Restrict access to phpMyAdmin by IP

2026 context: this is a historic Apache example, not a current server recipe

The Apache 2.2 directives in this 2015 article should not be copied to a modern server. An IP allowlist can still be a useful layer, but it is not the whole security plan and it can be unreliable for people on mobile networks, VPNs or changing home connections. Keep phpMyAdmin off the public internet where possible; otherwise use HTTPS, current distribution packages, individual least-privilege accounts and a tested recovery path. The legacy note below is retained as an incident-era explanation of why a database administration login needs protection.

2015 reference

phpMyAdmin is a handy tool for administering mySQL from an easy to use web interface. However, leaving such a powerful tool open to the entire world can be downright dangerous and is something that should be avoided if possible. Ultimately it’s best to keep it off your production server (or any other server you care about). However, if you absolutely must use phpMyAdmin, you should restrict who can access it. Below is a quick and easy tweak that will only allow access to it from a specific IP address. This tweak assumes an Ubuntu LAMP stack, but should work fine on any Linux distribution, although paths may be different.

Restricting access to phpMyAdmin on an Ubuntu LAMP stack

Under an Ubuntu LAMP install, phpMyAdmin adds an Apache vhost that makes it publically available at http://yoursite.com/phpmyadmin.

Having the login for phpmyadmin publically accessible is not a great idea, as bots look for this url and continually pound on it, trying to gain access by exploiting security vulnerabilities. Luckily, we can disable this.

Under Ubuntu, the phpMyAdmin apache conf file is located at: /etc/apache2/conf.d/phpmyadmin.conf

Simply add the following order, allow, deny directives to make it available to localhost only.

Order Deny,Allow
Deny from All
Allow from 123.123.123.123

The modified apache config file is below.

# phpMyAdmin default Apache configuration

Alias /phpmyadmin /usr/share/phpmyadmin

<Directory /usr/share/phpmyadmin>

        #do not allow access from the outside world!
        Order Deny,Allow
        Deny from All
        Allow from 123.123.123.123

        Options FollowSymLinks
        DirectoryIndex index.php

        <IfModule mod_php5.c>
                AddType application/x-httpd-php .php

                php_flag magic_quotes_gpc Off
                php_flag track_vars On
                php_flag register_globals Off
                php_admin_flag allow_url_fopen Off
                php_value include_path .
                php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
                php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/
        </IfModule>

</Directory>

# Authorize for setup
<Directory /usr/share/phpmyadmin/setup>
    <IfModule mod_authn_file.c>
    AuthType Basic
    AuthName "phpMyAdmin Setup"
    AuthUserFile /etc/phpmyadmin/htpasswd.setup
    </IfModule>
    Require valid-user
</Directory>

# Disallow web access to directories that don't need it
<Directory /usr/share/phpmyadmin/libraries>
    Order Deny,Allow
    Deny from All
</Directory>
<Directory /usr/share/phpmyadmin/setup/lib>
    Order Deny,Allow
    Deny from All
</Directory>

After editing the file, make sure to restart apache, so the changes take effect.

sudo service apache2 restart

That’s all there is to it! Once Apache restarts, only visitors from 123.123.123.123 will be able to access phpMyAdmin. All other visitors will receive 403 forbidden.

Current references: phpMyAdmin installation and security guidance · Apache 2.4 access control · Web Development