Forcing phpMyAdmin to use SSL

phpMyAdmin SSL – The “how to” you always wanted – but were too shy to admit to.

You should always use SSL with phpMyAdmin. Never leave a phpMyAdmin install insecure. Nowadays, you should secure phpMyAdmin with more than just SSL; like keeping phpMyAdmin SSL on its own private network. But that’s a different story entirely…

2 1/2 ways to force SSL with phpMyAdmin

1) Using Apache .htaccess (this can also be put in the httpd.conf if you don’t use .htaccess files):

or with nginx:

Now if you’re behind a proxy of some sort (load balancer), it might not have $ssl_protocol set. You would then have to check the headers to see which one is being set and check based on that. There isn’t a hard-set rule that everyone follows and so, it could be implementation specific. Hire Barton if you need.

2) Using phpMyAdmin’s config.inc.php file:

(NOTE: $cfg[‘ForceSSL’] has been removed as of phpMyAdmin 4.6) via Ken Zalewski

I prefer to use #2 because I don’t have to mess with Apache at all.

phpMyAdmin SSL | HTTPS Certificate with phpMyAdmin

If you’re wondering what 1/2 way is to use phpMyAdmin with SSL, well, I count #1 a little bit more since it’s talking about doing it with .htaccess and/or Apache/Nginx conf.

  1. Jacob Reply

    Number 2 is the way to go. Changes are instant :) Thank you

  2. Ken Zalewski Reply

    The ForceSSL configuration directive has been removed from phpMyAdmin 4.6 (release pending). The proper way to handle SSL redirects is via the web server config.

    • The Barton Reply

      Thanks Ken. I’ve updated this blog post with your update. Although, I will miss that configuration.

  3. Matthew Browne Reply

    This was a helpful article to get started, but this didn’t work for me on Ubuntu 16 and Apache 2.4 for some reason…but this worked:

    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/phpmyadmin$1 [R,L]

  4. MR MARTIN BARKER Reply

    Is your NGINX version correct as it does not seem to support query which phpMyAdmin uses so if some one had an old bookmark it phpMyAdmin will loes track of where to load after login.

    • The Barton Reply

      I didn’t mention a version # for nginx. If this is still an issue, email support,
      so someone may help you out.

      As time goes by, things change, and we would prefer people not even use
      phpMyAdmin on live websites. Only use it locally, then Deploy, or use something
      in a secure environment, and tunnel to your live server; or use VPN to restrict.

      These days there are too many hackers trying to ruin your day.

      Please be safe.

Leave a comment

Find the Best SEO in Fort Lauderdale, Florida (Plantation SEO) | Drupal & Worpress Develpment