May 24, 2018 by Paul G. | Ask Paulie Anything

Will Shield support renaming WordPress DB Prefix? [Ask Paulie Anything #8]

The main topic we’re going to discuss in this Episode 8 of Ask Paulie Anything, something you’ve probably heard of but you still don’t know much about, is “Renaming WordPress Database Prefix in the matter of security”.

I’m also going to answer the following questions:

  • What is the WordPress Database Prefix?
  • Is renaming the WordPress Database Prefix good security practice?
  • Will Shield support renaming the WordPress Database Prefix?
  • Does changing WordPress Database Prefix increase your security?
  • Does Shield modify core WordPress files? Is that a good practice?

[0:26] – What Is The WordPress Database Prefix?

What I’m referring to is, there is the setting within the WordPress config file referring to the prefix that the database tables should use when WordPress creates tables. There are a lot of reasons for having this, but basically, all WordPress tables in the WordPress Database are prefixed with this set of letters.

This helps separate those tables as belonging to a particular WordPress installation.

There has been a lot of talk, for a long time, about renaming the prefix from the default which is wp_ as a security measure.

[1:00] – Is Renaming The Prefix Good Security Practice?

There are still plugins, and many people who like to think that renaming the db prefix is good security practice. But, there’s nothing secure about renaming the WordPress prefix. Nothing.

Because, if someone’s already attacked your website and gained the access, a very simple SQL query will that tell them what your Prefix is.

Once they’re inside, they’ll know what the prefix is. So, there’s no point changing it.

The point is:

Changing your WordPress Database Prefix does nothing to secure your website whatsoever.

[1:31] – Will Shield Support Renaming The WordPress Database Prefix?

Shield will not be including renaming the WordPress database Prefix functionality because there’s absolutely no reason to do so.

But isn’t it a little bit like “security through obscurity”?

Yes, but that’s not really security.

“Security through obscurity” helps to slow things down and just makes things a little bit more frustrating for the attacker.

It doesn’t secure your website and should not be relied upon as a security mechanism.

Does changing WordPress Database Prefix increase your security?

No, it doesn’t.

In fact, it’ll likely cause you problems, especially if it’s done via a WordPress plugin because the plugin needs the WordPress to load.

If the WordPress plugin is, in a given page load,

  • attempting to rename the prefix
  • change your WordPress config file
  • rename on your tables

and it runs into any sort of trouble whatsoever, your website is likely going to be “toasted” (unless you know what you’re doing to revert it).

That gets me back to another point.

[2:23] – Does Shield Modify Core WordPress Files? Is That A Good Practice?

From the moment we’ve released Shield Security, our main principle was to never modify any core files, or any core WordPress hosting files. That includes the .htaccess and wp-config files.

Because, as I said, for WordPress plugins to change those, they require a valid WordPress load to work.

If there’re changes in the .htaccess or in the wp-config file that breaks your WordPress, the security plugin, can’t then revert those changes itself. It can’t fix any mistakes that are made, because WordPress itself can’t load.

Shield does not modify any WordPress core files and it certainly does not add or modify the php.ini files, which some security plugins do.

Generally, there are far too many WordPress plugins, especially security plugins, that leave their crap lying around your website when you uninstall and remove the plugin.

Shield doesn’t do any of that.

So, back to the point:

Be careful when you hear what people’re say is good security practice.

Just because 1 plugin does 1 thing, it doesn’t mean that:

a) it’s good security practice; and

b) that all other security plugins (including Shield) should have to do that to make it a good security plugin.

We choose our functionality very carefully.

Thank You! Comments, Questions?

If you have any questions about this topic, feel free to leave a comment somewhere below the video – wherever you’re watching it. 🙂

If you have your own question, feel free to use the link below.

Ask Your Own Question Here.

And, of course, you’re always welcome to “Like” or share this video on Facebook, or, if you want to know what next helpful videos we’re preparing for you, subscribe to our YouTube channel. 🙂

Hello dear reader!

If you want to level-up your WordPress security with ShieldPRO, click to get started today. (risk-free, with our no-quibble 14-day satisfaction promise!)

You'll get all PRO features, including AI Malware Scanning, WP Config File Protection, Plugin and Theme File Guard, import/export, exclusive customer support, and much, much more.

We'd be honoured to have you as a member, and look forward to serving you during your journey towards powerful, WordPress security.

Try ShieldPRO Today →

ShieldPRO Testimonials
@marklcm's Gravatar @marklcm

Does the job and is light on your server

I have tried several security plugins over time and have settled on this one for all sites I run or build. It does a good job and is very good on shared servers where memory and cpu usage can be important. It is not a resource hog.

@btreece84's Gravatar @btreece84

Follow Up on Previous Review

Great Job! I was very critical about the lack of clear notes in the change log in my first review. I’m happy to say that crystal clear, point by point updates have been logged fully for more than a month now. Could not be happier with a security plugin! Definitely…

@truffolo's Gravatar @truffolo

Great Product with Lots of Functionality

Nice complete set of security features for just about everything. Enable what you want or everything. Great for login protection and other common security risks. Support was responsive too.

@jmdumais's Gravatar @jmdumais

Does what is says

Works seamless and gives me massive peace of mind, especially after a bunch of bogus login attempts by who knows who. Just works.

Leave a Comment

Your email address will not be published. Required fields are marked *

Main Sections
Click to access the login or register cheese