Does Changing the Table Prefix in a WordPress Database Really Help? An Analysis Based on Actual Attack Logs

Is Changing a Database Table Prefix Really Effective? Let’s Examine This Using Actual Attack Logs.

What Is a Database Table Prefix?

In WordPress, you can set a naming convention for database tables called a “prefix.”
In the `wp-config.php` file,

the setting is defined as follows:

$table_prefix = 'wp_';

With this setting, all table names will begin with “wp_,” as shown below:

wp_commentmeta
wp_comments
wp_links
wp_options
wp_postmeta
wp_posts
wp_terms
wp_termmeta
wp_term_relationships
wp_term_taxonomy
wp_usermeta
wp_users

You can change this table prefix when you first install WordPress or using a plugin.
It’s often said that changing the table prefix improves security, but I’ll explain why this is the case and whether it really makes a difference.

Why does changing the table prefix improve security?

The reason changing the table prefix improves security is that it prevents hackers from identifying the exact table names during SQL injection attacks—attacks where hackers exploit vulnerabilities to retrieve or modify database contents. (This is why SQL injection attacks will fail on the first attempt, even if a vulnerability exists.)

For example, an SQL injection attack targeting a table name like the one below will fail:

*If the prefix is changed and the actual table name is wpc_users, the SQL injection attack below will fail:

SELECT * FROM wp_users WHERE username = '' OR '1'='1'

Investigate how many similar attacks exist among 250,000 hacker attacks

Based on recent hacker attack patterns collected by our company, we will investigate how many attacks specifically target table names.　
For the data search, we checked whether the tables frequently targeted in attacks—wp_users and wp_options—were included in the attacks.

Data from 256,620 hacker attack samples over the past two weeks
Number of cases where “wp_users” was included in GET or POST data: 91

Example attack queries (partially redacted as they could be used in actual attacks)

{"action":"******","*****":",(SELECT EXTRACTVALUE(1,CONCAT(0x7e,(SELECT GROUP_CONCAT(CONCAT(user_login,0x3a,user_pass) SEPARATOR '|') FROM wp_users LIMIT 5))))"}

Number of entries containing `wp_options` in GET or POST data: 42 entries\nExample attack query (partially redacted as it could be used in actual attacks)

{"action":"******","id":"1\\' UNION SELECT option_name,option_value,autoload FROM wp_options WHERE option_name LIKE \\'%key%\\'-- -"}

Total: 133 entries, 0.05%

Conclusion
Although the number of instances found is very low at 0.05%, attacks that target specific table names are actually taking place.

WordPress vulnerability attacks come in waves

Although injection attacks using hard-coded table names are extremely rare, when a major vulnerability is discovered, hackers may all resort to similar attack methods.
If this vulnerability allows for SQL injection attacks, the probability mentioned above could rise sharply.

For this reason, WP Doctor believes that changing the WordPress table prefix does indeed have security value (moderate).

Please be sure to use the security plugin we’ve developed.
[Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal]