For Teachers · Back to the Module · Print with your browser's Print command.

P14 Worksheet: CMS Hardening in Depth: WordPress, Joomla and Drupal

Student Worksheet (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P6

Learning Objectives

• [ ] Set safe permissions on wp-config.php, configuration.php and settings.php.
• [ ] Turn off debug output and the WordPress file editor in production.
• [ ] Explain why disabling automatic security updates is a high-risk choice.

Key Terms

Write each definition in your own words.

• Hardening: ______________________________________________
• Fingerprinting: ______________________________________________
• Debug Mode: ______________________________________________
• Patch Management: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-CMS- --out p14 and sort the findings by effort.
2. Write the wp-config.php lines that fix WEB-CMS-006, WEB-CMS-007 and WEB-CMS-008, and the chmod that fixes WEB-CMS-004 and WEB-CMS-005.

Self-Check Questions

1. What does define('DISALLOW_FILE_EDIT', true) prevent?

• [ ] a) Uploading images
• [ ] b) Editing theme and plugin PHP files from the dashboard
• [ ] c) Logging in
• [ ] d) Installing security updates

1. Why is a world-readable wp-config.php a problem on a shared server?

• [ ] a) It is not; it has no secrets
• [ ] b) Every local user can read the database password and keys
• [ ] c) It slows WordPress
• [ ] d) Only the web server can read it anyway

1. Is hiding the CMS version enough protection?

• [ ] a) Yes
• [ ] b) No, it only removes a hint; patching is what fixes vulnerabilities
• [ ] c) Only for Drupal
• [ ] d) Yes, if a web firewall is also used

1. Which permission is a common safe setting for wp-config.php?

• [ ] a) 777
• [ ] b) 666
• [ ] c) 640: owner read and write, web server group read
• [ ] d) 755

1. Why is switching off WordPress automatic minor updates a high-risk choice?

• [ ] a) Minor updates carry security fixes, so the site stays exposed until someone updates by hand
• [ ] b) Minor updates only change themes
• [ ] c) It stops the admin pages loading
• [ ] d) It deletes plugins

1. What do Joomla's joomla.xml manifest and Drupal's CHANGELOG.txt give an attacker?

• [ ] a) The database password
• [ ] b) The exact version, so they know which advisories apply
• [ ] c) Administrator sessions
• [ ] d) Nothing useful

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• WordPress, Hardening WordPress: https://developer.wordpress.org/advanced-administration/security/hardening/
• Joomla, Security Checklist: https://docs.joomla.org/Security_Checklist
• Drupal, Securing file permissions and ownership: https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.