The classic MySQL security mistake is connecting every application to the database as root. Scoped, least-privilege users are the correct default from day one.
-- Create an application user with only the access it needs CREATE USER 'app_user'@'10.0.0.%' IDENTIFIED BY 'strong-random-password'; GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'app_user'@'10.0.0.%'; -- A read-only reporting user CREATE USER 'reports'@'10.0.0.%' IDENTIFIED BY 'another-strong-password'; GRANT SELECT ON myapp.* TO 'reports'@'10.0.0.%'; -- Never GRANT ALL PRIVILEGES to an application account -- and always scope the host - avoid '%' in production FLUSH PRIVILEGES; SHOW GRANTS FOR 'app_user'@'10.0.0.%';
Scope the host portion of the user ('app_user'@'10.0.0.%') to your actual application network rather than '%' (anywhere) — this alone blocks a huge share of opportunistic MySQL attacks that rely on stolen credentials working from any IP.