MySQL Error 1130

Error number

1130

SQLSTATE

HY000

Symbol

ER_HOST_NOT_PRIVILEGED

Product

MySQL Server

Versions

MySQL 5.7, 8.0 and 8.4

Category

Access & Privileges

Last reviewed

24 October 2026

What it means

Error 1130 means the server has no account at all whose host part matches the address the client connects from, so it refused the connection before asking for a user name or password.

Every MySQL account has a host part, such as 'app'@'localhost' or 'app'@'10.0.0.%'. When a client connects, the server first checks whether any account allows connections from the client's host. If none does, it returns 1130 straight away and, as the Performance Schema documentation puts it, does not even ask for a user name or password. That makes 1130 different from 1045, where some account matches the host but the user name or password does not authenticate.

The good news hidden in 1130 is that the network works: the client reached the server, the port is open and the server is listening (otherwise you would get 2003). The host in the message is the address, or resolved name, that the server sees, which can differ from the client's own idea of its address when there is NAT, a proxy, a container network or a VPN in between. Use exactly that value when deciding which account host to allow.

Common causes

• The accounts exist only for local connections, such as the default 'root'@'localhost', and a client connects from another machine.
• The account was created for one address or subnet and the client now comes from another (a new application server, a changed IP, a container or cloud network with different addresses).
• NAT, a proxy or a VPN means the server sees a different source address than the client expects.
• The account host is a host name, but the server cannot resolve the client to that name, or runs with skip_name_resolve ON, in which case only IP addresses and localhost can match.

Diagnose it

Read-only These statements only read metadata (information_schema, performance_schema and SHOW statements) or your own data. They do not change data, privileges or configuration, so they are safe to run first.

SELECT user, host
FROM mysql.user
WHERE user = 'app'
ORDER BY host;

SELECT DISTINCT host
FROM mysql.user
ORDER BY host;

SELECT ip, host, host_validated, count_host_acl_errors, first_error_seen, last_error_seen
FROM performance_schema.host_cache
WHERE count_host_acl_errors > 0
ORDER BY last_error_seen DESC;

SHOW VARIABLES LIKE 'skip_name_resolve';
SHOW VARIABLES LIKE 'bind_address';

SELECT error_number, error_name, sum_error_raised, first_seen, last_seen
FROM performance_schema.events_errors_summary_global_by_error
WHERE error_number = 1130;

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

CREATE USER 'app'@'10.0.0.%' IDENTIFIED BY 'a-long-random-password';
GRANT SELECT, INSERT, UPDATE, DELETE ON shop.* TO 'app'@'10.0.0.%';

RENAME USER 'app'@'10.0.0.15' TO 'app'@'10.0.1.%';

Examples

Connecting as root from another machine

Shown as documented in the MySQL reference manual (Troubleshooting Problems Connecting to MySQL); not reproduced here, because it needs a connection from a second host, or account changes, and the lab may not create accounts.

-- On the server, root exists only for local connections:
SELECT user, host FROM mysql.user WHERE user = 'root';  -- root | localhost

-- From another machine (203.0.113.25):
-- mysql -h db.example.com -u root -p

ERROR 1130 (HY000): Host '203.0.113.25' is not allowed to connect to this MySQL server

An application server whose address is not covered by the account

Shown as documented in the MySQL reference manual (no user table row with a Host value that matches the client host); not reproduced here, because it needs a second client host and the lab may not create accounts. The PDO form follows the connection error format we observed for 1045 and 2002.

-- The account allows one subnet only:
SELECT user, host FROM mysql.user WHERE user = 'app';  -- app | 192.168.1.%

-- The application now runs in a container network and connects from 172.17.0.5:
-- new PDO('mysql:host=db.example.com;dbname=shop', 'app', $password);

SQLSTATE[HY000] [1130] Host '172.17.0.5' is not allowed to connect to this MySQL server

How to prevent it

Plan the host part with the network: decide which subnets the application servers use, create the accounts for those patterns at deployment time, and update them as part of any network or hosting change. Prefer IP or subnet patterns, which do not depend on DNS, and keep administrative accounts limited to localhost or a management subnet.

Watch for refused hosts: count_host_acl_errors in performance_schema.host_cache and error 1130 in events_errors_summary_global_by_error show new client addresses (or scanning) before users report them.

Common questions

Learn more on CodeWithSQL

• SQL security
• SQL commands: DDL, DML, DCL, TCL and DQL

Official documentation

• Access control, stage 1: connection verification
• Specifying account names
• Troubleshooting problems connecting to MySQL
• The host_cache table

Last technically reviewed 24 October 2026; examples and diagnostics run on MySQL 8.0.46. Message templates checked against the server's error catalogue (perror) for that version.