Set up a remote MySQL server for cPanel with WHM profiles

When a shared server's load average is pinned and top shows mysqld at the top, the fix is usually not a bigger box — it's moving the database off the web node entirely. WHM has shipped Manage MySQL Profiles for years, and it lets a cPanel server point its entire MySQL layer at a separate host without touching a single user's connection string. This covers the setup, the privileges it needs, how to migrate existing data, and the one tradeoff that bites CloudLinux shops.

This is for admins running one or more busy cPanel servers who want to split the web tier from the database tier. It is not a replication or high-availability guide — a profile points cPanel at exactly one remote MySQL server, and only one profile is active at a time.

When offloading MySQL is worth it

Moving MySQL to its own host buys you three things: CPU and RAM contention disappears from the web node, you can size the database server for IOPS instead of PHP workers, and you can scale the two tiers independently. It costs you network latency on every query (keep the two hosts in the same datacentre, ideally the same rack or VPC) and one more machine to patch.

The break-even is roughly when MySQL is consuming more than a third of a web node's RAM or when disk I/O wait is your bottleneck. Below that, tuning PHP-FPM pools and MySQL Governor modes usually recovers more headroom for less operational overhead.

Profiles vs Additional MySQL Access Hosts

These two WHM interfaces get conflated constantly. They do opposite things:

• Manage MySQL Profiles — points your cPanel server at a remote MySQL server. cPanel, WHM, phpMyAdmin, and every hosted site now read and write to the remote host. This is what you want for offloading.
• Additional MySQL Access Hosts — lets external app servers connect into your local MySQL. This is the interface a user needs when their app runs on a different box but the database stays on cPanel. It does not move anything.

If your goal is "get MySQL off this server", you want profiles. Read on.

Prerequisites

• A dedicated MySQL or MariaDB server reachable from the cPanel host. Supported versions: MySQL 5.7 / 8.0 or MariaDB 10.3 / 10.5 / 10.6 / 10.11. Match the local and remote major versions where you can — running local 5.7 against a remote 8.0 opens known privilege-escalation edge cases with wildcard % grant hosts.
• Port 3306 open from the cPanel server's IP to the database server. Lock it to that single source IP in the firewall — never expose 3306 to the world.
• A superuser on the remote MySQL server. The profile setup needs an account with at least 15 privileges — SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, INDEX, GRANT OPTION, CREATE USER, RELOAD, LOCK TABLES, CREATE TEMPORARY TABLES, SHOW DATABASES, and REFERENCES — all ON *.* with grant option.
• Do not set skip-name-resolve in the remote server's config. cPanel's grant management relies on hostname resolution for its access-host entries.

Migrate the existing databases first

On the cPanel server, dump everything including the mysql grant tables so user permissions survive the move:

mysqldump --all-databases --single-transaction --routines --triggers --events > /root/full-mysql-dump.sql

Copy it to the remote host and import:

scp /root/full-mysql-dump.sql root@db01.example.com:/root/
ssh root@db01.example.com "mysql < /root/full-mysql-dump.sql"

For large datasets, --single-transaction gives you a consistent InnoDB snapshot without locking writes for the whole dump. Verify row counts on a couple of the biggest tables before you cut over.

Create the profile in WHM

Go to WHM » Home » SQL Services » Manage MySQL Profiles and click Add Profile. The name is permanent, so pick something like db01-remote.

You have two setup paths:

Automatic (SSH)

WHM connects to the remote host over SSH as root, reads /root/.my.cnf, and creates the management superuser itself. This is the least error-prone option for a server you fully control. Provide the remote hostname, SSH port, and root credentials or key.

Manual

Enter an existing MySQL superuser's hostname, port, username, and password directly. Use this path for Amazon RDS and any managed database where you have no SSH access to the underlying host — RDS has no root shell, so automatic setup can't work.

Validate, then activate

Before activating, click the validate icon next to the new profile. WHM runs a connectivity and privilege check and tells you exactly which grant is missing if the superuser is under-privileged. Fix the grants on the remote server and re-validate until it passes clean.

Only then click Activate. cPanel rewrites its configuration to route through the remote host. Confirm with:

whmapi1 current_mysql_version
mysql -e "SELECT @@hostname;"

The hostname returned should be the remote database server. Load a couple of hosted sites and confirm they read and write correctly.

The CloudLinux Governor tradeoff

This is the gotcha nobody mentions until it's live. CloudLinux MySQL Governor throttles and accounts MySQL usage per cPanel user — and it only works against a local MySQL instance. Move the database to a remote host and Governor has nothing to watch. You lose per-tenant query throttling, the dbtop per-user view, and the ability to freeze a single abusive account's queries.

On a shared server that is the whole reason many hosts run CloudLinux, so weigh it carefully. The usual pattern: keep MySQL local on dense shared boxes where Governor earns its keep, and use remote profiles for reseller or semi-dedicated tiers where per-user throttling matters less than raw database throughput. If you rely on Governor, read MySQL Governor modes before committing to a remote layout.

Both scenarios need a valid CloudLinux license on the web node regardless of where MySQL lives — Governor is licensed with the OS, not the database. If you're standing up a fresh cPanel box for this, our cPanel license provisions in minutes.

FAQ

Next steps

• Upgrade MariaDB or MySQL on cPanel/WHM — match versions across your web and database tiers before cutover.
• MySQL Governor modes explained — understand exactly what you give up by going remote.
• Read LVE Manager statistics to find the offender — diagnose whether MySQL is really your bottleneck before you split tiers.