The same rules hold in the New site dialog, in the site's Database tab, in cgctl and in the API. The panel checks them as you type; the server checks them again.

Names

A database name and a database user name follow one rule:

Rule	Value
Shape	^[a-z][a-z0-9_]{2,47}$
Length	3 to 48 characters
Characters	lowercase letters a–z, digits, _
First character	a letter

These names are reserved and refused:

Kind	Names
Names	mysql, sys, performance_schema, information_schema, root, debian_sys_maint, mariadb_sys, mysql_sys, mariadb, mysqld, admin, test, phpmyadmin, cloudground, replication, repl, monitor, backup
Prefixes	cg followed by a letter and _ (for example cgq_: the panel's own accounts and scratch databases), mysql_, sys_, mariadb_, test_
The panel's default shape	site_<n>: only site number <n> has it, and only when the panel picks it (below)

A name is unique on the server:

• a database name that any site already has is refused (the New site dialog says <name> is already used on this server);
• a user name that any site already has is refused the same way;
• databases and users are two separate lists, so a user may have the same name as a database (the primary user often does);
• a database or a user made outside the panel is never taken over: its name is refused.

The names the panel picks

Where	Database name	User name
New site dialog	proposed from the domain: its labels without the last one, joined by _ (blog.example.com → blog_example); you can change it	the same as the database, until you change it
cgctl and the API, without a name	site_<id>	site_<id>

<id> is the site's number. A proposed name that would be reserved gets site_ in front (test.example → site_test).

Passwords

Rule	Value
Length	12 to 256 characters
Refused characters	', ", \, and control characters
Spaces	none at the start or at the end
Left empty	the panel generates one: 32 URL-safe characters

The New site dialog fills the field with a generated password of 24 URL-safe characters, which you can keep or replace.

Why the three characters: wp-cli writes the primary user's password into wp-config.php and does not quote ', " and \ correctly. A password with one of them would make WordPress use a different password, or break wp-config.php. The spaces at either end, because a copied password easily loses them.

A password is shown only when the panel generated it, and only once: in the new site's summary, or right after you create a user or reset its password. The panel never shows it again; you set a new one from the Database tab.

Privileges

In the panel	Granted on the database
None	nothing
Read only	SELECT, SHOW VIEW
All privileges	ALL PRIVILEGES

Every user is <name>@localhost: it signs in from this server only, with at most 50 connections at a time.

Next step

Manage databases from the site's Database tab.