WordPress WordPress Security & Hardening 2

Question 1

What file permission setting is recommended for wp-config.php to prevent unauthorized access?

Accepted Answer

400 or 440 (read-only for owner or owner and group)

Answer

Setting wp-config.php to 400 or 440 restricts access so only the file owner (or owner and group) can read it, preventing other users from accessing database credentials.

Question 2

Why is disabling XML-RPC recommended as a security measure for most WordPress sites?

Accepted Answer

It prevents attackers from using it as a vector for brute force attacks and DDoS amplification

Answer

XML-RPC can be exploited for brute force login attempts that test thousands of passwords in a single HTTP request, and for amplified DDoS attacks against other targets.

Question 3

How can you prevent directory listing in WordPress, where visitors could browse the contents of folders?

Accepted Answer

Add 'Options -Indexes' to the .htaccess file

Answer

Adding 'Options -Indexes' to .htaccess instructs Apache to return a 403 Forbidden error instead of displaying directory contents when no index file exists.

Question 4

What is the most secure approach when configuring database privileges for the WordPress database user?

Accepted Answer

Grant only SELECT, INSERT, UPDATE, DELETE, and CREATE privileges needed for normal operation

Answer

Following the principle of least privilege, the WordPress database user should have only the minimum permissions required, limiting potential damage if credentials are ever compromised.

Question 5

Where should wp-config.php ideally be relocated to improve WordPress security?

Accepted Answer

One directory level above the WordPress web root (public_html)

Answer

WordPress automatically searches one directory above the web root for wp-config.php, so moving it there keeps the file outside the publicly accessible document root.

WordPress Practice Test

WordPress Practice Test

WordPress WordPress Security & Hardening 2