The default database prefix is ‘wp-’ which can be changed before install when installing manually. Since so many installs are by cPanel or other scripts, would that be a vulnerability? If one were to change that to ‘cp-’ or ‘mysite-’ would that provide some protection or just be ‘security by obscurity’?
If this doesn’t break anything, might it be something to add to core?
the prefix is there to namespace the tables so one database can safely hold multiple installations without table-name collisions.
Usually the installers let you chose a prefix for that reason.
It has very minimal security value however.
Changing the default prefix can slightly reduce exposure to automated attacks that assume standard WordPress table names, but it does not stop SQL injection or any real attack on its own. In practice, security depends much more on patching, safe plugin/theme code, least-privilege database users, and good server hardening than on the prefix name.