DVWA Troubleshooting Guide

MySQL: "Access Denied for User 'root'@'localhost'"

On Kali and most modern Debian-based systems, the root MySQL/MariaDB user authenticates through your Linux login (the unix_socket plugin), not a database password. Running mysql -u root -p and entering a password — even a blank one, fails with this exact error. Use sudo instead:

sudo mysql -u root

That drops you straight into the MariaDB prompt with no password needed.

Want password-based root login instead? Once you're in via sudo mysql -u root, you can switch root to a real password:

ALTER USER 'root'@'localhost' IDENTIFIED BY 'your_new_password';
FLUSH PRIVILEGES;
EXIT;

After that, mysql -u root -p will work too. This isn't required for DVWA, sudo mysql -u root is enough, but it's handy if other tools expect a root password.

"Can't Create Database 'dvwa'; Database Exists"

This happens if you've run through the install before, even partially. It's safe to just continue on to the CREATE USER and GRANT commands using the existing database. If you'd rather start completely clean, drop it first:

DROP DATABASE dvwa;
CREATE DATABASE dvwa;

Going forward, using CREATE DATABASE IF NOT EXISTS dvwa; (as the current install guide does) avoids this error entirely on re-runs.

DVWA Shows a 404 Not Found Error

A 404 usually means Apache isn't serving files from the DVWA folder yet. Confirm you cloned DVWA directly into /var/www/html so the URL matches http://localhost/DVWA exactly, folder names are case-sensitive on Linux, so dvwa and DVWA are different paths. Then confirm Apache is actually running:

sudo systemctl status apache2

If it's inactive, start it:

sudo systemctl start apache2

"Unable to Connect to the Database" Error

This happens when the database name, username, or password in DVWA/config/config.inc.php don't match what you actually created in MySQL. Open the config file:

sudo nano /var/www/html/DVWA/config/config.inc.php

And confirm these values exactly match the database, user, and password you created earlier:

$_DVWA['db_server'] = '127.0.0.1';
$_DVWA['db_database'] = 'dvwa';
$_DVWA['db_user'] = 'dvwa';
$_DVWA['db_password'] = 'password';

If you're not sure the MySQL user exists, log back into MySQL (mysql -u root -p) and re-run the CREATE USER and GRANT ALL PRIVILEGES commands from the install guide.

php.ini: "No Such File or Directory"

Guides (including this one) often show a specific path like /etc/php/8.2/apache2/php.ini, but that version number goes stale as OSes ship newer PHP releases, Kali, for example, has moved to PHP 8.4. Find your actual path instead of copying the example literally:

php --ini | grep "Loaded Configuration"

Open whatever path that prints.

apt: "Unable to Locate Package php-openssl"

On Debian and Kali, OpenSSL support ships compiled directly into PHP core rather than as a separate extension package, so php-openssl doesn't exist and apt install will always fail to find it. Check php -m, if openssl is already listed, there's nothing to install. Just install whichever of the others are actually missing:

sudo apt install php-mysqli php-gd php-curl

DVWA Shows a Blank White Page

A blank page almost always means PHP hit a fatal error but isn't displaying it. Enable error output in php.ini:

sudo nano /etc/php/8.2/apache2/php.ini

Set (or confirm) this line, then save and restart Apache:

display_errors = On

sudo systemctl restart apache2

Reload the page, the real error should now appear. You can also check the log directly:

sudo tail -f /var/log/apache2/error.log

Missing PHP Module Errors

DVWA needs mysqli, gd, curl, and openssl. Check which are installed:

php -m

Install anything missing, then restart Apache:

sudo apt install php-mysqli php-gd php-curl php-openssl
sudo systemctl restart apache2

Permission Denied Errors

Re-apply ownership and permissions so Apache can read and write DVWA's files, especially the upload and config directories:

sudo chown -R www-data:www-data /var/www/html/DVWA
sudo chmod -R 755 /var/www/html/DVWA
sudo chmod -R 777 /var/www/html/DVWA/hackable/uploads
sudo chmod -R 777 /var/www/html/DVWA/config

Login Page Rejects admin / password

DVWA's default login is username admin and password password, but the account only exists after the database tables have been created. Visit http://localhost/DVWA/setup.php and click "Create / Reset Database", then try logging in again.

Installing DVWA Without Docker

The main install guide sets up DVWA natively using Apache, MySQL, and PHP, no Docker or containers required. DVWA does also ship an official Dockerfile if you'd rather containerize it, but every step in the installation guide works on a plain Ubuntu or Kali install.

Still Not Working? Full Troubleshooting Checklist

If DVWA still isn't loading correctly after trying the fixes above, work through this list in order:

• MySQL "access denied" for root: use sudo mysql -u root instead of mysql -u root -p
• "php.ini: no such file or directory": run php --ini to find your actual PHP version path
• Blank white page: enable PHP error display and check sudo tail -f /var/log/apache2/error.log
• "Unable to connect to the database": re-check config.inc.php matches your MySQL username and password
• PHP module errors: install missing modules and restart Apache
• Permission denied errors: re-apply the ownership commands above
• Login page rejects admin/password: make sure you clicked "Create / Reset Database" first
• Still stuck? re-check every step in the installation guide in order, most issues trace back to one skipped or mistyped command