---
title: "P14: CMS Hardening in Depth: WordPress, Joomla and Drupal"
canonical: https://openvapt.com/academy/p14.html
html: https://openvapt.com/academy/p14.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# P14: CMS Hardening in Depth: WordPress, Joomla and Drupal

Beyond version banners: protecting CMS configuration files, switching off debug output and in-browser code editing, and keeping security updates flowing.

- Level: Practitioner
- Time: about 25 minutes
- Read first: P6

## You Will Be Able To

- Set safe permissions on wp-config.php, configuration.php and settings.php.
- Turn off debug output and the WordPress file editor in production.
- Explain why disabling automatic security updates is a high-risk choice.

## The Configuration File Is the Crown Jewel

wp-config.php, Joomla's configuration.php and Drupal's settings.php hold the database password and the keys that sign logins. They are also PHP code that runs on every request. Readable by every user, they leak the site to anyone with a shell on the server; writable by others, they become a backdoor. Owner read and write, web server group read (640) is a common safe setting.

## Debug Output and the File Editor

WP_DEBUG with display on, or Joomla debug and maximum error reporting, print paths and internals into pages. The WordPress Theme and Plugin File Editors let any administrator change PHP from the browser. One stolen admin session then becomes code execution. DISALLOW_FILE_EDIT turns them off.

## Updates and Fingerprints

WordPress delivers security fixes as automatic minor updates; switching them off leaves the site exposed until someone updates by hand. Version files such as Joomla's joomla.xml manifest and Drupal's CHANGELOG.txt tell attackers exactly which advisories apply. Removing the fingerprint is not a substitute for patching, but there is no reason to publish it.

## In Summary

A CMS is attacked through its admin pages, plugins and exposed files. Hide versions, lock down file permissions, remove installers and keep everything updated.

## Apply It

- [WEB-CMS-001 WordPress Version Disclosed](https://openvapt.com/checks/WEB-CMS-001.md) (low)
- [WEB-CMS-002 WordPress XML-RPC Interface Enabled](https://openvapt.com/checks/WEB-CMS-002.md) (low)
- [WEB-CMS-003 WordPress User Accounts Enumerable](https://openvapt.com/checks/WEB-CMS-003.md) (low)
- [WEB-CMS-004 CMS Configuration Readable by All Users](https://openvapt.com/checks/WEB-CMS-004.md) (high)
- [WEB-CMS-005 CMS Configuration Writable by Other Users](https://openvapt.com/checks/WEB-CMS-005.md) (high)
- [WEB-CMS-006 WordPress Shows Debug Output to Visitors](https://openvapt.com/checks/WEB-CMS-006.md) (medium)
- [WEB-CMS-007 WordPress Dashboard File Editor Enabled](https://openvapt.com/checks/WEB-CMS-007.md) (low)
- [WEB-CMS-008 WordPress Automatic Updates Disabled](https://openvapt.com/checks/WEB-CMS-008.md) (medium)
- [WEB-CMS-009 Joomla Debug or Verbose Error Reporting Enabled](https://openvapt.com/checks/WEB-CMS-009.md) (medium)
- [WEB-CMS-010 Joomla Version Disclosed](https://openvapt.com/checks/WEB-CMS-010.md) (low)
- [WEB-CMS-011 Drupal Version Disclosed by Changelog](https://openvapt.com/checks/WEB-CMS-011.md) (low)
- [WEB-CMS-012 Drupal Core Past End of Life](https://openvapt.com/checks/WEB-CMS-012.md) (high)
- [WEB-CMS-013 Drupal Trusted Host Patterns Not Set](https://openvapt.com/checks/WEB-CMS-013.md) (medium)
- [WEB-CMS-014 Joomla Core Past End of Life](https://openvapt.com/checks/WEB-CMS-014.md) (high)
- [WEB-CMS-015 Magento Not in Production Mode](https://openvapt.com/checks/WEB-CMS-015.md) (medium)
- [WEB-CMS-016 Ghost Configured With a Plain HTTP Site URL](https://openvapt.com/checks/WEB-CMS-016.md) (medium)
- [WEB-CMS-017 WordPress Cron Reachable by Visitors](https://openvapt.com/checks/WEB-CMS-017.md) (info)
- [WEB-CMS-018 WordPress Author Archive Reveals Login Names](https://openvapt.com/checks/WEB-CMS-018.md) (low)
- [WEB-CMS-019 Drupal update.php Open Without Authentication](https://openvapt.com/checks/WEB-CMS-019.md) (high)

## Lab

1. `Run: openvapt demo --only WEB-CMS- --out p14 and sort the findings by effort.`
2. `Write the wp-config.php lines that fix WEB-CMS-006, WEB-CMS-007 and WEB-CMS-008, and the chmod that fixes WEB-CMS-004 and WEB-CMS-005.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. What does define('DISALLOW_FILE_EDIT', true) prevent?
   - A. Uploading images
   - B. Editing theme and plugin PHP files from the dashboard
   - C. Logging in
   - D. Installing security updates
   - Answer: B. It removes the in-browser code editors. Automatic security updates keep working.

2. Why is a world-readable wp-config.php a problem on a shared server?
   - A. It is not; it has no secrets
   - B. Every local user can read the database password and keys
   - C. It slows WordPress
   - D. Only the web server can read it anyway
   - Answer: B. The file holds credentials and the keys that sign logins.

3. Is hiding the CMS version enough protection?
   - A. Yes
   - B. No, it only removes a hint; patching is what fixes vulnerabilities
   - C. Only for Drupal
   - D. Yes, if a web firewall is also used
   - Answer: B. Fingerprint removal complements patching and never replaces it.

4. Which permission is a common safe setting for wp-config.php?
   - A. 777
   - B. 666
   - C. 640: owner read and write, web server group read
   - D. 755
   - Answer: C. 640 lets the owner edit and the web server read, and keeps everyone else out.

5. Why is switching off WordPress automatic minor updates a high-risk choice?
   - A. Minor updates carry security fixes, so the site stays exposed until someone updates by hand
   - B. Minor updates only change themes
   - C. It stops the admin pages loading
   - D. It deletes plugins
   - Answer: A. WordPress delivers security fixes as automatic minor updates.

6. What do Joomla's joomla.xml manifest and Drupal's CHANGELOG.txt give an attacker?
   - A. The database password
   - B. The exact version, so they know which advisories apply
   - C. Administrator sessions
   - D. Nothing useful
   - Answer: B. Version files point attackers at the advisories that apply. There is no reason to publish them.

## Key Terms

- Hardening: Reducing a system's attack surface and weaknesses through configuration.
- Fingerprinting: Identifying the exact software and version a system runs, for example from banners, headers or version files.
- Debug Mode: A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production.
- Patch Management: The process of finding, testing and installing software updates, especially security fixes.

## References

- [WordPress, Hardening WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/)
- [Joomla, Security Checklist](https://docs.joomla.org/Security_Checklist)
- [Drupal, Securing file permissions and ownership](https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership)

Offline: `openvapt learn P14`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p14.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.