Install phpMyAdmin Securely on Ubuntu 24.04 with Apache

This article is a localized edition of the Japanese original. Read the Japanese original

phpMyAdmin is a tool for managing MySQL and MariaDB from a browser. It is convenient, but a phpMyAdmin instance on the web is a direct entrance to your database. If anyone can reach its login screen, it becomes a target for password brute-forcing and for attacks on known vulnerabilities.

This article walks through installing phpMyAdmin from the Ubuntu packages (apt) on Ubuntu 24.04 with Apache, and then restricting it so that outsiders cannot touch it. The steps were tested as of November 2026 with the Ubuntu 24.04 packages (phpmyadmin 5.2.1, PHP 8.3, Apache 2.4.58). The approach follows "Securing your phpMyAdmin installation" in the official phpMyAdmin documentation.

Prerequisites

• An Ubuntu 24.04 server where you can use sudo
• MySQL or MariaDB running on the same server (if not, install it and finish the initial setup first: initial MySQL security setup)
• Ideally, a fixed IP address that you connect from for administration (used for the IP restriction)

Step 1: Install Apache, PHP and phpMyAdmin

sudo apt update
sudo apt install apache2 libapache2-mod-php phpmyadmin

There is a reason libapache2-mod-php is listed explicitly. The phpmyadmin package only "recommends" the PHP module for Apache, and when Apache is already present that recommendation can be treated as satisfied, so the module that runs PHP inside Apache does not get installed. In our test, opening /phpmyadmin/ in that state returned HTTP 200 and displayed the raw PHP source code. It may not happen in every environment, but naming the packages together prevents it. On a server that uses PHP-FPM, use your existing PHP-FPM setup instead of libapache2-mod-php.

The installer asks two questions.

1. Web server to reconfigure automatically: press the space bar to mark apache2 (*), then press Enter. If you continue without marking it, no Apache configuration is created.
2. Configure database for phpmyadmin with dbconfig-common?: this decides whether to create the phpMyAdmin "configuration storage" (a database for bookmarks, history and so on). If you use MySQL on the same server, "Yes" is fine. You can redo this later with sudo dpkg-reconfigure phpmyadmin.

When you select apache2, the following configuration is created and enabled automatically.

Older guides tell you to link /usr/share/phpmyadmin to /var/www/html/phpmyadmin and give ownership to www-data, but this is unnecessary with the packaged version. Avoid making program files writable by the web server user.

Open http://server-address/phpmyadmin/ in a browser and confirm the login screen appears. At this point, however, anyone can reach the login screen. Do not leave it reachable from outside until you have completed the next step.

Step 2: Restrict source IPs and add Basic authentication in Apache

Before anyone reaches phpMyAdmin, set up two gates at the Apache level.

• IP restriction: return 403 to anyone not connecting from an administrator's address
• Basic authentication: ask for a separate username and password before the phpMyAdmin login screen

First, create the password file for Basic authentication (htpasswd is part of apache2-utils, which is installed along with apache2).

sudo htpasswd -c /etc/apache2/.htpasswd-pma pmaadmin
sudo chown root:www-data /etc/apache2/.htpasswd-pma
sudo chmod 640 /etc/apache2/.htpasswd-pma

-c creates a new file. When adding a second or later user, run the command without -c (with it, existing users are wiped).

Instead of editing the package's apache.conf directly, add a separate configuration file.

sudo nano /etc/apache2/conf-available/phpmyadmin-restrict.conf

<Directory /usr/share/phpmyadmin>
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.htpasswd-pma
    <RequireAll>
        # Replace with the IP address you administer from (separate multiple addresses with spaces)
        Require ip 203.0.113.10
        Require valid-user
    </RequireAll>
</Directory>

Conditions inside RequireAll mean "allow only when all of them are met." Only someone who comes from the listed IP and also passes Basic authentication can reach the phpMyAdmin login screen.

sudo a2enconf phpmyadmin-restrict
sudo apache2ctl configtest
sudo systemctl reload apache2

Reload only after you see Syntax OK. In our test environment we confirmed 401 without credentials, 200 with correct credentials, and 403 from a non-allowed IP even with correct credentials.

If you have no fixed IP, either drop the Require ip line and rely on Basic authentication alone, or open an SSH tunnel to the server and limit access to Require ip 127.0.0.1 ::1.

# Run on your local PC. Connects local port 8080 to port 80 on the server
ssh -L 8080:127.0.0.1:80 username@server-address

With the tunnel open, browse to http://127.0.0.1:8080/phpmyadmin/ on your PC, and the server sees the connection as coming from 127.0.0.1.

For how Basic authentication and .htpasswd work, see also How to set up Basic authentication in Apache.

Step 3: Add phpMyAdmin settings

Create your own settings file in /etc/phpmyadmin/conf.d/. Files here are not overwritten by package updates.

sudo nano /etc/phpmyadmin/conf.d/90-local.php

<?php
// Block logins as the MySQL root user
$cfg['Servers'][1]['AllowRoot'] = false;

// Seconds of inactivity before logout (default is 1440 seconds)
$cfg['LoginCookieValidity'] = 1800;

sudo php -l /etc/phpmyadmin/conf.d/90-local.php

If you see No syntax errors detected, the syntax is correct. The settings take effect the next time you open a page.

• AllowRoot: prevents logging in to phpMyAdmin as root. For everyday work, create a user with privileges only on the databases it needs (MySQL users and privileges).
• Login method: the packaged default is cookie authentication (you enter a MySQL username and password on the login screen). Do not use the config method, which stores the password in the configuration file and lets anyone in without a login screen.
• Two-factor authentication: phpMyAdmin itself also supports two-factor authentication, which each user can enable from "Settings" after logging in (it requires the configuration storage).

Step 4: Use it over HTTPS

Login credentials and data travel in the clear otherwise, so use phpMyAdmin only over HTTPS. If your site already has a certificate, you can open it at https://your-domain/phpmyadmin/. If not, install a certificate from Let's Encrypt or another CA and redirect HTTP to HTTPS (How to set up an SSL certificate on Apache with Certbot).

When you use an SSH tunnel, the traffic is encrypted by SSH, so plain HTTP inside the tunnel is fine.

Step 5: Firewall ports to open

phpMyAdmin runs on top of Apache, so there are no new ports to open. Having the web ports 80 and 443 open is enough.

sudo ufw allow OpenSSH
sudo ufw allow "Apache Full"
sudo ufw enable
sudo ufw status

If you run ufw enable before allowing OpenSSH, your current SSH session may be cut off. Mind the order. You do not need to open MySQL's port 3306 for phpMyAdmin (phpMyAdmin connects to MySQL from the same server).

If you limit port 443 itself to specific IPs in UFW, nobody else can reach the websites on the same server either. To restrict only phpMyAdmin, do it in the Apache configuration from Step 2. UFW usage is covered in How to set up a firewall with UFW.

Operational tips

• Keep updating: vulnerabilities have been found in phpMyAdmin many times in the past. Run sudo apt update && sudo apt upgrade regularly and apply Ubuntu security updates.
• Turn it off when not in use: if you rarely use it, you can disable it with sudo a2disconf phpmyadmin and sudo systemctl reload apache2, and re-enable it with a2enconf only when needed.
• Changing the URL alone is not protection: you can rename /phpmyadmin to something hard to guess, but that only makes it less visible. It does not replace IP restrictions or authentication.
• Watch the logs: in /var/log/apache2/access.log you can check requests to /phpmyadmin and their response codes (for example, a flood of 401 or 403).

Troubleshooting

Summary

• On Ubuntu, install apache2, libapache2-mod-php and phpmyadmin together, and mark apache2 when asked.
• Do not edit the package files directly: add Apache settings under conf-available and phpMyAdmin settings under /etc/phpmyadmin/conf.d/.
• Layer source IP restrictions and Basic authentication in Apache, block root login in phpMyAdmin, and use it only over HTTPS or through an SSH tunnel.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)