By default, Plesk creates database users with full Read and Write access. If you need a user with limited permissions — for example, read-only access for a reporting tool or write-only for a data import script — you can customise their privileges.

## Creating a new database user

1. Log in to your **Plesk control panel**.
2. Go to **Websites & Domains** > **Databases**.
3. Click the **User Management** tab.
4. Click **Add New Database User**.
5. Enter a **username** and a strong **password**.
6. Select the **database** this user should have access to (or choose **Any** for a universal user).
7. Under **Role**, choose one of the predefined options:
   - **Read and Write** — full access (default)
   - **Read Only** — can view data but not change it
   - **Write Only** — can insert/update/delete but not read
8. Click **OK** to create the user.

## Setting custom privileges

If the predefined roles don't fit your needs, you can create a custom set of privileges:

1. Go to **Databases** > **User Management**.
2. Click on an existing user's name (or create a new one first).
3. Under **Role**, you'll see the current role and checkboxes for individual privileges.
4. Select or clear specific privileges as needed:
   - **Select** — read data from tables
   - **Insert** — add new rows
   - **Update** — modify existing data
   - **Delete** — remove rows
   - **Create** — create new tables
   - **Drop** — delete tables
   - **Alter** — change table structure
   - **Index** — manage indexes
   - **Create Temporary Tables** — create temp tables
   - **Lock Tables** — lock tables during operations
   - **Create View / Show View** — manage database views
5. Once you change any privilege, the role automatically switches to **Custom**.
6. Click **OK** to save.

## Common use cases

- **Reporting/analytics tool:** grant only **Select** and **Show View**.
- **Data import script:** grant **Select**, **Insert**, **Create**, and **Create Temporary Tables**.
- **Application user:** grant **Select**, **Insert**, **Update**, **Delete** — but not **Drop** or **Alter** for safety.

## Important notes

- Passwords must be at least 5 characters and cannot contain the username.
- Each user account can only access the specific database it's assigned to, unless created as a universal user.
- Custom privilege changes only apply to MySQL/MariaDB databases.
- Your hosting provider may restrict certain privileges. If a privilege checkbox is missing, it's been disabled at the server level.

## Troubleshooting

- **User can't connect?** Double-check the password and make sure the correct database is selected.
- **Application errors after restricting privileges?** The app likely needs more permissions than you've granted. Check the app's documentation for required database privileges.
- **Can't see the privilege checkboxes?** This feature is only available for MySQL/MariaDB. SQL Server users can only use the predefined roles.