phpMyAdmin: Install, Access & Security Setup

This is a working reference on phpMyAdmin, drawn from the material our MySQL support team uses on customer database servers. It covers install steps for Ubuntu/Debian and RHEL-family systems, the access URL, first login and the common login failures, the security settings that matter on an internet-facing server, and export/import limits.

What is phpMyAdmin

phpMyAdmin is a free, web-based administration tool for MySQL and MariaDB, written in PHP and released under the GPLv2 license. The current stable release is 5.2.3, which requires PHP 7.2.5 or newer and works against MySQL or MariaDB 5.5 or newer, per the phpMyAdmin download page. It runs as a set of PHP scripts under an existing web server — Apache, Nginx with PHP-FPM, or anything else that executes PHP — and connects to the database server as whatever MySQL user logs into it. Everything it does maps to SQL statements the same account could run from the mysql command-line client.

The project site is phpmyadmin.net and the official documentation is at docs.phpmyadmin.net.

Install on Ubuntu and Debian

Both distributions ship a phpmyadmin package that pulls in PHP and its required extensions:

sudo apt update
sudo apt install phpmyadmin

The package installer asks two questions. First, which web server to configure — selecting apache2 adds an alias so the panel is reachable immediately. Second, whether to configure a database with dbconfig-common — answering yes creates the phpmyadmin control database and its service account.

On Apache, if the installer's automatic configuration did not apply, enable the shipped config by hand:

sudo ln -s /etc/phpmyadmin/apache.conf /etc/apache2/conf-available/phpmyadmin.conf
sudo a2enconf phpmyadmin
sudo systemctl reload apache2

Nginx has no packaged config. The standard approach is a symlink from the web root to the phpMyAdmin files, served by an existing PHP-FPM location block:

sudo ln -s /usr/share/phpmyadmin /var/www/html/phpmyadmin

Install on RHEL, AlmaLinux, and Rocky Linux

The RHEL family does not carry phpMyAdmin in the base repositories; it comes from EPEL. The package name is capitalized:

sudo dnf install epel-release
sudo dnf install phpMyAdmin

The EPEL package drops an Apache config at /etc/httpd/conf.d/phpMyAdmin.conf that, by default, restricts access to localhost. Edit the Require directives in that file to admit your admin IPs, then reload httpd. A manual install from the upstream tarball also works on any distribution: download from phpmyadmin.net, extract into the web root, copy config.sample.inc.php to config.inc.php, and set a blowfish secret — the full procedure is in the official installation documentation.

Access URL and first login

The default access URL is the server address plus /phpmyadmin — for example https://example.com/phpmyadmin (on EPEL installs, /phpMyAdmin also resolves). The login page asks for a MySQL username and password; these are database credentials, not Linux accounts. Sign in with a MySQL user that has privileges on the databases you need to manage.

Common login failures

Where phpMyAdmin comes bundled

On shared and managed hosting, phpMyAdmin is usually already installed. cPanel includes it under the Databases section of every account, and Plesk ships it as the default database webadmin tool — details on the cPanel side are in our cPanel guide. Turnkey stacks such as XAMPP also bundle it for local development. On those platforms there is nothing to install; the panel handles updates.

Main features

Security setup

Bots scan every public web server for /phpmyadmin, /pma, and similar paths; an exposed default install receives automated login attempts within hours of going online. The settings below reduce that exposure:

• Rename the alias. Change the Alias line in the Apache config (or the Nginx location/symlink) from /phpmyadmin to a non-obvious path. This removes the install from generic path scans.
• Restrict by IP. Use Require ip directives in Apache or an allow/deny block in Nginx so only known admin addresses reach the login page. The EPEL package does this by default.
• Add a second login layer. HTTP basic auth (htpasswd plus a Require valid-user directive, or auth_basic in Nginx) in front of the panel means a phpMyAdmin vulnerability alone is not enough to reach the login form.
• Block root login. Set AllowRoot to false in config.inc.php so the MySQL root account cannot authenticate through the web panel; use named admin accounts with the privileges they need.
• Force HTTPS. Set ForceSSL in config.inc.php or redirect at the web server. Credentials travel in the login POST; plain HTTP exposes them.
• Keep it updated. phpMyAdmin publishes security advisories regularly, and distribution packages track those fixes. An outdated copy on a public URL is one of the most common web compromise vectors.

Export and import limits

Import failures on larger dump files are a PHP limit, not a phpMyAdmin bug. The upload cap is the smaller of upload_max_filesize and post_max_size in php.ini, and long imports can also hit max_execution_time and memory_limit. Raise all four in php.ini (or the PHP-FPM pool config) and reload PHP:

upload_max_filesize = 256M
post_max_size = 256M
max_execution_time = 600
memory_limit = 512M

For dumps beyond a few hundred megabytes, skip the browser entirely and load the file with the mysql command-line client — it has no upload limit and is faster.

Alternatives

MySQL Workbench is the official desktop client from Oracle, covered in our MySQL Workbench guide; Adminer is a single-file PHP alternative with a smaller attack surface footprint on disk.

FAQ

Is phpMyAdmin free?

Yes. It is open source under the GPLv2 license, with no paid edition.

What is the default phpMyAdmin URL?

The server address plus /phpmyadmin on Debian and Ubuntu packages, /phpMyAdmin on EPEL installs. Manual installs use whatever directory the files were extracted into. Renaming this path is a standard hardening step.

What login does phpMyAdmin use?

MySQL or MariaDB database credentials. There is no separate phpMyAdmin account system in the default cookie authentication mode.

Does phpMyAdmin work with MariaDB?

Yes. It supports MySQL 5.5+ and MariaDB 5.5+, and most Linux distribution packages are built against MariaDB.