Practical protection.
THE ESSENTIALS
A strong generated password, different for every database user One user per application, with access only to its own database Remote access disabled unless genuinely needed The configuration file outside the web root where possible, at 600 permissions
WHY ONE USER PER APPLICATION
A shared user with access to every database means one application's vulnerability exposes all of them.
This is the single most useful separation available on shared hosting.
THE CONFIGURATION FILE
It contains the credentials in plain text. Confirm it is not publicly reachable: visiting the path should return Forbidden or Not Found, never content.
Check after every deployment.
A renamed backup such as wp-config.php.bak may be served as plain text, which is worse than the original.
REMOTE ACCESS
Off, unless required. When required, restrict to specific addresses and remove them when finished.
NEVER STORE CARD DETAILS
Use a hosted payment gateway. There is no legitimate reason for a small business database to hold card numbers.
BACKUPS
They contain everything the database does. Protect the storage accordingly, and encrypt where your tool supports it.
