Choose a private connection

When the website and database share a server or container network, use its private connection path. Avoid public port mappings unless a documented business need requires them.

Limit accounts

Give each app its own database account with only the permissions it needs. Do not reuse the database root account for every site. Keep credentials out of code repositories, chat, and public error pages.

Remote access

Use a supported encrypted private connection, VPN, or reviewed tunnel when required. Restrict source addresses and confirm the database's authentication and TLS configuration. A firewall rule is only one layer of protection.

Before making changes

Record the current connection settings and take a consistent backup. Test the intended app after a credential or networking change. Never reset or recreate the database to solve an ordinary connection error without a recovery plan.