mysql_secure_installation: What Each Prompt Means and How to Answer

This article is a localized edition of the Japanese original. Read the Japanese original

mysql_secure_installation is a program bundled with MySQL that tightens the security of a freshly installed server. You answer a few interactive prompts, and it sets a password for the root account, removes root accounts that can connect from outside the local host, removes anonymous users, and removes the test database. This article was checked against the MySQL 8.4 Reference Manual and Ubuntu bug reports (Launchpad) as of November 2026.

Before you run it

Make sure the MySQL server is running first. On Ubuntu the service name is mysql (on some distributions it is mysqld).

sudo systemctl status mysql
sudo mysql_secure_installation

When it starts, it connects to the local server (localhost) and begins asking questions. You can change the connection target with --host, --port, or --socket. The --password (-p) option is accepted but ignored; you always type the password at the prompt.

What each prompt means and how to answer

The exact wording varies a little by version and distribution, but the prompts cover the following. In MySQL 8.0 and later, pressing any key other than "y" or "Y" means "no."

1. Use the password validation component (VALIDATE PASSWORD)?

You are asked whether to enable the validate_password component, which checks password strength. If you enable it, the password you set next and any password set later with statements such as CREATE USER are checked.

If you enable it, you then choose how strict the check is (the policy).

The default minimum length is 8 characters. The STRONG dictionary check runs only when a dictionary file is set in validate_password.dictionary_file.

Once it is enabled, short passwords generated by applications or admin tools may be rejected. If you use a long random string for the WordPress password, it passes even with MEDIUM.

2. Set the root password

Enter a password for the root account, then enter it again to confirm.

With MySQL 8.0 installed from Ubuntu or Debian packages, root authenticates with auth_socket (which checks whether you are logged in as the OS root user) rather than a password. In that state, trying to set a password used to fail with a "SET PASSWORD has no significance" error, and the prompt kept repeating. Fixed packages (the Ubuntu builds of mysql-server 8.0.33 and later) were released for Ubuntu 20.04, 22.04 and others; they skip the password step and print a message saying auth_socket is in use. Update the package to the latest version before running the script.

As long as root uses auth_socket, you can only get into MySQL as root with sudo mysql, so no one can log in as root from outside even without a password. Change the authentication method as follows only if you need to log in as root with a password, for example from an admin tool.

-- Run this after logging in with sudo mysql
ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'a-long-random-password';

3. Remove anonymous users? (Remove anonymous users?)

Accounts with an empty user name (anonymous users) let anyone connect without a user name, so answer "yes" to remove them. Depending on how MySQL was installed, there may be no anonymous users to begin with; answering "yes" is still fine.

4. Disallow remote root login? (Disallow root login remotely?)

This removes root accounts that can connect from anywhere other than localhost. Answer "yes." Even if you need to manage the server remotely, it is safer to create a separate user with limited privileges than to use root.

5. Remove the test database? (Remove test database and access to it?)

This removes the test database that anyone can use, along with the privileges that allow access to databases whose names start with test_. Answer "yes" unless you use it.

6. Reload the privilege tables? (Reload privilege tables now?)

Answer "yes" so that the changes take effect immediately.

Check the result

Log in with sudo mysql and check which accounts remain.

SELECT user, host, plugin FROM mysql.user;
SHOW DATABASES;

If there are no rows with an empty user name, no root account whose host is %, and no test in the database list, the changes have been applied.

Create a database and user for WordPress

Do not connect WordPress as root. Create a database and a user just for WordPress.

CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'a-long-random-password';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';

Put the database name, user name, and password you created into DB_NAME, DB_USER, and DB_PASSWORD in WordPress's wp-config.php. If the web server and the database are on the same server, leave DB_HOST as localhost.

If you cannot connect, see also "Causes and fixes for MySQL Access denied errors."

On MariaDB

In MariaDB the program that does the same job is called mariadb-secure-installation (it used to be called mysql_secure_installation, and the old name still works). It likewise asks about changing the root password, removing anonymous users, disallowing remote root login, removing the test database, and reloading the privilege tables. Because MariaDB uses unix_socket authentication for root by default, in most cases you can manage it with sudo mariadb without setting a root password.

Notes

• mysql_secure_installation only cleans up the initial state. After running it, you still need ongoing practices such as not opening port 3306 to the outside in your firewall and not creating users you do not need.
• With --use-default, it runs non-interactively with the default answers. Use it when you include it in automated provisioning.
• On a server that already holds data, take a backup with mysqldump or similar before changing settings.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)