Install and secure phpMyAdmin on a Linux VPS

phpMyAdmin is the familiar web interface for MySQL and MariaDB: browse tables, run queries, import and export databases. On a VPS without a control panel you install it yourself, and because bots constantly probe /phpmyadmin, securing it is as important as installing it.

Before you start

• A VPS with a working LEMP or LAMP stack: Nginx or Apache, PHP-FPM and MySQL/MariaDB.
• A domain with HTTPS (Let's Encrypt) so database passwords are never sent in plain text.
• The PHP extensions mbstring, zip, gd, xml and mysqli.

Download phpMyAdmin

Distribution packages lag behind and pull in Apache, so installing the official release in its own folder is cleaner:

cd /tmp && wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.tar.gz

mkdir -p /usr/share/phpmyadmin && tar -xzf phpMyAdmin-latest-all-languages.tar.gz --strip-components=1 -C /usr/share/phpmyadmin

Create its config and temp folder:

cp /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.php && mkdir -p /usr/share/phpmyadmin/tmp && chown -R www-data: /usr/share/phpmyadmin/tmp

(Use nginx or apache instead of www-data on AlmaLinux/Rocky.) In config.inc.php set a random 32-character blowfish_secret (openssl rand -base64 24) and add:

$cfg['TempDir'] = '/usr/share/phpmyadmin/tmp';

Serve it on a hidden URL (Nginx)

Inside your site's server { } block, use a path that is not /phpmyadmin:

location ^~ /db-admin-7f3k/ {
    alias /usr/share/phpmyadmin/;
    index index.php;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.pma_htpasswd;
    allow 198.51.100.25;
    deny all;

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $request_filename;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }
}

Adjust the PHP-FPM socket to your version and replace the IP with yours. Create the password file:

apt install apache2-utils && htpasswd -c /etc/nginx/.pma_htpasswd pmaadmin

Then nginx -t && systemctl reload nginx.

Apache alternative

Create /etc/apache2/conf-available/pma.conf:

Alias /db-admin-7f3k /usr/share/phpmyadmin
<Directory /usr/share/phpmyadmin>
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.pma_htpasswd
    <RequireAll>
        Require valid-user
        Require ip 198.51.100.25
    </RequireAll>
</Directory>

Enable it with a2enconf pma && systemctl reload apache2.

Use a dedicated database account

Do not log in to phpMyAdmin as MySQL root. Create a user for the databases you manage:

CREATE USER 'pmauser'@'localhost' IDENTIFIED BY 'strong-password';
GRANT ALL PRIVILEGES ON shopdb.* TO 'pmauser'@'localhost';

Also set $cfg['Servers'][$i]['AllowRoot'] = false; in config.inc.php.

Check that it works

• Opening https://example.com/db-admin-7f3k/ from your IP prompts for the HTTP password, then the phpMyAdmin login.
• From another IP, or at /phpmyadmin, you get 403 or 404.
• The phpMyAdmin home page shows no warnings about the blowfish secret or temp directory.

Troubleshooting

• The mbstring extension is missing: install it (apt install php8.3-mbstring) and restart PHP-FPM.
• PHP file downloads instead of running: the nested PHP location or fastcgi_pass socket is wrong.
• Import fails for large files: raise upload_max_filesize and post_max_size in php.ini and client_max_body_size in Nginx, or import via the command line.
• mysqli::real_connect(): (HY000/2002): MySQL is not running or listens on a different socket/host.

phpMyAdmin FAQ

Is phpMyAdmin safe to use?

Yes when kept updated and hidden behind HTTPS, extra authentication and IP limits. Unprotected installs are a frequent attack target.

Is there an alternative without a web interface exposure?

Use a desktop client such as DBeaver or HeidiSQL over an SSH tunnel; nothing is exposed to the web at all.

Does cPanel include phpMyAdmin?

Yes, under cPanel → Databases → phpMyAdmin, already secured and logged in for your account.

Next steps

• Import and export with phpMyAdmin
• Install a LEMP stack
• Use SSH tunnels