WordPress Risk Assessment & Management 5 — Questions and Answers
Question 1: Which WordPress configuration hardens security by preventing direct PHP file execution in the uploads directory?
- Enabling the WordPress media library
- Adding an .htaccess rule to deny PHP execution in wp-content/uploads/ (Correct answer)
- Increasing the upload file size limit
- Disabling WordPress auto-updates
Correct answer: Adding an .htaccess rule to deny PHP execution in wp-content/uploads/
Blocking PHP execution in the uploads directory prevents attackers from running malicious scripts they've uploaded as image or media files.
Question 2: What risk does 'user enumeration' present to a WordPress site?
- It causes performance degradation from database queries
- It allows attackers to discover valid usernames to target with brute-force attacks (Correct answer)
- It exposes private post content to anonymous users
- It reveals server PHP version information
Correct answer: It allows attackers to discover valid usernames to target with brute-force attacks
WordPress exposes usernames via the author archives by default; knowing valid usernames gives attackers half the credentials needed to log in.
Question 3: In a business impact analysis (BIA) for a WordPress e-commerce site, what does RTO stand for?
- Rate of Traffic Optimization
- Recovery Time Objective — the maximum acceptable downtime after an incident (Correct answer)
- Redundant Theme Operation
- Risk Transfer Option
Correct answer: Recovery Time Objective — the maximum acceptable downtime after an incident
RTO defines how quickly a system must be restored after a failure to avoid unacceptable business impact.
Question 4: A WordPress multisite network's super admin account is compromised. What is the blast radius compared to a single-site admin compromise?
- Identical — both affect only one site
- Much larger — all sites in the network are at risk simultaneously (Correct answer)
- Smaller — multisite compartmentalizes risk per site
- Limited to the primary domain only
Correct answer: Much larger — all sites in the network are at risk simultaneously
A super admin has unrestricted control over every site in the multisite network, so one compromised account affects the entire network.
Question 5: Which WordPress update strategy best balances security risk with stability risk?
- Never update to avoid breaking changes
- Apply security updates promptly and test major updates on staging first (Correct answer)
- Update all plugins simultaneously to save time
- Wait 6 months after each major release before updating
Correct answer: Apply security updates promptly and test major updates on staging first
Security patches should be applied quickly to close vulnerabilities, while major updates benefit from staging validation to catch compatibility issues.
Question 6: What risk does storing WordPress database backups in the web root (public directory) create?
- Slower backup creation speeds
- Anyone on the internet can download the database file and access all site data (Correct answer)
- Backups overwrite each other automatically
- Causes conflicts with the WordPress cron system
Correct answer: Anyone on the internet can download the database file and access all site data
Database backups in a publicly accessible directory can be downloaded directly by anyone, exposing all user data, passwords hashes, and content.
Question 7: Which risk mitigation strategy involves transferring financial exposure from a WordPress security breach to a third party?
- Installing a WAF (Web Application Firewall)
- Purchasing cyber liability insurance (Correct answer)
- Enabling automatic plugin updates
- Moving to a managed WordPress host
Correct answer: Purchasing cyber liability insurance
Cyber liability insurance transfers the financial cost of a breach — including legal fees, notification costs, and damages — to the insurer.
WordPress Risk Assessment & Management 5
Which WordPress configuration hardens security by preventing direct PHP file execution in the uploads directory?