on 127.0.0.1 only, and the firewall blocks the database port from outside. The health score checks both and says so.
Root secured
A generated 32-character root password is kept in an encrypted vault on the server. Anonymous accounts and remote root are removed and the sample database is dropped.
One account per website
Adding a website creates its schema and an account with rights on that schema only. The credentials are written to the site's private folder for the application to read, never into wwwroot and never on a command line.
Signed packages only
MySQL 8.4 LTS from Oracle's Authenticode-signed installer, or MariaDB 11.8 LTS verified against the SHA-256 MariaDB publishes for every file. You choose the engine in Setup.
Remote access, on purpose
Need to reach the database from your desk? Advanced Setup can open the port to a chosen list of addresses. Otherwise use the tools on the server or a tunnel over Remote Desktop.
Backed up and proven
With the Backups module every database is dumped on a schedule and replayed into a scratch schema to prove it restores. Backups proven by restore.
Questions about database security on Windows
Can I reach the database from my desktop?
Not by default, and that is deliberate. Advanced Setup can open the database port to a chosen list of addresses if you need it; otherwise use the tools on the server or a tunnel.
Does my website need the port open to use the database?
No. A website on the same server talks to the database over localhost. The port only needs to be reachable from outside if something on another machine connects directly, which is rare and better done through a tunnel.
MySQL or MariaDB?
Either. Both are installed the same careful way, bound to localhost with a secured root account. Most PHP applications, including WordPress, run on both.
What if I already have MySQL on the server?
Pre-flight detects it and reports what it found. ServerMaid never replaces a database it did not install. You can secure the existing one by hand using the steps above, or let ServerMaid install a fresh engine for the sites it manages.
Where is the root password kept?
In an encrypted vault on the server that only ServerMaid, running as an administrator, can read. It is never written to a file in wwwroot, shown in a log or passed on a command line.
Take the database off the internet today
The Server setup module installs MySQL or MariaDB local-only with a secured root, and the security baseline keeps it that way. Preview every change before it runs.