diff --git a/doc/setup.rst b/doc/setup.rst
index 8943b6ab95..0f39d8cae0 100644
--- a/doc/setup.rst
+++ b/doc/setup.rst
@@ -414,3 +414,21 @@ information. If you want to purchase a Swekey please visit
 since this link provides funding for phpMyAdmin.
 
 .. seealso:: :config:option:`$cfg['Servers'][$i]['auth_swekey_config']`
+
+
+Securing your phpMyAdmin installation
++++++++++++++++++++++++++++++++++++++
+
+The phpMyAdmin team tries hardly to make the application secure, however there
+are always ways to make your installation more secure:
+
+* remove ``setup`` directory from phpMyAdmin, you will probably not 
+  use it after initial setup
+* prevent access to ``libraries`` directory from browser, 
+  as it is not needed, supplied ``.htaccess`` file does this
+* properly choose authentication method - :ref:`cookie`
+  is probably the best choice for shared hosting
+* in case you don't want all MySQL users to be able to access 
+  phpMyAdmin, you can use :config:option:`$cfg['Servers'][$i]['AllowDeny']['rules']` to limit them
+* consider hiding phpMyAdmin behind authentication proxy, so that 
+  MySQL credenticals are not all users need to login