rename modules for security reasons?

[DRMasterChief]

Hello, perhaps a simple question, but important for me:

is it an idea to rename a purchased module (including all files and necessary changes in them) so that it is perhaps not visible from the outside with the known name?

I don't know exactly how SQL injections work, for example, but perhaps files are searched for known names (modules) and this could perhaps prevent it a little?

A module always presents a certain risk until something about it appears at https://security.friendsofpresta.org/. But many developers still need many weeks or months to come up with a fix.

 

In that case, would I have to change all the names in every file that is contained in the module? For example, if the developer calls the module 'moduleone', would I have to rename every expression 'moduleone' to 'newname'?

Edited November 2, 2024 by DRMasterChief

[the.rampage.rado]

The bots crawl and look for exploits, they don't care if your module is called XYZ or ZYX. If your module has the same code in it the name does not matter. In some cases the module names is even not visible.

[DRMasterChief]

2 hours ago, the.rampage.rado said:

The bots crawl and look for exploits...

ok  -  but how ?

[camillaroblesa]

Jumping in on this older post because I’ve been thinking about this same question. When bots scan for vulnerabilities, they look for code patterns like function calls or database queries, not the module’s filename. So renaming doesn’t change the exploitable logic. Curious—have you tried any other obfuscation methods that actually work for you?

[DRMasterChief]

Hello, no, I haven't pursued that any further at the moment.