diff --git a/index.php b/index.php
index dfd98fb79c..4a7bff9c32 100644
--- a/index.php
+++ b/index.php
@@ -552,6 +552,20 @@ if ($GLOBALS['cfg']['LoginCookieStore'] != 0
     );
 }
 
+/**
+ * Warning if using the default MySQL controluser account
+ */
+if ($server != 0
+    && isset($GLOBALS['cfg']['Server']['controluser']) && $GLOBALS['cfg']['Server']['controluser'] == 'pma'
+    && isset($GLOBALS['cfg']['Server']['controlpass']) && $GLOBALS['cfg']['Server']['controlpass'] == 'pmapass'
+) {
+    trigger_error(
+        __('Your MySQL server is running with default controluser and password, and is open to intrusion, you really should fix this security hole by changing the password for controluser \'pma\'.'),
+        E_USER_WARNING
+    );
+}
+
+
 /**
  * Check if user does not have defined blowfish secret and it is being used.
  */