For Teachers · Back to the Module · Print with your browser's Print command.

P14 Teacher Answer Key: CMS Hardening in Depth: WordPress, Joomla and Drupal

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P6

Learning Objectives

• [ ] Set safe permissions on wp-config.php, configuration.php and settings.php.
• [ ] Turn off debug output and the WordPress file editor in production.
• [ ] Explain why disabling automatic security updates is a high-risk choice.

Key Terms

Write each definition in your own words.

• Hardening: Reducing a system's attack surface and weaknesses through configuration.
• Fingerprinting: Identifying the exact software and version a system runs, for example from banners, headers or version files.
• Debug Mode: A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production.
• Patch Management: The process of finding, testing and installing software updates, especially security fixes.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-CMS- --out p14 and sort the findings by effort.
2. Write the wp-config.php lines that fix WEB-CMS-006, WEB-CMS-007 and WEB-CMS-008, and the chmod that fixes WEB-CMS-004 and WEB-CMS-005.

Self-Check Questions

1. What does define('DISALLOW_FILE_EDIT', true) prevent?

• [ ] a) Uploading images
• [x] b) Editing theme and plugin PHP files from the dashboard
• [ ] c) Logging in
• [ ] d) Installing security updates
• Answer: b. It removes the in-browser code editors. Automatic security updates keep working.

1. Why is a world-readable wp-config.php a problem on a shared server?

• [ ] a) It is not; it has no secrets
• [x] b) Every local user can read the database password and keys
• [ ] c) It slows WordPress
• [ ] d) Only the web server can read it anyway
• Answer: b. The file holds credentials and the keys that sign logins.

1. Is hiding the CMS version enough protection?

• [ ] a) Yes
• [x] b) No, it only removes a hint; patching is what fixes vulnerabilities
• [ ] c) Only for Drupal
• [ ] d) Yes, if a web firewall is also used
• Answer: b. Fingerprint removal complements patching and never replaces it.

1. Which permission is a common safe setting for wp-config.php?

• [ ] a) 777
• [ ] b) 666
• [x] c) 640: owner read and write, web server group read
• [ ] d) 755
• Answer: c. 640 lets the owner edit and the web server read, and keeps everyone else out.

1. Why is switching off WordPress automatic minor updates a high-risk choice?

• [x] a) Minor updates carry security fixes, so the site stays exposed until someone updates by hand
• [ ] b) Minor updates only change themes
• [ ] c) It stops the admin pages loading
• [ ] d) It deletes plugins
• Answer: a. WordPress delivers security fixes as automatic minor updates.

1. What do Joomla's joomla.xml manifest and Drupal's CHANGELOG.txt give an attacker?

• [ ] a) The database password
• [x] b) The exact version, so they know which advisories apply
• [ ] c) Administrator sessions
• [ ] d) Nothing useful
• Answer: b. Version files point attackers at the advisories that apply. There is no reason to publish them.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• WordPress, Hardening WordPress: https://developer.wordpress.org/advanced-administration/security/hardening/
• Joomla, Security Checklist: https://docs.joomla.org/Security_Checklist
• Drupal, Securing file permissions and ownership: https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.