WordPress WordPress Security & Hardening 2

Question 1

What file permission setting is recommended for wp-config.php to prevent unauthorized access?

Accepted Answer

400 or 440 (read-only for owner or owner and group)

Answer

777 (read, write, and execute for all users)

Answer

644 (read for everyone, write only for owner)

Answer

755 (read and execute for all, write only for owner)

Question 2

Why is disabling XML-RPC recommended as a security measure for most WordPress sites?

Accepted Answer

It prevents attackers from using it as a vector for brute force attacks and DDoS amplification

Answer

It significantly speeds up the WordPress admin dashboard

Answer

It is required before installing SSL certificates on the site

Answer

It prevents spam comments from being automatically submitted

Question 3

How can you prevent directory listing in WordPress, where visitors could browse the contents of folders?

Accepted Answer

Add 'Options -Indexes' to the .htaccess file

Answer

Delete all index.php files from WordPress subdirectories

Answer

Change the WordPress permalink structure to the plain setting

Answer

Disable the WordPress REST API in site settings

Question 4

What is the most secure approach when configuring database privileges for the WordPress database user?

Accepted Answer

Grant only SELECT, INSERT, UPDATE, DELETE, and CREATE privileges needed for normal operation

Answer

Grant SUPER privileges to allow all possible database operations

Answer

Use the root database user for simplicity and unrestricted access

Answer

Grant ALL PRIVILEGES on all databases to ensure WordPress always functions correctly

Question 5

Where should wp-config.php ideally be relocated to improve WordPress security?

Accepted Answer

One directory level above the WordPress web root (public_html)

Answer

Into the wp-content directory alongside themes and plugins

Answer

Into the wp-admin directory alongside other core admin files

Answer

It cannot be moved and must remain in the WordPress root directory

Question 6

What security risk is introduced by using nulled (pirated) WordPress themes or plugins?

Accepted Answer

They commonly contain backdoors and malicious code that can compromise the entire site

Answer

They significantly reduce WordPress performance by 50% or more

Answer

They conflict with the WordPress REST API, causing API errors

Answer

They prevent WordPress from connecting to the official update server

Question 7

Which WordPress constant, added to wp-config.php, prevents administrators from editing theme and plugin files through the admin panel?

Accepted Answer

define('DISALLOW_FILE_EDIT', true);

Answer

define('DISABLE_EDITOR', true);

Answer

define('WP_EDITOR_OFF', true);

Answer

define('BLOCK_FILE_MODS', false);