[SECURITY] Hardening wp-config.php and Changing Default Database Prefixes

[JackaL]

[SECURITY] Hardening wp-config.php and Changing Default Database Prefixes

Out of the box, WordPress is highly vulnerable to automated SQL injection attacks. If your database prefix is still the default wp_, you are a sitting duck for automated bots.

---

Step 1: Disable File Editing
If a hacker gains access to an admin account, they will inject PHP shells via the Theme Editor. Block this at the core level by adding this to your wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Step 2: Change Database Prefix
Do not use wp_. Before installing WordPress, change the variable in wp-config.php to a randomized string:

$table_prefix = 'crz_749x_';

If your site is already live, you must use a plugin like Solid Security (formerly iThemes) to safely rename the tables in your MySQL database without breaking the site.