WordPress WordPress Security & Hardening 1 — Questions and Answers
Question 1: What is the default WordPress database table prefix, and why is changing it considered a security best practice?
- It is 'wp_', and changing it makes SQL injection attacks targeting default table names less effective (Correct answer)
- It is 'wordpress_', and changing it speeds up database queries
- It is 'db_', and changing it prevents all SQL injection attacks
- It is 'wptable_', and changing it is required for multisite installations
Correct answer: It is 'wp_', and changing it makes SQL injection attacks targeting default table names less effective
The default prefix 'wp_' is well-known to attackers; changing it makes automated SQL injection attempts targeting default table names less likely to succeed.
Question 2: Which file in a WordPress installation contains the database credentials and requires the most careful protection?
- wp-config.php (Correct answer)
- functions.php
- .htaccess
- wp-login.php
Correct answer: wp-config.php
wp-config.php contains the database name, username, password, and secret keys, making it the most sensitive file in any WordPress installation.
Question 3: What is the purpose of WordPress authentication keys and salts defined in wp-config.php?
- They encrypt and secure browser cookies and session tokens, making them harder to forge (Correct answer)
- They authenticate the WordPress admin during the login process
- They generate secure passwords for newly created user accounts
- They encrypt the database connection between WordPress and MySQL
Correct answer: They encrypt and secure browser cookies and session tokens, making them harder to forge
WordPress authentication keys and salts add random elements to values stored in cookies, making them more secure and significantly harder to crack or forge.
Question 4: Which combination of measures is most effective for protecting the WordPress login page against brute force attacks?
- Limiting login attempts and adding CAPTCHA verification (Correct answer)
- Changing the site tagline to something obscure
- Removing the default admin username only
- Disabling comments on all posts and pages
Correct answer: Limiting login attempts and adding CAPTCHA verification
Limiting login attempts blocks repeated failed logins while CAPTCHA prevents automated bots, together making brute force attacks significantly harder to execute.
Question 5: What does enabling two-factor authentication (2FA) in WordPress require users to provide at login?
- Both their password and a secondary verification code from a separate device or app (Correct answer)
- Two separate passwords configured during account creation
- A password and their email address confirmed each time they log in
- Two security questions answered correctly before gaining access
Correct answer: Both their password and a secondary verification code from a separate device or app
2FA requires users to provide their password plus a time-based or device-generated code, meaning a stolen password alone is insufficient to gain unauthorized access.
Question 6: Which WordPress function should developers use to sanitize plain text input from users before saving it to the database?
- sanitize_text_field() (Correct answer)
- wp_filter_content_tags()
- get_option()
- wp_insert_post()
Correct answer: sanitize_text_field()
sanitize_text_field() removes HTML tags, extra whitespace, and invalid UTF-8 characters from user-supplied text, preventing XSS and injection attacks.
Question 7: What is the primary security purpose of a WordPress nonce?
- To verify that a form submission or action request is legitimate and not a cross-site forgery (Correct answer)
- To generate unique usernames for newly registered WordPress accounts
- To encrypt post content before storing it in the database
- To create unique download URLs for media files
Correct answer: To verify that a form submission or action request is legitimate and not a cross-site forgery
Nonces (numbers used once) are security tokens that verify requests originate from the expected source, protecting against CSRF (cross-site request forgery) attacks.
WordPress WordPress Security & Hardening 1
What is the default WordPress database table prefix, and why is changing it considered a security best practice?