<p>Short answer, no. You'll want to make sure that your DB user has all of the necessary privileges.</p>

<p>Just because you're not entering <em>your</em> data into the database doesn't mean that Craft isn't writing <em>its own</em> data into the database. There are several tables responsible for handling data which is automatically generated by Craft, and not managed directly by admins.</p>

<p>For example:</p>

<ul>
<li><strong>craft_sessions</strong> records user sessions, to know who is currently logged in.</li>
<li><strong>craft_assettransformindex</strong> saves any <a href="http://buildwithcraft.com/docs/image-transforms" rel="nofollow">image transforms</a> which have already been triggered.</li>
<li><strong>craft_templatecaches</strong>, <strong>craft_templatecachecriteria</strong>, and <strong>craft_templatecacheelements</strong> store data from templates which use the <a href="http://buildwithcraft.com/docs/templating/cache" rel="nofollow"><code>{% cache %}</code> tag</a>.</li>
</ul>

<p>And there are probably others that I'm missing.</p>

<p>Bottom line... Craft needs to be able to write to the database just as much as you do.</p>

CC BY-SA 3.0
2014-10-31T09:39:27.127Z
Thanks Lindsey, I'm not surprised that INSERT, UPDATE, and possibly DELETE(?) privileges are required. still wondering whether CREATE, ALTER, and DROP are needed? And, given that, how much of a difference it might make, from a security perspective?
Brett Gullan
CC BY-SA 3.0
2014-10-31T16:02:51.997Z
Well, I'm guessing that CREATE, ALTER, and DROP are really only necessary if/when you run an update to Craft, or an update to any of your plugins. Either of those actions could trigger **migrations**, which need full capabilities to add, edit, or remove existing tables or columns. (It's possible that I'm overlooking something, but I'm 90% confident saying this.)
Lindsey D
CC BY-SA 3.0
2014-10-31T06:15:59.247Z
2014-10-31T06:15:59.247Z
Lindsey D
<p>I'm wondering if it's possible to reduce the database user privileges required by Craft, to run just the front-end of the site.</p>

<p>Currently, the requirements docs indicate that the MySQL user must have CREATE, ALTER, DROP privileges, etc. This makes sense when using the CP to update content, etc. (or if the site needs to accept user input form submission, member login, etc.)</p>

<p>However, I'd like to disable the CP on the site front-end and create a multi-environment config using a DB connection with a much less privileged MySQL user.</p>

<p>Does Craft require more than basic database 'read' permissions to simply serve up content?</p>

<p>Any reason I couldn't create two subdomains, one for serving content and one for managing content via the CP and provide different DB users (with separate privileges)?</p>

<p>Thanks!</p>

<database><multi-environment><security><multi-domain>
Minimum database privileges for Craft front-end?
# Minimum database privileges for Craft front-end?

(Asked by: username_0 on 2014-10-31)

I'm wondering if it's possible to reduce the database user privileges required by Craft, to run just the front-end of the site.

Currently, the requirements docs indicate that the MySQL user must have CREATE, ALTER, DROP privileges, etc. This makes sense when using the CP to update content, etc. (or if the site needs to accept user input form submission, member login, etc.)

However, I'd like to disable the CP on the site front-end and create a multi-environment config using a DB connection with a much less privileged MySQL user.

Does Craft require more than basic database 'read' permissions to simply serve up content?

Any reason I couldn't create two subdomains, one for serving content and one for managing content via the CP and provide different DB users (with separate privileges)?

Thanks!

**Tags:** database, multi-environment, security, multi-domain


---

## 1 answers

### Answer by username_1 on 2014-10-31. Score: 4

Short answer, no. You'll want to make sure that your DB user has all of the necessary privileges.

Just because you're not entering *your* data into the database doesn't mean that Craft isn't writing *its own* data into the database. There are several tables responsible for handling data which is automatically generated by Craft, and not managed directly by admins.

For example:

* **craft\_sessions** records user sessions, to know who is currently logged in.
* **craft\_assettransformindex** saves any [image transforms](http://buildwithcraft.com/docs/image-transforms) which have already been triggered.
* **craft\_templatecaches**, **craft\_templatecachecriteria**, and **craft\_templatecacheelements** store data from templates which use the [`{% cache %}` tag](http://buildwithcraft.com/docs/templating/cache).

And there are probably others that I'm missing.

Bottom line... Craft needs to be able to write to the database just as much as you do.

> **Comments:**
> **username_0**: Thanks Lindsey, I'm not surprised that INSERT, UPDATE, and possibly DELETE(?) privileges are required. still wondering whether CREATE, ALTER, and DROP are needed? And, given that, how much of a difference it might make, from a security perspective?  
> **username_1**: Well, I'm guessing that CREATE, ALTER, and DROP are really only necessary if/when you run an update to Craft, or an update to any of your plugins. Either of those actions could trigger **migrations**, which need full capabilities to add, edit, or remove existing tables or columns. (It's possible that I'm overlooking something, but I'm 90% confident saying this.)  

---

