WPBeginner

Beginner's Guide for WordPress

  • Blog
    • Beginners Guide
    • News
    • Opinion
    • Showcase
    • Themes
    • Tutorials
    • WordPress Plugins
  • Start Here
    • How to Start a Blog
    • Create a Website
    • Start an Online Store
    • Best Website Builder
    • Email Marketing
    • WordPress Hosting
    • Business Name Ideas
  • Deals
    • Bluehost Coupon
    • SiteGround Coupon
    • WP Engine Coupon
    • HostGator Coupon
    • Domain.com Coupon
    • Constant Contact
    • View All Deals »
  • Glossary
  • Videos
  • Products
X
☰
Beginner's Guide for WordPress / Start your WordPress Blog in minutes
Choosing the Best
WordPress Hosting
How to Easily
Install WordPress
Recommended
WordPress Plugins
View all Guides

WPBeginner» Blog» Tutorials» How to Change the WordPress Database Prefix to Improve Security

How to Change the WordPress Database Prefix to Improve Security

Last updated on May 11th, 2016 by Editorial Staff
139 Shares
Share
Tweet
Share
Pin
Free WordPress Video Tutorials on YouTube by WPBeginner
How to Change the WordPress Database Prefix to Improve Security

WordPress Database is like a brain for your entire WordPress site because every single information is stored in there thus making it hacker’s favorite target. Spammers and hackers run automated codes for SQL injections. Well, unfortunately many people forget to change the database prefix while they install WordPress. This makes it easier for hackers to plan a mass attack by targeting the default prefix wp_. The smartest way you can protect your database is by changing the database prefix which is really easy to do on a site that you are setting up. But it takes a few steps to change the WordPress database prefix properly for your established site without completely messing it up.

Video Tutorial

Subscribe to WPBeginner

If you don’t like the video or need more instructions, then continue reading.

Preparation

We recommend that you backup your WordPress Database before you perform anything suggested in this tutorial. It is important to keep daily backups of your site, we recommend BackupBuddy plugin for doing that. Next thing we recommend is that you redirect your visitors to a temporary maintenance page.

Change Table Prefix in wp-config.php

Open your wp-config.php file which is located in your WordPress root directory. Change the table prefix line from wp_ to something else like this wp_a123456_

So the line would look like this:

$table_prefix  = 'wp_a123456_';

Note: You can only change it to numbers, letters, and underscores.

Change all Database Tables Name

You need to access your database (most likely through phpMyAdmin), and then change the table names to the one we specified in wp-config.php file. If you are using the cPanel WordPress hosting, then you can find the phpMyAdmin link in your cPanel. Look at the image below:

phpMyAdmin

There are a total of 11 default WordPress tables, so changing them manually would be pain.

SQL Query

That’s why to make things faster, we have a SQL query that you can use.

RENAME table `wp_commentmeta` TO `wp_a123456_commentmeta`;
RENAME table `wp_comments` TO `wp_a123456_comments`;
RENAME table `wp_links` TO `wp_a123456_links`;
RENAME table `wp_options` TO `wp_a123456_options`;
RENAME table `wp_postmeta` TO `wp_a123456_postmeta`;
RENAME table `wp_posts` TO `wp_a123456_posts`;
RENAME table `wp_terms` TO `wp_a123456_terms`;
RENAME table `wp_termmeta` TO `wp_a123456_termmeta`;
RENAME table `wp_term_relationships` TO `wp_a123456_term_relationships`;
RENAME table `wp_term_taxonomy` TO `wp_a123456_term_taxonomy`;
RENAME table `wp_usermeta` TO `wp_a123456_usermeta`;
RENAME table `wp_users` TO `wp_a123456_users`;

You may have to add lines for other plugins that may add their own tables in the WordPress database. The idea is that you change all tables prefix to the one that you want.

The Options Table

We need to search the options table for any other fields that is using wp_ as a prefix, so we can replace them. To ease up the process, use this query:

SELECT * FROM `wp_a123456_options` WHERE `option_name` LIKE '%wp_%'

This will return a lot of results, and you need to go one by one to change these lines.

UserMeta Table

Next, we need to search the usermeta for all fields that is using wp_ as a prefix, so we can replace it. Use this SQL query for that:

SELECT * FROM `wp_a123456_usermeta` WHERE `meta_key` LIKE '%wp_%'

Number of entries may vary on how many plugins you are using and such. Just change everything that has wp_ to the new prefix.

Backup and Done

You are now ready to test the site. If you followed the above steps, then everything should be working fine. Now, you should make a new backup of your database just to be on the safe side.

139 Shares
Share
Tweet
Share
Pin
Popular on WPBeginner Right Now!
  • Google Analytics in WordPress

    How to Install Google Analytics in WordPress for Beginners

  • How to Properly Move Your Blog from WordPress.com to WordPress.org

  • Checklist

    Checklist: 15 Things You MUST DO Before Changing WordPress Themes

  • How to Fix the Error Establishing a Database Connection in WordPress

    How to Fix the Error Establishing a Database Connection in WordPress

About the Editorial Staff

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi. Trusted by over 1.3 million readers worldwide.

The Ultimate WordPress Toolkit

132 Comments

Leave a Reply
  1. Eka says:
    Sep 23, 2020 at 12:17 pm

    you save my time, thanks alot bro.
    i do test password and the problem has been detect :D
    thanks !

    Reply
    • WPBeginner Support says:
      Sep 24, 2020 at 11:16 am

      Glad our guide was helpful :)

      Reply
  2. Barry Richardson says:
    Sep 18, 2020 at 12:45 pm

    A plugin developer told me that you cannot have a WordPress blog without a database prefix. This is very confusing because I have had an active WordPress blog for 5 years – and it has no database prefix. So, can you have a WordPress site without a database prefix?

    Reply
    • WPBeginner Support says:
      Sep 21, 2020 at 10:58 am

      WordPress has a database prefix by default without you needing to make any changes, this is a way to customize the prefix.

      Reply
  3. Emily says:
    Mar 2, 2020 at 1:47 pm

    Hi there, I was following another tutorial to look at the database files and noticed mine have names like “wphy_users” … is this possibly an extension of the thing described here, just without the _ before?

    Look forward to your reply!

    Reply
    • WPBeginner Support says:
      Mar 3, 2020 at 10:14 am

      Correct, from the sound of it your database was created with a different prefix :)

      Reply
  4. Izzy says:
    Sep 25, 2019 at 1:30 pm

    Hi, I changed my table prefix names ia while a go. I found out there where some new maps added with the old name + the main folder (database I think) also has the old name. Now I also found out my folders already HAD a different name than the standard “wp” prefix name, so the change wasn’t even needed in the first place. The only thing now is that half of the tables has 1 certain name and the other ones have another name. Because everything works fine now I don’t want to change things again, but my only question now is: is it a problem that the tables have different names? Do they all need to be named the same, or does it not matter?

    Reply
    • WPBeginner Support says:
      Sep 26, 2019 at 10:33 am

      The extra tables may have been created by a plugin, we would recommend your site using the same prefix for all of your content.

      Reply
  5. Akhilesh says:
    Apr 2, 2019 at 12:44 am

    I am multi domain hosting. at the time of installation of WP what have to put in table prefix (as wp_ written by default.)??

    Please suggest me as early as possible…

    Reply
    • WPBeginner Support says:
      Apr 2, 2019 at 11:14 am

      You would choose what you want the prefix to be if you’re changing your site’s database prefix

      Reply
  6. Mainak Ghosh says:
    Feb 10, 2019 at 1:29 pm

    After changing database prefix i am getting “Sorry, you are not allowed to access this page” this error when i visit WordPress admin dashboard.

    Reply
    • WPBeginner Support says:
      Feb 11, 2019 at 4:16 pm

      You may want to ensure you updated all of the links in your tables and you may want to check your wp-config file for another location. To see if it is more than one error you could enable wp debug: https://www.wpbeginner.com/wp-tutorials/how-to-set-up-wordpress-error-logs-in-wp-config/

      Reply
  7. Kid Max says:
    Feb 6, 2019 at 1:16 am

    Hi, I’m using wordpess multisite. I want to use home site’s database prefix and folder for media attachment for all of subsite including home site. Any idea?

    Reply
    • WPBeginner Support says:
      Feb 6, 2019 at 10:35 am

      You could upload your images to the home site’s media library and embed the images on your subsites to do something like that.

      Reply
      • Kid Max says:
        Feb 6, 2019 at 11:59 pm

        I know about that, but featured images not support for that, so I want to use home site’s media database prefix for all site.

        Reply
        • WPBeginner Support says:
          Feb 7, 2019 at 11:10 am

          Sadly, at the moment we don’t have a recommended method for that.

  8. Mike says:
    Jan 18, 2019 at 3:30 pm

    I tried it and then I couldn’t login. Probably because I have a security plugin.

    If I disable and delete all my plugins and just leave my installation with the core WP, and then I make the change, would that probably eliminate the need to change anything in usermeta or the options tables? i.e. Would that probably be the safest way to make the table change and not break anything.

    Then, I’ll just re-install my plugins.

    Reply
  9. Mishel says:
    Oct 23, 2018 at 1:34 pm

    According to this article, Changing the WordPress table prefix does absolutely nothing to enhance the site security.
    Even if we have changed the table prefix, a hacker can find the table prefix by running this code:
    SELECT DISTINCT SUBSTRING(`TABLE_NAME` FROM 1 FOR ( LENGTH(`TABLE_NAME`)-8 ) )
    2
    FROM information_schema.TABLES WHERE
    3
    `TABLE_NAME` LIKE ‘%postmeta’;

    Reply
    • WPBeginner Support says:
      Oct 30, 2018 at 2:22 pm

      Hi Mishel,

      We don’t agree with that. Every security step that obscures something can be uncovered by a experienced hacker. These steps just add a difficulty layer to make your overall security harder to crack. Changing table prefix certainly has no downside to it and if it can block some automated and obvious hacking attempts, then its totally worth it.

      Reply
      • Sayeed says:
        Nov 29, 2018 at 5:39 am

        Yes I agree.

        Reply
  10. Daniel says:
    Oct 15, 2018 at 11:47 am

    Just what I was looking for. Thanks.

    Reply
  11. Mehdi says:
    Jun 22, 2018 at 10:44 am

    The queries in both wp_options and wp_usermeta return datas that is contained wp should I rename them too?
    ex: wpseo_title, _yoast_wpseo_

    Reply
  12. rado says:
    Oct 21, 2017 at 9:42 am

    I made really silly mistake, in my wp-config file i assign the variable $table-prefix without the underscore at the end. Something like “wp_12345”, it should be “wp_12345_”.

    Reply
  13. Molly says:
    Aug 29, 2017 at 11:34 am

    this broke my files, none of my files are accessible on the local or live sites, thankfully this is all learning and a test site, but what went wrong?

    Reply
  14. Josch says:
    Jun 22, 2017 at 2:28 am

    Works fine, thank you very much! Except: I get the following warning in the backend after changing prefix. Tried it two times:

    Warning: Cannot modify header information – headers already sent by (output started at /myurl/wp-config.php:1) in /myurl/wp-includes/option.php on line 837

    Warning: Cannot modify header information – headers already sent by (output started at /myurl/wp-config.php:1) in /myurl/wp-includes/option.php on line 838

    Can you help me?

    Reply
    • WPBeginner Support says:
      Jun 22, 2017 at 6:01 pm

      Hi Josch,

      This error can be caused by an empty space or an extra line at the end of wp-config.php file. Deleting it can solve the issue.

      Reply
  15. Mehdi says:
    May 27, 2017 at 12:44 am

    Hi, thank you for your article. I have a question about that. If you have some plugins which are installed in your wordpress, is this method that you mentioned above the same? or maybe we need to other things to complete this step?
    I appreciate if you guide me about that because I have more than 20 install plugin in my wordpress sit.
    Thank you for your help

    Reply
  16. Asterix says:
    Mar 27, 2017 at 10:53 pm

    Won’t I have issues when updating plugins etc in the future?

    I tried to use iThemes Security built in advanced features for this, but got the error: An “invalid format” error prevented the request from completing as expected. The format of data returned could not be recognized. This could be due to a plugin/theme conflict or a server configuration issue.

    So I am not sure if I dare to do this manually either…

    Reply
  17. Joe says:
    Mar 2, 2017 at 8:16 am

    Hello Team

    thanks for sharing this.

    All steps went well except for the last one: UserMeta Table.

    MySql doesn’t let me change the prefix for it.

    That’s the error message I get:

    #1054 – Unknown column ‘wp_new_usermeta.umeta_id’ in ‘where clause’

    Please, any advise?

    Many thanks,

    Joe

    Reply
  18. Shivam Pandey says:
    Feb 1, 2017 at 10:40 am

    How to change the database prefix while installing WordPress.

    Reply
    • Vipul Parekh says:
      Mar 2, 2017 at 5:13 am

      There’s an option it asked to enter db prefix while installation. so you can give prefix whatever you wish to!!

      Reply
  19. Tom B. says:
    Nov 4, 2016 at 12:59 pm

    Is it necessary to still include the”wp_” as part of the new prefix I want to create? Can I just use any alpha numeric string to reduce the chance of any type of hack?

    Thanks,

    Tom

    Reply
    • WPBeginner Support says:
      Nov 5, 2016 at 12:08 am

      Yes, you can use alpha-numeric string.

      Reply
  20. Chad Mowery says:
    Sep 22, 2016 at 6:31 am

    Nice article. I think the query on the Options and UserMeta table will throw off less savvy individuals. Not sure how but it would help if you could provide more detail on those steps.

    I followed the guide and have successfully changed my DB table prefix!

    Reply
  21. blade says:
    Aug 30, 2016 at 10:07 am

    This does not add really any kind of security.
    If I can inject SQL, I can query against information_schema.tables and get info about tables, whatever fancy prefix you put in front of names ;)

    Reply
    • thomas says:
      Sep 13, 2016 at 8:52 am

      very true. a good htaaccess will block sql injections too. on top of that, my wordpress install only gives full database access to very select users by assigning those credentials based on certain things gathered long before a db connection. everybody else gets the very very basic access.

      i also stopped most hacking attempts cold by hiding the wpzlogin.php and further password protecting access to wp admin in cpanel. it takes a login just to get to the wp login page.

      Reply
  22. John says:
    Aug 26, 2016 at 11:19 am

    @Shivi

    This is all you need to do to change table.prefix ? even when live?

    Reply
  23. shivi says:
    Aug 24, 2016 at 2:59 am

    Hi , Nice article ! Thought of simplifying replacing table prefix.

    In Phpmyadmin once u select the database, you can see the list of tables.
    1. Enable the checkbox check all

    2. select Replace table prefix in the dropdown ‘with selected’

    3. Enter the existing prefix in from option: ‘wp_’ as mentioned in the article.

    4. Enter the new prefix in to option: ‘wp_a123456_’ as mentioned in the article.

    5. Click submit

    This helps to change table prefix for all tables including that of the plugin.

    You can check these articles if you need support on dehack your site

    Reply
    • john says:
      Aug 26, 2016 at 1:32 pm

      So…. @SHIVI

      All I need to do, to change the table.prefix is go into my config.file change the prefix and then proceed to your steps 1-5 and the table.prefix will be changed everywhere (plugins etc..)
      And that’s it?

      Reply
    • Dana Nourie says:
      Feb 5, 2017 at 4:18 pm

      Sweet! This was great.

      Reply
    • Matt Boden says:
      May 2, 2017 at 10:41 pm

      You’ll still need to manually update the prefix on the options and usermeta tables.

      Reply
  24. Fahim says:
    Jul 21, 2016 at 10:10 am

    Should i run Sql for every table? i mean i have 15 table. or only change two tables you described will fix the problem.

    Reply
    • WPBeginner Support says:
      Jul 21, 2016 at 11:48 pm

      All tables. You would want to change table prefix from all your existing WordPress tables.

      Reply
  25. Alph says:
    Jul 17, 2016 at 12:21 pm

    Hi guys,

    Thanks for these instructions. They helped me resolve my uppercase issues.

    As a beginner, some guidance as to the how to change the table names manually would have been appreciated. I would have felt more comfortable doing it that way.

    Also, for a beginner like me, some instruction on how to make the changes in the Options and Usermeta tables would been helpful.

    Thanks again. Could not have done it without you!

    Reply
  26. Chris A says:
    Jun 22, 2016 at 10:15 am

    Thanks for the instruction. I needed to remove an UPPER case letter from a prefix and this showed that exact records I needed to touch!

    TIP: with phpMyAdmin you can check all records at the bottom and select ‘replace table prefix’ this will bring up a standard replace box with ‘from’ and ‘to’ values.
    It will also save a lot of typing in step one – especially if it’s a large database.

    Reply
  27. Prabhakar says:
    Jun 15, 2016 at 7:56 pm

    You made it !

    Thanks

    Reply
  28. Igor says:
    Jun 10, 2016 at 3:50 am

    Hi guys,

    when I made these changes it don’t give me to sign in as current user but it tells me to install wordpress again…

    Igor

    Reply
    • WPBeginner Support says:
      Jun 10, 2016 at 7:44 pm

      This usually happens when the database you connected to is empty. Please recheck your database name.

      Reply
  29. Alan P says:
    May 3, 2016 at 8:02 pm

    wp_termmeta is missing from the list of tables to rename.

    Reply
    • WPBeginner Support says:
      May 11, 2016 at 11:23 pm

      Thank you for notifying us. We have updated the article.

      Reply
  30. Rick says:
    Apr 29, 2016 at 5:04 am

    My SQl DB have no table prefix so got error sometimes on wordpress Wpconfig.php without $table_prefix = ”;.
    how to add table prefix,
    when i try to add in config file and rename all table with same prefix
    and login in to wp got error “you don’t have permission to access”

    Reply
  31. Sameer Panda says:
    Mar 30, 2016 at 5:44 am

    Worked as a charm, thanks for sharing. :)

    Reply
« 1 2

Leave a Reply Cancel reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.

Over 1,320,000+ Readers

Get fresh content from WPBeginner

Featured WordPress Plugin
Smash Balloon
Smash Balloon
Add Custom Social Media Feeds in WordPress. Learn More »
How to Start a Blog How to Start a Blog
I need help with ...
Starting a
Blog
WordPress
Performance
WordPress
Security
WordPress
SEO
WordPress
Errors
Building an
Online Store
Useful WordPress Guides
    • 7 Best WordPress Backup Plugins Compared (Pros and Cons)
    • How to Fix the Error Establishing a Database Connection in WordPress
    • Why You Need a CDN for your WordPress Blog? [Infographic]
    • 30 Legit Ways to Make Money Online Blogging with WordPress
    • Self Hosted WordPress.org vs. Free WordPress.com [Infograph]
    • Free Recording: WordPress Workshop for Beginners
    • 24 Must Have WordPress Plugins for Business Websites
    • How to Properly Move Your Blog from WordPress.com to WordPress.org
    • 5 Best Contact Form Plugins for WordPress Compared
    • Which is the Best WordPress Popup Plugin? (Comparison)
    • Best WooCommerce Hosting in 2021 (Comparison)
    • How to Fix the Internal Server Error in WordPress
    • How to Install WordPress - Complete WordPress Installation Tutorial
    • Why You Should Start Building an Email List Right Away
    • How to Properly Move WordPress to a New Domain Without Losing SEO
    • How to Choose the Best WordPress Hosting for Your Website
    • How to Choose the Best Blogging Platform (Comparison)
    • WordPress Tutorials - 200+ Step by Step WordPress Tutorials
    • 5 Best WordPress Ecommerce Plugins Compared
    • 5 Best WordPress Membership Plugins (Compared)
    • 7 Best Email Marketing Services for Small Business (2021)
    • How to Choose the Best Domain Registrar (Compared)
    • The Truth About Shared WordPress Web Hosting
    • When Do You Really Need Managed WordPress Hosting?
    • 5 Best Drag and Drop WordPress Page Builders Compared
    • How to Switch from Blogger to WordPress without Losing Google Rankings
    • How to Properly Switch From Wix to WordPress (Step by Step)
    • How to Properly Move from Weebly to WordPress (Step by Step)
    • Do You Really Need a VPS? Best WordPress VPS Hosting Compared
    • How to Properly Move from Squarespace to WordPress
    • How to Register a Domain Name (+ tip to get it for FREE)
    • HostGator Review - An Honest Look at Speed & Uptime (2021)
    • SiteGround Reviews from 4464 Users & Our Experts (2021)
    • Bluehost Review from Real Users + Performance Stats (2021)
    • How Much Does It Really Cost to Build a WordPress Website?
    • How to Create an Email Newsletter the RIGHT WAY (Step by Step)
    • Free Business Name Generator (A.I Powered)
    • How to Create a Free Business Email Address in 5 Minutes (Step by Step)
    • How to Install Google Analytics in WordPress for Beginners
    • How to Move WordPress to a New Host or Server With No Downtime
    • Why is WordPress Free? What are the Costs? What is the Catch?
    • How to Make a Website in 2021 – Step by Step Guide
Deals & Coupons (view all)
SeedProd Logo
SeedProd Coupon
Get 50% OFF SeedProd Coming Soon Page plugin for WordPress.
HostGator
HostGator Coupon
Get 62% OFF HostGator, one of the most reliable and popular web hosting companies! Includes FREE domain.
Featured In
About WPBeginner®

WPBeginner is a free WordPress resource site for Beginners. WPBeginner was founded in July 2009 by Syed Balkhi. The main goal of this site is to provide quality tips, tricks, hacks, and other WordPress resources that allows WordPress beginners to improve their site(s).

Join our team: We are Hiring!

Site Links
  • About Us
  • Contact Us
  • FTC Disclosure
  • Privacy Policy
  • Terms of Service
  • Free Blog Setup
  • Free Business Tools
  • Growth Fund
Our Sites
  • OptinMonster
  • MonsterInsights
  • WPForms
  • SeedProd
  • Nameboy
  • RafflePress
  • Smash Balloon
  • AIOSEO

Copyright © 2009 - 2021 WPBeginner LLC. All Rights Reserved. WPBeginner® is a registered trademark.

Managed by Awesome Motive | WordPress hosting by SiteGround | WordPress Security by Sucuri.