OpenVAPTCMS Hardening in Depth: WordPress, Joomla and Drupal
Beyond version banners: protecting CMS configuration files, switching off debug output and in-browser code editing, and keeping security updates flowing.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/p14.html. Offline: openvapt learn P14.
Read First: P6
You Will Be Able To
- Set safe permissions on wp-config.php, configuration.php and settings.php.
- Turn off debug output and the WordPress file editor in production.
- Explain why disabling automatic security updates is a high-risk choice.
The Configuration File Is the Crown Jewel
wp-config.php, Joomla's configuration.php and Drupal's settings.php hold the database password and the keys that sign logins. They are also PHP code that runs on every request. Readable by every user, they leak the site to anyone with a shell on the server; writable by others, they become a backdoor. Owner read and write, web server group read (640) is a common safe setting.
Debug Output and the File Editor
WP_DEBUG with display on, or Joomla debug and maximum error reporting, print paths and internals into pages. The WordPress Theme and Plugin File Editors let any administrator change PHP from the browser. One stolen admin session then becomes code execution. DISALLOW_FILE_EDIT turns them off.
Updates and Fingerprints
WordPress delivers security fixes as automatic minor updates; switching them off leaves the site exposed until someone updates by hand. Version files such as Joomla's joomla.xml manifest and Drupal's CHANGELOG.txt tell attackers exactly which advisories apply. Removing the fingerprint is not a substitute for patching, but there is no reason to publish it.
In Summary
A CMS is attacked through its admin pages, plugins and exposed files. Hide versions, lock down file permissions, remove installers and keep everything updated.
Apply It
These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.
| Check | Title | Severity |
|---|---|---|
WEB-CMS-001 | WordPress Version Disclosed | Low |
WEB-CMS-002 | WordPress XML-RPC Interface Enabled | Low |
WEB-CMS-003 | WordPress User Accounts Enumerable | Low |
WEB-CMS-004 | CMS Configuration Readable by All Users | High |
WEB-CMS-005 | CMS Configuration Writable by Other Users | High |
WEB-CMS-006 | WordPress Shows Debug Output to Visitors | Medium |
WEB-CMS-007 | WordPress Dashboard File Editor Enabled | Low |
WEB-CMS-008 | WordPress Automatic Updates Disabled | Medium |
WEB-CMS-009 | Joomla Debug or Verbose Error Reporting Enabled | Medium |
WEB-CMS-010 | Joomla Version Disclosed | Low |
WEB-CMS-011 | Drupal Version Disclosed by Changelog | Low |
WEB-CMS-012 | Drupal Core Past End of Life | High |
WEB-CMS-013 | Drupal Trusted Host Patterns Not Set | Medium |
WEB-CMS-014 | Joomla Core Past End of Life | High |
WEB-CMS-015 | Magento Not in Production Mode | Medium |
WEB-CMS-016 | Ghost Configured With a Plain HTTP Site URL | Medium |
WEB-CMS-017 | WordPress Cron Reachable by Visitors | Info |
WEB-CMS-018 | WordPress Author Archive Reveals Login Names | Low |
WEB-CMS-019 | Drupal update.php Open Without Authentication | High |
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Run: openvapt demo --only WEB-CMS- --out p14 and sort the findings by effort.Write the wp-config.php lines that fix WEB-CMS-006, WEB-CMS-007 and WEB-CMS-008, and the chmod that fixes WEB-CMS-004 and WEB-CMS-005.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
- WordPress, Hardening WordPress
- Joomla, Security Checklist
- Drupal, Securing file permissions and ownership
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). P14: CMS Hardening in Depth: WordPress, Joomla and Drupal (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p14.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_p14,
author = {{OpenVAPT}},
title = {{P14: CMS Hardening in Depth: WordPress, Joomla and Drupal}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/p14.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.