My database is open to the internet. How do I close it?

Also searched as: Publicly accessible database · MongoDB exposed

Updated 3 October 2026

Short answer

Close the network first. Turn off public access (on AWS RDS it's a single setting), and set the firewall so only your app's own servers can connect. Make sure the database requires a login with a strong, unique password. Then check its logs for connections you don't recognise, because an open database may already have been read or copied, and that may mean telling your customers.

What's the problem

Your database can be reached from anywhere on the internet, not just from your app. Maybe a scanner or a security email told you, or you've just realised the setting is on. Anyone who finds it can try to log in, and if there's no password or a weak one, they're in.

Why it happens

  • It was opened for convenience. Public access was switched on so a developer could connect from their laptop with a database tool, and never switched off.
  • The firewall allows everyone. The rule says "any address" (0.0.0.0/0) instead of only your app's servers.
  • The database listens everywhere. PostgreSQL listens only on the local machine by default, and MongoDB recommends allowing only trusted clients. Changing that to listen on every network interface is a common shortcut.
  • No login, or a default one. Some self-hosted databases were set up without access control, or with a password from a tutorial.

How to fix it

  1. Turn off public access. On AWS RDS, set Public access to "No". On other providers, look for public networking or a public IP setting.
  2. Lock the firewall. Allow connections only from your app's servers or private network. Remove any "allow all" rule.
  3. Require authentication with a strong, unique password, and an app user that has only the permissions the app needs.
  4. Developers connect privately, through a VPN, a bastion host or the provider's secure tunnel, not by opening the database to the internet.
  5. Rotate the database password if it was ever weak, shared, or in the code.
  6. Check the logs for logins and connections you don't recognise during the time it was open, and look for missing, changed or ransom-note data.
  7. If personal information may have been accessed, see do I have to report a data breach.

When to call Preventionlabs

Turn off public access today; it takes minutes. Call us when the app breaks once the database is private, because it was built to connect from wherever it happened to run, or when nobody knows what else is exposed. Data exposure is on the MVP-level protection checklist in every resurrection, checked from the outside the way an attacker would find it, then fixed.

Submit your project for a free assessment

Free assessment. $10,000 AUD flat to get it live, only if we take it on and you go ahead.

Sources

  1. Amazon Web Services: Working with a DB instance in a VPCcloud platform docsYou can use the Public access option to designate whether the DB instance also has a public IP address in addition to the private IP address.
  2. Amazon Web Services: Working with a DB instance in a VPCcloud platform docsAccess to the DB instance is ultimately controlled by the security group it uses.
  3. MongoDB: Security Checklist for Self-Managed Deploymentsdatabase docsAllow only trusted clients to access the network interfaces and ports on which MongoDB instances are available.
  4. MongoDB: Security Checklist for Self-Managed Deploymentsdatabase docsEnable access control and specify an authentication mechanism.
  5. PostgreSQL: Connections and Authentication: listen_addressesdatabase docsThe default value is localhost, which allows only local TCP/IP “loopback” connections to be made.

Related

Supabase RLS is disabled. Is my data public? A table in an exposed schema without Row Level Security is readable and writable through your public key, which is in your app. Turn RLS on for every table. Is my Firebase database open to anyone? If it was set up in test mode and never locked down, possibly. The API key being public is normal: the security rules are what protect the data. How to check. Do I have to report a data breach? (Australia) If the Privacy Act covers you and the breach is likely to cause serious harm, yes: tell the OAIC and those affected. Suspected breaches: assess within 30 days. Are my app's uploaded files public? (S3) New S3 buckets are private by default, but a policy can open them. Turn on Block Public Access, and serve private files through short-lived signed links.
← All of Is it safe?