Trusted WordPress tutorials, when you need them most.
Beginner’s Guide to WordPress
25 Million+
Websites using our plugins
Years of WordPress experience
WordPress tutorials
by experts

How to Change the WordPress Database Prefix to Improve Security

Editorial Note: We earn a commission from partner links on WPBeginner. Commissions do not affect our editors' opinions or evaluations. Learn more about Editorial Process.

Are you wondering how to change the WordPress database prefix for your website?

Changing the database prefix can protect your website’s data against SQL injections and other attacks from online hackers. It can be an important step towards improving WordPress security.

In this tutorial, we will show you how to change the WordPress database prefix to improve security.

How to change the WordPress database prefix

Why Should You Change the WordPress Database Prefix?

The WordPress Database is like a brain for your entire WordPress website because every single piece of information and files are stored there.

This makes the database a hacker’s favorite target. Spammers and hackers can run automated codes for SQL injections and get into your WordPress database.

Unfortunately, many people forget to change the database prefix while they install WordPress. This makes it easier for hackers to plan a mass attack by targeting the default prefix wp_.

The easiest way you can protect your WordPress database is by changing the database prefix, which is really simple to do on a site that you are setting up.

It takes a few extra steps to change the WordPress database prefix properly for your established site without completely messing it up. With that being said, we will show you how to change your WordPress database prefix and improve your WordPress security.

Video Tutorial

Subscribe to WPBeginner

If you don’t like the video or need more instructions, then just continue reading.

How to Change the WordPress Database Prefix

We recommend that you back up your WordPress database before you do anything suggested in this tutorial. It is also important to keep daily backups of your WordPress website using a plugin like Duplicator.

We also recommend that you redirect your visitors to a temporary maintenance page while you change the database prefix. Otherwise, you could cause a bad user experience for visitors to your website.

How to Change Table Prefix in wp-config.php

First, you will need to connect to your website using FTP or the File Manager app in your WordPress hosting account.

You then need to open your wp-config.php file, which is located in your WordPress root directory. Here, you can change the table prefix line from wp_ to something else like this wp_a123456_

So the line would look like this:

$table_prefix  = 'wp_a123456_';

Note: You can only change the table prefix using numbers, letters, and underscores.

Change All Database Table Names

Next, you need to connect to your database using the phpMyAdmin tool. If your host uses the cPanel dashboard, then you can easily find phpMyAdmin there.

Selecting phpMyAdmin on cPanel

There are a total of 11 default WordPress tables, so changing them manually would be a pain.

Instead, you should click on the ‘SQL’ tab at the top.

SQL query in phpMyAdmin

Then, you can enter the following SQL query:

RENAME table `wp_commentmeta` TO `wp_a123456_commentmeta`;
RENAME table `wp_comments` TO `wp_a123456_comments`;
RENAME table `wp_links` TO `wp_a123456_links`;
RENAME table `wp_options` TO `wp_a123456_options`;
RENAME table `wp_postmeta` TO `wp_a123456_postmeta`;
RENAME table `wp_posts` TO `wp_a123456_posts`;
RENAME table `wp_terms` TO `wp_a123456_terms`;
RENAME table `wp_termmeta` TO `wp_a123456_termmeta`;
RENAME table `wp_term_relationships` TO `wp_a123456_term_relationships`;
RENAME table `wp_term_taxonomy` TO `wp_a123456_term_taxonomy`;
RENAME table `wp_usermeta` TO `wp_a123456_usermeta`;
RENAME table `wp_users` TO `wp_a123456_users`;

Remember to change the database prefix to the one that you picked when editing the wp-config.php file.

You also may have to add lines for other plugins that add their own tables in the WordPress database. The idea is that you change all the table prefixes to the one that you want.

The Options Table

We then need to search the options table for any other fields that are using wp_ as a prefix so we can replace them.

To speed up the process, you can use this query:

SELECT * FROM `wp_a123456_options` WHERE `option_name` LIKE '%wp_%'

This will return a lot of results, and you need to go through them one by one to change these lines and their prefixes.

UserMeta Table

Next, we need to search usermeta for all fields that are using wp_ as a prefix, so we can replace it.

You can use this SQL query for that:

SELECT * FROM `wp_a123456_usermeta` WHERE `meta_key` LIKE '%wp_%'

The number of entries may vary depending on how many WordPress plugins you are using on your website. Just change everything that has wp_ to the new prefix.

You are now ready to test your site. If you followed the above steps, then everything should be working fine.

We recommend making a new backup of your database just to be on the safe side.

We hope this article helped you learn how to change the WordPress database prefix. You may also like to see our guide on how to optimize your WordPress database and our expert picks of the best WordPress database plugins.

Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us. Here's our editorial process.

Editorial Staff

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi with over 16 years of experience in WordPress, Web Hosting, eCommerce, SEO, and Marketing. Started in 2009, WPBeginner is now the largest free WordPress resource site in the industry and is often referred to as the Wikipedia for WordPress.

The Ultimate WordPress Toolkit

Get FREE access to our toolkit - a collection of WordPress related products and resources that every professional should have!

Reader Interactions

143 CommentsLeave a Reply

  1. Syed Balkhi says

    Hey WPBeginner readers,
    Did you know you can win exciting prizes by commenting on WPBeginner?
    Every month, our top blog commenters will win HUGE rewards, including premium WordPress plugin licenses and cash prizes.
    You can get more details about the contest from here.
    Start sharing your thoughts below to stand a chance to win!

  2. Jiří Vaněk says

    Thank you for the guide. Before I started getting into WordPress, I used the default installations where the user was, of course, ‘admin’ and the prefix was ‘wp_’. It was only later that I read it isn’t good from a security standpoint and that it’s much better to have a custom prefix. I was a bit afraid to start changing things on an already functioning website, and I also didn’t have enough knowledge for it. I tried changing the prefix on a small site according to this guide, and it really worked great. So, I’ll probably do the same for my other websites to ensure a bit better security. Great.

    • Mrteesurez says

      Thanks your encouragement and sharing your experience on how it worked for you. I have decided to changing it on new WordPress site, I still don’t have courage to change it on an established site. I too will follow this guide and try it on a small website to know if it will work.

  3. enel lee says

    You need to adjust the query to, ‘wp\_%’ – this escapes the underscore character which has a value of ‘one character’ in SQL otherwise, as many will find out following your advise, you will get anything with ‘wp’ in the name! You also don’t need the first ‘%’ char as we are looking for names that BEGIN WITH ‘wp’ meaning nothing in front of it. The inner occurrences in the options table is great advice though for those who may use the built in phpMyAdmin feature to change prefix; this only changes the main table names and doesn’t look within the table fields

    • WPBeginner Support says

      Thank you for your feedback, we will look into this code again, as this was for a search only and not a replace it was set up to have a broader search to be safe :)


  4. Moinuddin Waheed says

    This is an eye opener for wordpress security.
    I never felt the need to change the database prefix for its simplicity and never knew that leaving it as it is can be dangerous.
    I think most of the beginners leave database prefix as it is and never change it.
    I will definitely keep this in mind while installing every new wordpress website.

    • Mrteesurez says

      Yes most beginner bloggers including me, leave it without changing because we didn’t know the implications therein. It is best and easier to change during new WP installation while is challenging for an established blog.

    • Dayo Olobayo says

      You’re right Moinuddin. Many beginners (myself included) often overlook this step. The “default” nature of the prefix can lull one into a false sense of security. Changing it adds an extra hurdle for attackers using automated scripts. It’s a simple security measure that can make a big difference.

  5. mohadese esmaeeli says

    Hello. Changing the prefix of WordPress tables is very, very important because this prefix is the default, and most people don’t change it, making it susceptible to testing by any hacker. So, it makes sense to alter it, and I recommend this to all my friends. If we change the prefix during the WordPress installation, it’s much better. However, even after installation, it is possible to change the table prefix.

  6. Ka Khaliq says

    Hi there,
    I’m referring to this article to update my WordPress website database prefix.
    I have a confusion about updating the Options and Usermeta tables. Upon running the respective SQL queries, the results obtained, also contains some rows something like transient_wp_cloudflare OR dismissed_wp_pointers OR tlwp_feedback_data OR wpseo_social etc.
    So do I need to update such rows too where wp_ is present in the middle/end OR do I just need to update rows that has the wp_ prefix at the start like wp_page_for_privacy_policy etc.
    I understand that by prefix means, something at the start but still want to solve this confusion.

    • WPBeginner Support says

      No, you would want to leave those tables as they are as those are used by plugins and other tools that are looking for those specific titles.


  7. Barry Richardson says

    A plugin developer told me that you cannot have a WordPress blog without a database prefix. This is very confusing because I have had an active WordPress blog for 5 years – and it has no database prefix. So, can you have a WordPress site without a database prefix?

    • WPBeginner Support says

      WordPress has a database prefix by default without you needing to make any changes, this is a way to customize the prefix.


  8. Emily says

    Hi there, I was following another tutorial to look at the database files and noticed mine have names like “wphy_users” … is this possibly an extension of the thing described here, just without the _ before?

    Look forward to your reply!

    • WPBeginner Support says

      Correct, from the sound of it your database was created with a different prefix :)


  9. Izzy says

    Hi, I changed my table prefix names ia while a go. I found out there where some new maps added with the old name + the main folder (database I think) also has the old name. Now I also found out my folders already HAD a different name than the standard “wp” prefix name, so the change wasn’t even needed in the first place. The only thing now is that half of the tables has 1 certain name and the other ones have another name. Because everything works fine now I don’t want to change things again, but my only question now is: is it a problem that the tables have different names? Do they all need to be named the same, or does it not matter?

    • WPBeginner Support says

      The extra tables may have been created by a plugin, we would recommend your site using the same prefix for all of your content.


  10. Akhilesh says

    I am multi domain hosting. at the time of installation of WP what have to put in table prefix (as wp_ written by default.)??

    Please suggest me as early as possible…

    • WPBeginner Support says

      You would choose what you want the prefix to be if you’re changing your site’s database prefix


  11. Mainak Ghosh says

    After changing database prefix i am getting “Sorry, you are not allowed to access this page” this error when i visit WordPress admin dashboard.

  12. Kid Max says

    Hi, I’m using wordpess multisite. I want to use home site’s database prefix and folder for media attachment for all of subsite including home site. Any idea?

    • WPBeginner Support says

      You could upload your images to the home site’s media library and embed the images on your subsites to do something like that.


      • Kid Max says

        I know about that, but featured images not support for that, so I want to use home site’s media database prefix for all site.

        • WPBeginner Support says

          Sadly, at the moment we don’t have a recommended method for that.

  13. Mike says

    I tried it and then I couldn’t login. Probably because I have a security plugin.

    If I disable and delete all my plugins and just leave my installation with the core WP, and then I make the change, would that probably eliminate the need to change anything in usermeta or the options tables? i.e. Would that probably be the safest way to make the table change and not break anything.

    Then, I’ll just re-install my plugins.

  14. Mishel says

    According to this article, Changing the WordPress table prefix does absolutely nothing to enhance the site security.
    Even if we have changed the table prefix, a hacker can find the table prefix by running this code:
    FROM information_schema.TABLES WHERE
    `TABLE_NAME` LIKE ‘%postmeta’;

    • WPBeginner Support says

      Hi Mishel,

      We don’t agree with that. Every security step that obscures something can be uncovered by a experienced hacker. These steps just add a difficulty layer to make your overall security harder to crack. Changing table prefix certainly has no downside to it and if it can block some automated and obvious hacking attempts, then its totally worth it.


  15. Mehdi says

    The queries in both wp_options and wp_usermeta return datas that is contained wp should I rename them too?
    ex: wpseo_title, _yoast_wpseo_

  16. rado says

    I made really silly mistake, in my wp-config file i assign the variable $table-prefix without the underscore at the end. Something like “wp_12345”, it should be “wp_12345_”.

  17. Molly says

    this broke my files, none of my files are accessible on the local or live sites, thankfully this is all learning and a test site, but what went wrong?

  18. Josch says

    Works fine, thank you very much! Except: I get the following warning in the backend after changing prefix. Tried it two times:

    Warning: Cannot modify header information – headers already sent by (output started at /myurl/wp-config.php:1) in /myurl/wp-includes/option.php on line 837

    Warning: Cannot modify header information – headers already sent by (output started at /myurl/wp-config.php:1) in /myurl/wp-includes/option.php on line 838

    Can you help me?

  19. Mehdi says

    Hi, thank you for your article. I have a question about that. If you have some plugins which are installed in your wordpress, is this method that you mentioned above the same? or maybe we need to other things to complete this step?
    I appreciate if you guide me about that because I have more than 20 install plugin in my wordpress sit.
    Thank you for your help

  20. Asterix says

    Won’t I have issues when updating plugins etc in the future?

    I tried to use iThemes Security built in advanced features for this, but got the error: An “invalid format” error prevented the request from completing as expected. The format of data returned could not be recognized. This could be due to a plugin/theme conflict or a server configuration issue.

    So I am not sure if I dare to do this manually either…

  21. Joe says

    Hello Team

    thanks for sharing this.

    All steps went well except for the last one: UserMeta Table.

    MySql doesn’t let me change the prefix for it.

    That’s the error message I get:

    #1054 – Unknown column ‘wp_new_usermeta.umeta_id’ in ‘where clause’

    Please, any advise?

    Many thanks,


    • Vipul Parekh says

      There’s an option it asked to enter db prefix while installation. so you can give prefix whatever you wish to!!

  22. Tom B. says

    Is it necessary to still include the”wp_” as part of the new prefix I want to create? Can I just use any alpha numeric string to reduce the chance of any type of hack?



  23. Chad Mowery says

    Nice article. I think the query on the Options and UserMeta table will throw off less savvy individuals. Not sure how but it would help if you could provide more detail on those steps.

    I followed the guide and have successfully changed my DB table prefix!

  24. blade says

    This does not add really any kind of security.
    If I can inject SQL, I can query against information_schema.tables and get info about tables, whatever fancy prefix you put in front of names ;)

    • thomas says

      very true. a good htaaccess will block sql injections too. on top of that, my wordpress install only gives full database access to very select users by assigning those credentials based on certain things gathered long before a db connection. everybody else gets the very very basic access.

      i also stopped most hacking attempts cold by hiding the wpzlogin.php and further password protecting access to wp admin in cpanel. it takes a login just to get to the wp login page.

  25. shivi says

    Hi , Nice article ! Thought of simplifying replacing table prefix.

    In Phpmyadmin once u select the database, you can see the list of tables.
    1. Enable the checkbox check all

    2. select Replace table prefix in the dropdown ‘with selected’

    3. Enter the existing prefix in from option: ‘wp_’ as mentioned in the article.

    4. Enter the new prefix in to option: ‘wp_a123456_’ as mentioned in the article.

    5. Click submit

    This helps to change table prefix for all tables including that of the plugin.

    You can check these articles if you need support on dehack your site

    • john says

      So…. @SHIVI

      All I need to do, to change the table.prefix is go into my config.file change the prefix and then proceed to your steps 1-5 and the table.prefix will be changed everywhere (plugins etc..)
      And that’s it?

  26. Fahim says

    Should i run Sql for every table? i mean i have 15 table. or only change two tables you described will fix the problem.

  27. Alph says

    Hi guys,

    Thanks for these instructions. They helped me resolve my uppercase issues.

    As a beginner, some guidance as to the how to change the table names manually would have been appreciated. I would have felt more comfortable doing it that way.

    Also, for a beginner like me, some instruction on how to make the changes in the Options and Usermeta tables would been helpful.

    Thanks again. Could not have done it without you!

  28. Chris A says

    Thanks for the instruction. I needed to remove an UPPER case letter from a prefix and this showed that exact records I needed to touch!

    TIP: with phpMyAdmin you can check all records at the bottom and select ‘replace table prefix’ this will bring up a standard replace box with ‘from’ and ‘to’ values.
    It will also save a lot of typing in step one – especially if it’s a large database.

  29. Igor says

    Hi guys,

    when I made these changes it don’t give me to sign in as current user but it tells me to install wordpress again…


  30. Rick says

    My SQl DB have no table prefix so got error sometimes on wordpress Wpconfig.php without $table_prefix = ”;.
    how to add table prefix,
    when i try to add in config file and rename all table with same prefix
    and login in to wp got error “you don’t have permission to access”

Leave a Reply to Sayeed Cancel reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.