Database Least-Privilege SOP

Database Least-Privilege SOP
The app DB user should never be able to drop your tables.

— Step 1: Audit current grants: SHOW GRANTS FOR 'wpuser'@'localhost';
— Step 2: Strip dangerous privileges the app never needs at runtime: DROP, GRANT OPTION, FILE.
— Step 3: Grant only SELECT, INSERT, UPDATE, DELETE on the one app schema.
— Step 4: Create a separate, higher-privileged migration user used only during deploys.
— Step 5: Bind MySQL to 127.0.0.1 — no remote DB exposure.
— Step 6: Rotate the DB password and update wp-config in the same maintenance window.
— Verify: the app user fails a test DROP TABLE with a permission error.

Run this every time.