Enable MySQL Remote Access in cPanel

By default, MySQL on a cPanel server only accepts connections from localhost. To connect from an external IP: a development machine, a remote application, or a database GUI like TablePlus or DBeaver: you need to grant remote access.

Method 1: cPanel Remote MySQL (per account)

Each cPanel account can grant remote access to its own databases without needing WHM or root access.

Log into cPanel.

Go to Databases → Remote MySQL.

Enter the IP address or hostname of the remote machine that needs access.

Click Add Host.

This adds the IP to MySQL’s host table, allowing connections from that address to any database owned by this cPanel account.

To find your current public IP, visit ifconfig.me or run curl ifconfig.me in your terminal.

Method 2: WHM (all accounts, server-level)

If you need to grant remote access to a specific IP for all databases on the server:

1. Log into WHM
2. Go to SQL Services → Additional MySQL Access Hosts
3. Enter the IP or hostname
4. Click Save

Method 3: Grant via MySQL directly (root access)

For more granular control, grant access directly in MySQL:

mysql -u root -p

# Grant access to a specific database from a specific IP
GRANT ALL PRIVILEGES ON dbname.* TO 'dbuser'@'REMOTE_IP' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;

# Verify
SELECT user, host FROM mysql.user WHERE user = 'dbuser';

Open MySQL port in the firewall

Even with MySQL permissions set, the server firewall blocks port 3306 by default. Open it for your IP:

# CSF firewall (standard on cPanel servers)
csf -a REMOTE_IP  # whitelist the IP entirely
# OR add only port 3306:
iptables -I INPUT -s REMOTE_IP -p tcp --dport 3306 -j ACCEPT
csf -a REMOTE_IP tcp 3306  # permanent via CSF

Or from WHM → Plugins → ConfigServer Security & Firewall → Firewall Allow IPs.

Connecting from a database client

Use these settings in TablePlus, DBeaver, Sequel Pro, or similar:

Setting	Value
Host	Your server IP
Port	3306
Database	Your database name
Username	Your MySQL username
Password	Your MySQL password

Never open port 3306 to `0.0.0.0/0` (all IPs). MySQL exposed to the internet is a major security risk. Always restrict to specific, trusted IP addresses. Use SSH tunneling for development access instead of opening the firewall.

Secure alternative: SSH tunnel

The most secure way to access MySQL remotely is through an SSH tunnel. No firewall changes needed:

# Forward local port 3307 to remote MySQL
ssh -L 3307:localhost:3306 root@YOUR_SERVER_IP -N

# Then connect your database client to:
# Host: 127.0.0.1  Port: 3307

The tunnel encrypts all traffic and requires only your SSH credentials: no MySQL port needs to be open on the firewall.