Missing "Harden" button for "Database table prefix"

There is no hardening button for that option. The plugin used to have one but after a discussion with our research team I had to remove it because it represented a security hole in the websites.

The button basically would create a backup of the database to restore the site in case of a malfunctioning of the hardening, then it starts changing the name of all the main database tables, and finally secure some specific data in the options and metadata tables. The issue was that I also added an option that allowed the administrator to download the backup of the database, and the code that powered this option was vulnerable allowing an attacker to download any file from the server.

I fixed this security hole as soon as it was discovered, but before the patch was released the manager of the research and development team decided that it was better to omit that option, so I removed the hardening button (as you can see here [1] and here [2]) and since then it only has the warning.

[1] https://plugins.trac.www.ads-software.com/changeset/949827
[2] https://plugins.trac.www.ads-software.com/changeset/953661

That’s strange indeed. The two websites where I currently have Sucuri installed have (or at least it says they have) the same version: 1.7.5.

Leaving that behind, maybe making the backup downloadable is the problem. Making a temporary backup is a good idea, but it should be deleted after the DB change is confirmed to have gone OK as Sucuri’s mission is not providing backups. It would even be perfectly fine if you only warned the user that a backup should be made (with cPanel, BackupWordPress or other)… and there you could even have a business opportunity by selecting which backup system you recommend.

Anyway, it would be great if you could re-enable the database prefix change again.

Happy New Year, Yorman.

Yes, I even was proud to have written the code to implement that hardening option, because I spent many hours improving it to work better and faster. I also had the same idea that you propose, but I can not take that decision on my own, so I will just move this to our internal tracking system, if my manager and the rest of our development team consider that this hardening option can be added again, then I will re-implement the code for a future version of the plugin, but I can not promise anything.

Happy new year for you too.