WordPress.org

1. Anonymous
   Unregistered
   Posted 3 years ago #

   Hello,

   I just upgraded to WordPress 2.6 and am also having trouble logging into my blog via Firefox. That aside...

   I found an internet white paper on how to secure your wordpress blog at: http://blogsecurity.net/wordpress/wordpress-security-whitepaper/

   It suggested that you change the table prefix from "WP_" to something like "asdf_".

   I went into my wp-config file and where it says:

   $table_prefix = 'wp_';

   I tried changing it to:

   $table_prefix = 'asdf_';

   I uploaded the wp-config file and then went to check out my blog. Instead of seeing the website, all I saw was a "welcome to wordpress installation" page.

   Do I have to go into mysql in my server and change something?

   thanks.

   p.s. will this help secure the blog or is it just a small thing?

2. Laogeodritt
   Member
   Posted 3 years ago #

   I think that the security benefits are minimal but existent. Somebody could sensibly still exploit an SQL Injection vulnerability, but were he able to execute MySQL queries freely, he wouldn't be able to select tables without knowing the prefix. I'm neither a security expert nor am I knowledgeable with common web cracking techniques, so I'm not entirely sure, though.

   As for changing the prefix:

   If you ONLY changed the table prefix, then WordPress tries to find tables called asdf_(something) in your database, but they're still all called wp_(something). You have to change the table's prefixes themselves too (in phpMyAdmin or similar).

   you can run RENAME TABLE (old_table) TO (new_table)
   in your case, for example, RENAME TABLE wp_comments TO asdf_comments

   And repeat for each of the ten tables in your WordPress database.

   But! If you try going into your Admin panel now, you'll get an error. This is because there's certain rows that need changing, because they contain the prefix too. (From http://www.eligeotravez.net/2007/04/17/changing-table-prefix-for-wordpress/ )

   Table (prefix)_options
   --> option_name = (old prefix)_user_roles
   Table (prefix)_usermeta
   --> meta_key = (old prefix)_capabilities
   --> meta_key = (old prefix)_user_level
   --> meta_key = (old prefix)_autosave_draft_ids

   The last one might not exist, depending on whether you autosaved a draft in WordPress or not. Anyway, what I did when I did this was use phpMyAdmin, select the table in question, go to the SQL tab, and run these commands:

   UPDATE (new prefix)_options SET option_name = '(new prefix)_user_roles' WHERE option_name = '(old prefix)_user_roles'

   UPDATE (new prefix)_usermeta SET ,eta_key = '(new prefix)_capabilities' WHERE meta_key = '(old prefix)_capabilities'

   And so on, where (new prefix) and (old prefix) are these prefixes, without the parentheses of course. This will update all of those values.

3. rxcknrxll
   Member
   Posted 2 years ago #

   I've learned that many mysql injection attacks are automated and assume the prefix wp_. Changing the prefix is beneficial for this type of attack. No system is crack proof of course but it's advisable to do what you can :)

Topic Closed

This topic has been closed to new replies.