Fix phpMyAdmin Configuration File Writable Warning

Quick Answer

Run chmod 644 /etc/phpmyadmin/config.inc.php on Linux or remove the "write" permission for the Users group on Windows. That kills the warning immediately.

Why You're Seeing This Warning

phpMyAdmin checks permissions on config.inc.php at startup. If the file's writable by anyone other than the owner (usually www-data on Debian/Ubuntu, or IUSR on IIS), it throws the warning: "Your configuration file is writable, please change its permissions."

The culprit here is almost always a fresh install or a copy of phpMyAdmin where the config file inherited relaxed permissions from the packaging script. Sometimes it's a manual edit where you chmod'd the file to 777 and forgot to lock it back down. This isn't a break-the-app error — phpMyAdmin still works. But it's a security risk. Anyone with local shell access could inject a malicious config directive, steal session keys, or redirect database traffic.

You'll see this most often on Ubuntu 22.04 and 24.04 LTS after apt install phpmyadmin, or on Windows Server 2022 when deploying via Web Platform Installer or manually copying files.

Fix Steps

Linux (Apache/Nginx)

1. Find the file. Location varies by distro. Common paths:

   /etc/phpmyadmin/config.inc.php
   /usr/share/phpmyadmin/config.inc.php
   /var/www/html/phpmyadmin/config.inc.php

2. Check current permissions. Run ls -la /path/to/config.inc.php. You'll see something like -rw-rw-rw- (world-writable) or -rwxrwxrwx (777).
3. Fix permissions. Run this command:

   sudo chmod 644 /etc/phpmyadmin/config.inc.php

   That sets owner read/write, group and others read-only. If you need stricter control (e.g., only www-data should read it), use chmod 640 and verify the group matches the web server's group.
4. Verify ownership. Run sudo chown www-data:www-data /etc/phpmyadmin/config.inc.php on Debian/Ubuntu. On RHEL/Fedora/CentOS, use apache:apache. This prevents other system users from reading it.
5. Reload phpMyAdmin. Hit F5 in the browser. The warning should be gone.

Windows (IIS)

1. Locate config.inc.php. Usually C:\inetpub\wwwroot\phpmyadmin\config.inc.php.
2. Right-click the file > Properties > Security tab.
3. Edit permissions for the Users group. Uncheck "Write" and "Modify". Leave "Read & execute" and "Read" checked.
4. Apply and OK. Refresh phpMyAdmin. Done.

Alternative Fixes (When the Main One Doesn't Work)

SELinux blocking the change. If you're on CentOS/RHEL/Fedora and the warning persists after chmod, SELinux might be overriding the permission check. Temporarily test with setenforce 0. If the warning disappears, you need to set the correct SELinux context:

sudo semanage fcontext -a -t httpd_sys_content_t "/etc/phpmyadmin(/.*)?"
sudo restorecon -Rv /etc/phpmyadmin

Config file included from another location. Check if your config.inc.php has an include() or require() statement pointing to another file. That included file might be writable. Fix permissions on both.

Docker container. If phpMyAdmin runs inside a container, the warning often comes from a bind-mounted config file that retains host permissions. Either set the file to 644 on the host, or copy the config inside the Dockerfile with COPY instead of VOLUME.

Prevention Tip

This won't happen again if you adopt a simple rule: never set chmod 777 on any config file in production. Ever. Use 644 for configs that need world-read access (like phpMyAdmin's), and 640 for sensitive ones like .env or database credentials. If you edit config files often, alias a command in your bashrc that opens the file and then locks it:

alias phpmyadmin-config='nano /etc/phpmyadmin/config.inc.php && sudo chmod 644 /etc/phpmyadmin/config.inc.php'

That way, the second you close the editor, permissions snap back to safe.