Read the exact failure
Connection refused generally means the client could not establish the expected network connection at the selected address and port. Access denied means the server responded but rejected a connection attempt or access. Record the exact error, client host, destination, time and transport without sharing passwords.
Compare the application's configured hostname and port with the intended database. On some systems a local connection using localhost can select a Unix socket while 127.0.0.1 selects TCP. That difference can lead to different permissions and error messages.
Follow the path
For a refused connection, check that the intended MySQL service is running, listening on the expected interface and reachable through the approved network path. Review firewall and bind configuration. A timeout differs from an immediate refusal and may indicate another network boundary.
For access denied, inspect the account name, source-host match, authentication method, TLS requirement and grants using an appropriately authorized administrator. MySQL accounts can be scoped by user and host; a working local login does not prove that a remote application's identity is authorized.
Fix narrowly and verify
Do not expose the database publicly, grant broad privileges or disable TLS simply to make a connection succeed. Correct the observed address, account or network rule with the least access needed, then test from the application's actual environment.
Confirm the application performs its intended database operation and that an unauthorized connection remains blocked. Document the connection path and credential owner so future changes can be checked against a known baseline.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.