WordPress WordPress Security & Hardening 2 — Questions and Answers
Question 1: What file permission setting is recommended for wp-config.php to prevent unauthorized access?
- 400 or 440 (read-only for owner or owner and group) (Correct answer)
- 777 (read, write, and execute for all users)
- 644 (read for everyone, write only for owner)
- 755 (read and execute for all, write only for owner)
Correct answer: 400 or 440 (read-only for owner or owner and group)
Setting wp-config.php to 400 or 440 restricts access so only the file owner (or owner and group) can read it, preventing other users from accessing database credentials.
Question 2: Why is disabling XML-RPC recommended as a security measure for most WordPress sites?
- It prevents attackers from using it as a vector for brute force attacks and DDoS amplification (Correct answer)
- It significantly speeds up the WordPress admin dashboard
- It is required before installing SSL certificates on the site
- It prevents spam comments from being automatically submitted
Correct answer: It prevents attackers from using it as a vector for brute force attacks and DDoS amplification
XML-RPC can be exploited for brute force login attempts that test thousands of passwords in a single HTTP request, and for amplified DDoS attacks against other targets.
Question 3: How can you prevent directory listing in WordPress, where visitors could browse the contents of folders?
- Add 'Options -Indexes' to the .htaccess file (Correct answer)
- Delete all index.php files from WordPress subdirectories
- Change the WordPress permalink structure to the plain setting
- Disable the WordPress REST API in site settings
Correct answer: Add 'Options -Indexes' to the .htaccess file
Adding 'Options -Indexes' to .htaccess instructs Apache to return a 403 Forbidden error instead of displaying directory contents when no index file exists.
Question 4: What is the most secure approach when configuring database privileges for the WordPress database user?
- Grant only SELECT, INSERT, UPDATE, DELETE, and CREATE privileges needed for normal operation (Correct answer)
- Grant SUPER privileges to allow all possible database operations
- Use the root database user for simplicity and unrestricted access
- Grant ALL PRIVILEGES on all databases to ensure WordPress always functions correctly
Correct answer: Grant only SELECT, INSERT, UPDATE, DELETE, and CREATE privileges needed for normal operation
Following the principle of least privilege, the WordPress database user should have only the minimum permissions required, limiting potential damage if credentials are ever compromised.
Question 5: Where should wp-config.php ideally be relocated to improve WordPress security?
- One directory level above the WordPress web root (public_html) (Correct answer)
- Into the wp-content directory alongside themes and plugins
- Into the wp-admin directory alongside other core admin files
- It cannot be moved and must remain in the WordPress root directory
Correct answer: One directory level above the WordPress web root (public_html)
WordPress automatically searches one directory above the web root for wp-config.php, so moving it there keeps the file outside the publicly accessible document root.
Question 6: What security risk is introduced by using nulled (pirated) WordPress themes or plugins?
- They commonly contain backdoors and malicious code that can compromise the entire site (Correct answer)
- They significantly reduce WordPress performance by 50% or more
- They conflict with the WordPress REST API, causing API errors
- They prevent WordPress from connecting to the official update server
Correct answer: They commonly contain backdoors and malicious code that can compromise the entire site
Nulled themes and plugins are frequently modified to include malware, backdoors, or spam injection code, giving attackers persistent access to the compromised site.
Question 7: Which WordPress constant, added to wp-config.php, prevents administrators from editing theme and plugin files through the admin panel?
- define('DISALLOW_FILE_EDIT', true); (Correct answer)
- define('DISABLE_EDITOR', true);
- define('WP_EDITOR_OFF', true);
- define('BLOCK_FILE_MODS', false);
Correct answer: define('DISALLOW_FILE_EDIT', true);
Setting DISALLOW_FILE_EDIT to true removes the built-in theme and plugin file editors from the WordPress admin, preventing attackers from injecting code if they gain admin access.
WordPress WordPress Security & Hardening 2
What file permission setting is recommended for wp-config.php to prevent unauthorized access?