If there is one thing a hacker likes, it’s default settings.
Two of the settings in WordPress that originally were unchangeable were the default user – admin, and the database table prefix – wp_.
Nowadays both these can be changed at the time of installation but many people fail to do so and they remain at the default.
Changing them on an established site is not too difficult. Once you have a tool like phpMyAdmin then it is pretty straightforward.
Changing the default username is the simplest job of all – simply open the ‘wp_user’ table and change the user_login to something other ‘than admin’. The password and permissions will remain the same. From experience, hackers trying a brute force attack will always use admin because a) that’s the default and b) because trying to crack a username as well as a password is exponentially more difficult.
Changing the database table names is a little more time consuming.
First of all, the site needs to be taken off line, as any changes (such as comments) made during the fix will more than likely be lost. I use the Ultimate Maintenance Mode plugin for this.
Next you need to check the maximum upload filesize allowed by your server. A simple way to check is to select “Import” in phpMyAdmin and it will tell you. A typical value would be around 10 to 15 Mb. The reason for this check is that it is easy to download a database dump. but you may not be able to upload it again if the file is too big. Most small sites will give little trouble, but a larger, well established site with thousands of posts and tens of thousands of comments will generate a dump well in excess or the limit. The simple way around this is to export the database in batches of groups of tables. Compression is another way around this, but for the sake of simplicity it’s best to use a SQL dump rather than a compressed one.
Once the file (or files) has been downloaded it is a simple matter of opening it (or them) in a text editor and doing a Search and Replace. Note however that within the dump file there are two types of single quote.-
DROP TABLE IF EXISTS `wp_posts`;
CREATE TABLE IF NOT EXISTS `wp_posts` (
`ID` bigint(20) unsigned NOT NULL auto_increment,
`post_author` bigint(20) unsigned NOT NULL default ‘0’,
Both types are shown in the above example. The oblique quote appears before wp_… and the straight quote at ‘0’. Doing the Find and Replace, it is essential to use the oblique version. Cut and paste is the simple solution.
Decide on a new table prefix (I’ll call it ‘fixed_’ and then do the Find (`wp_) and Replace (`fixed_). on each and every SQL dump file. Once that is complete, import the file(s) back into the database. You should now have doubled the number of tables, half with the old prefix and the rest with the new.
Now open up the file wp-config.php and change the value of $table_prefix to the new one .
The site is now ready for public viewing, but you will find one rather nasty looking problem – when you try to access the Dashboard. or the Admin area you will get a message –
“You do not have sufficient permissions to access this page”
To fix this, (using phpMyAdmin) open up the table ‘fixed_usermeta’ and modify any data in the ‘meta_key’ field that starts with the old ‘wp_’ to the new prefix ‘fixed_’. You should end up with fields containing the likes of ‘fixed_capabilities’ and ‘fixed_userlevel’.
Lastly, open the table ‘fixed_options’. You will see an entry under ‘option_name’ called ‘wp_user_roles’. Change that to ‘fixed_user_roles’.
That’s it.
The site should now be happily running with a new administrator user name and a non-default database.
