Keeping applications separated.
THE PRINCIPLE
One database and one database user per application, with privileges only on that database.
WHY
A shared user with access to everything means one application's vulnerability exposes all of them. This is a common and avoidable failure.
CREATING THEM
Create the database, create a user with a strong unique password, and grant privileges on that database only.
Never grant privileges on all databases. Never let an application connect as root.
NAMING
Use a convention that makes the owner obvious: appname_db, appname_user.
CONNECTION LIMITS
Each application holds connections. Several applications on one server can exhaust the connection limit, at which point everything fails.
Set the limit to match what your applications actually open, and check that applications are not leaking connections.
BACKUPS
Dump each database separately, so you can restore one without affecting others.
MONITORING
Watch the slow query log. One application's bad query slows the database for every application sharing it.
