diff --git a/doc/setup.rst b/doc/setup.rst
index 1442a74e62..48d54c204a 100644
--- a/doc/setup.rst
+++ b/doc/setup.rst
@@ -885,7 +885,8 @@ are always ways to make your installation more secure:
   can do this using ``robots.txt`` file in root of your webserver or limit
   access by web server configuration, see :ref:`faq1_42`.
 * In case you don't want all MySQL users to be able to access
-  phpMyAdmin, you can use :config:option:`$cfg['Servers'][$i]['AllowDeny']['rules']` to limit them.
+  phpMyAdmin, you can use :config:option:`$cfg['Servers'][$i]['AllowDeny']['rules']` to limit them
+  or :config:option:`$cfg['Servers'][$i]['AllowRoot']` to deny root user access.
 * Consider hiding phpMyAdmin behind an authentication proxy, so that
   users need to authenticate prior to providing MySQL credentials
   to phpMyAdmin. You can achieve this by configuring your web server to request