Your app works fine on cPanel itself, but the moment you try to connect to that same MySQL database from your laptop, a staging server, or a BI tool like Power BI or Tableau, you get slapped with "ERROR 1130: Host is not allowed to connect to this MySQL server." The database is right there, the credentials are correct, and yet nothing external can touch it. That's not a bug — cPanel's MySQL server refuses every remote connection by default, and getting it working means enabling one specific feature the right way.

Why cPanel Blocks Remote MySQL by Default

On shared and reseller hosting, MySQL is bound to listen on all interfaces, but every database user is scoped to a specific "host" — usually localhost. That's a deliberate security boundary: only scripts running on the same server (your PHP app, a cron job, terminal" class="auto-link">WP-CLI) can talk to the database. Anyone scanning the internet for open port 3306 hits a wall immediately.

You only need to change this when something outside that server needs a direct connection — a local dev environment pulling production data, an ETL job on another VPS, a desktop client like MySQL Workbench or DBeaver, or an analytics tool that connects straight to the database instead of going through your app's API.

Symptom: Access Denied From a Specific Host

The error you'll actually see depends on the client, but it's almost always one of these:

  • ERROR 1130 (HY000): Host '203.0.113.45' is not allowed to connect to this MySQL server
  • ERROR 2003 (HY000): Can't connect to MySQL server on 'yourdomain.com' (110) — this one usually means the connection never reached MySQL at all; a firewall dropped it before the "host not allowed" check even ran.
  • A generic "Access denied for user" from a GUI tool that's actually masking a host-mismatch error underneath.

The first error means MySQL saw your connection and rejected it based on the user's allowed host. The second means something in front of MySQL — CSF/LFD, a cloud firewall, or the hosting provider's network — is blocking port 3306 outright. You'll need to fix both layers, not just one.

Fix: Enable Remote MySQL in cPanel

cPanel has a dedicated tool for exactly this, and it's the only supported way to do it — don't try to edit MySQL's user table by hand through phpMyAdmin, since cPanel's own database syncing will often overwrite manual grants.

  1. Log into cPanel and open Remote MySQL under the Databases section.
  2. Under "Add Access Host," enter the IP address that needs to connect — your office's static IP, your dev machine's public IP, or the IP of the other server running the job.
  3. Add an optional comment ("Dev laptop – Mumbai office") so you remember why the entry exists six months from now.
  4. Click Add Host. cPanel updates the relevant database user(s) to accept connections from that address.

If you genuinely don't know the connecting IP in advance — a CI pipeline with rotating runners, for example — cPanel lets you enter % as a wildcard host. Resist that unless you have no other option; a wildcard host means any IP on the internet that has the username and password can attempt a login, turning your database into a target for brute-force scanners the moment they find port 3306 open.

Step Two: Open the Firewall

Adding the access host in cPanel only updates MySQL's own grant tables. If the server also runs CSF (ConfigServer Security & Firewall) or a cloud-provider firewall, port 3306 is very likely still closed to the outside world by default — and it should be, for anyone who isn't you.

In WHM, under CSF's Firewall Configuration, add the same IP to the allow list, or open port 3306 scoped to specific source IPs only (never open it to 0.0.0.0/0):

csf -a 203.0.113.45
csf -r

If you're on a VPS without CSF, check ufw status or your provider's cloud firewall/security group rules. The port needs to be reachable and the MySQL user needs to allow that host — both, not either.

Testing the Connection

From the machine you just whitelisted, confirm both layers are working:

mysql -h yourdomain.com -u cpuser_dbuser -p -P 3306

If that hangs and eventually times out, it's a firewall problem — the packet never arrived. If it connects instantly and then throws "Host not allowed," the firewall is fine but the cPanel Remote MySQL entry either wasn't saved, targets the wrong IP, or hasn't finished propagating (give it a minute; cPanel's database sync isn't always instant on busy servers).

One easy mistake: whitelisting your home or office IP, then connecting from a laptop on mobile data or a different Wi-Fi network later. Remote MySQL access is IP-based, not device-based — if your IP changes, the connection breaks again with the exact same error, and it'll look like the setting "stopped working" when nothing actually changed on the server.

Prevention: Lock It Down Properly

Remote database access is convenient and genuinely risky if left loose. A few habits keep it from becoming the thing that gets you hacked:

  • Never use % in production. List specific IPs. If your office or home IP isn't static, ask your ISP for one or route through a VPN with a fixed exit IP.
  • Use a read-only database user for reporting tools. A BI dashboard doesn't need INSERT or DROP privileges — create a separate user in cPanel's MySQL Databases tool and grant only SELECT.
  • Prefer an SSH tunnel over opening 3306 at all. If you only need occasional access from your own machine, tunnel through SSH instead of exposing the database port publicly: 
    ssh -L 3307:localhost:3306 user@yourdomain.com
    Then connect your local client to 127.0.0.1:3307. Nothing needs to change in CSF, and there's no MySQL port sitting open on the internet.
  • Audit the access host list periodically. Remove entries for IPs, contractors, or old office locations you no longer use. A stale allow-list entry from a departed contractor is exactly the kind of thing that gets forgotten for years.
  • Set strong, unique passwords per database user — especially once that user can be reached from outside the server, credential-stuffing becomes a real risk instead of a theoretical one.

Frequently Asked Questions

Can I enable Remote MySQL on shared hosting, or only on a VPS?

Both. The Remote MySQL tool is standard in cPanel regardless of the plan. On shared hosting you won't have CSF access yourself, so if the connection still fails after adding the host, ask your hosting provider to confirm port 3306 is open to your IP at the network level.

Why does it work from my office but not my home connection?

Remote MySQL access is granted per IP address, not per user account globally. Your office and home connections have different public IPs, so each one needs its own entry under Remote MySQL in cPanel (and in CSF, if it's active).

Is it safe to just use the wildcard host (%) temporarily for testing?

It's safer to add your specific current IP for the ten minutes you need it, then remove it, than to open a wildcard entry and forget to close it later. Automated scanners find open MySQL ports within hours, not weeks.

My connection times out instead of giving an access-denied error — what does that mean?

A timeout means the packet never reached MySQL at all — a firewall (CSF, a cloud security group, or your own network) is dropping it silently. An "access denied" or "host not allowed" error means the packet arrived and MySQL rejected it, which is a cPanel/grant-table issue, not a firewall one.

Do I need to restart MySQL after adding a Remote MySQL entry in cPanel?

No. cPanel updates the user's allowed host in MySQL's grant tables directly and it takes effect immediately in almost all cases. If a connection still fails after a couple of minutes, double-check the IP you entered matches your actual public IP — not your local network IP, which MySQL never sees.