Security plugins in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary function of a WordPress security plugin?

Choose the main purpose of installing a security plugin on a WordPress site.

A To add new design themes and templates

B To improve the website's loading speed by caching pages

C To protect the website from unauthorized access and attacks

D To manage SEO and improve search rankings

💡 Hint

Think about what security means for a website.

Security plugins help protect WordPress sites from hackers, malware, and unauthorized access.

❓ component_behavior

intermediate

What happens when you activate a WordPress security plugin with firewall features?

After activating a security plugin that includes a firewall, what behavior should you expect?

A The plugin deletes all existing posts to prevent hacking

B The plugin automatically changes your website's theme

C The plugin disables all user logins temporarily

D The plugin blocks suspicious traffic before it reaches your website

💡 Hint

Firewalls act like guards at the gate.

A firewall filters and blocks harmful traffic before it can harm your website.

📝 Syntax

advanced

Which code snippet correctly adds a security plugin activation notice in WordPress?

Identify the correct PHP code to show an admin notice after activating a security plugin.

Wordpress

<?php
function show_activation_notice() {
    echo '<div class="notice notice-success is-dismissible"><p>Security plugin activated!</p></div>';
}
add_action('admin_notices', 'show_activation_notice');
?>

A

<?php
function show_activation_notice() {
    echo '<div class="notice notice-error"><p>Security plugin activated!</p></div>'
}
add_action('admin_notices', 'show_activation_notice');
?>

B

<?php
function show_activation_notice() {
    echo '<div class="notice notice-success is-dismissible"><p>Security plugin activated!</p></div>';
}
add_action('admin_notices', 'show_activation_notice');
?>

C

<?php
function show_activation_notice() {
    echo '<div class="notice notice-success is-dismissible"><p>Security plugin activated!</p></div>'
}
add_action('admin_notices', show_activation_notice);
?>

D

<?php
function show_activation_notice() {
    echo '<div class="notice notice-success is-dismissible"><p>Security plugin activated!</p></div>';
}
add_action('admin_notices', 'show_activation_notice'
?>

💡 Hint

Check for correct syntax: semicolons, quotes, and function references.

Option B correctly uses quotes around the function name, includes semicolons, and closes all parentheses.

🔧 Debug

advanced

Why does this WordPress security plugin code cause a fatal error?

Review the code below and select the reason it causes a fatal error when activated.

Wordpress

<?php
function block_ip() {
    $blocked_ips = ['192.168.1.1', '10.0.0.1'];
    if (in_array($_SERVER['REMOTE_ADDR'], $blocked_ips)) {
        wp_die('Access denied');
    }
}
add_action('init', 'block_ip');
?>

A The $_SERVER['REMOTE_ADDR'] variable may not be set, causing an undefined index error

B The function block_ip is missing a return statement

C The wp_die function is not available during the 'init' action hook

D The add_action call uses the wrong hook name

💡 Hint

Check if all variables are always defined when the code runs.

Sometimes $_SERVER['REMOTE_ADDR'] is not set, causing an undefined index error. It should be checked before use.

❓ state_output

expert

What is the output of this WordPress security plugin snippet when a blocked IP visits?

Given the code below, what will a visitor from IP '192.168.1.1' see?

Wordpress

<?php
function block_ip() {
    $blocked_ips = ['192.168.1.1', '10.0.0.1'];
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';
    if (in_array($ip, $blocked_ips)) {
        wp_die('Access denied');
    }
}
add_action('init', 'block_ip');
?>

A The visitor sees a white screen with the message 'Access denied' and script execution stops

B The visitor is redirected to the homepage without any message

C The visitor sees the normal website content without interruption

D The visitor receives a 404 Not Found error page

💡 Hint

wp_die stops the page and shows a message.

wp_die displays the message and stops further script execution, showing a simple error page.