Connect Your IDE to a Live Joomla Database Over SSH

Do not open port 3306

Some hosting panels offer remote database access: you add your IP address to an allow list and connect to host:3306 directly. It works, and it puts your database credentials on the open internet, protected by an address that changes whenever your router reconnects.

An SSH tunnel avoids all of it. MySQL stays bound to localhost on the server, and the connection travels inside SSH — the same channel you already trust for shell access. Nothing new is exposed.

The tunnel by hand

Before touching the IDE, confirm the tunnel works:

ssh -L 3307:127.0.0.1:3306 user@example.com -N

That forwards local port 3307 to MySQL on the server. In another terminal:

mysql -h 127.0.0.1 -P 3307 -u dbuser -p dbname

If that connects, everything else is configuration. If it does not, the problem is on the server and no IDE setting will fix it.

Use 127.0.0.1 rather than localhost in the client — many MySQL clients read localhost as "use the unix socket" and ignore the port entirely, which produces a confusing failure at exactly this step.

In the IDE

Taking PhpStorm as the example, the same fields exist in DataGrip, DBeaver and TablePlus.

Open the database tool window, add a MySQL data source, and fill in the connection as the server sees it:

Host: 127.0.0.1
Port: 3306
Database, user, password: the values from Joomla's configuration.php

Then open the SSH/SSL tab, enable the tunnel and give it the server details: host, SSH port, your SSH user, and key-based authentication. Use a key, not a password — if your host still requires passwords for SSH, that is worth fixing on its own.

Test the connection. If the client reports a missing driver, the IDE offers to download it; that is a one-time step.

Guard rails on a production database

A live database one keystroke away from an editor is genuinely useful and genuinely dangerous. Three things worth doing before you start:

Connect read-only. Create a MySQL user with SELECT only and use it for the production connection. Anything that needs to write can use a second, deliberately chosen connection.
Colour the connection. Every serious client lets you tag a data source with a colour. Make production red. It is the cheapest protection against running a query in the wrong window.
Turn off auto-commit for that data source, so a mistyped UPDATE can still be rolled back.

What it is good for

Once connected, the everyday Joomla questions get fast: which extension owns a table, what a menu item's params actually contain, whether an article is unpublished or merely outside its publish window, how many rows a session table has grown to.

For schema work, keep using Joomla's own installation and update SQL. Editing the schema by hand leaves the database and the extension manifests disagreeing, and that surfaces much later as an update that fails for no visible reason.