File permission hardening in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding WordPress file permission basics

Which file permission setting is generally recommended for WordPress files to ensure security while allowing the web server to read them?

A 644

B 600

C 777

D 755

💡 Hint

Think about permissions that allow reading but restrict writing by others.

WordPress files should typically have permissions set to 644, which means the owner can read and write, and others can only read. This prevents unauthorized modifications while allowing the server to serve the files.

❓ component_behavior

intermediate

Effect of incorrect directory permissions in WordPress

If WordPress directories are set to permission 644 instead of the recommended 755, what is the most likely outcome?

A WordPress will fail to upload media files or install plugins due to lack of execute permission on directories.

B WordPress will work normally without any issues.

C WordPress files will become publicly writable, causing security risks.

D WordPress will automatically correct the permissions to 755.

💡 Hint

Directories need execute permission to allow access inside them.

Directories require execute permission (x) to allow the server to access files inside. Setting directories to 644 removes execute permission, causing failures in uploading or installing plugins.

📝 Syntax

advanced

Correct .htaccess rule to prevent PHP execution in uploads

Which of the following .htaccess snippets correctly prevents execution of PHP files inside the wp-content/uploads directory?

A

<Files *.php>
  Require all denied
</Files>

B

<Files *.php>
  deny from all
</Files>

C

<FilesMatch "\.php$">
  deny from all
</FilesMatch>

D

<FilesMatch "\.php$">
  Require all denied
</FilesMatch>

💡 Hint

Modern Apache versions use 'Require all denied' for access control.

For Apache 2.4+, the correct way to deny access is using Require all denied inside a <FilesMatch> block. This prevents PHP execution in uploads, enhancing security.

🔧 Debug

advanced

Diagnosing permission error during plugin update

A WordPress site shows a 'Could not create directory' error when updating plugins. The wp-content/plugins directory has permissions 755 and is owned by root. What is the most likely cause?

A The plugins directory is missing execute permission.

B The directory permissions 755 are too restrictive; it should be 777.

C The directory ownership by root prevents the web server user from writing to it.

D The WordPress configuration file is corrupted.

💡 Hint

Check who owns the directory and which user runs the web server.

Even with correct permissions, if the directory is owned by root and the web server runs as a different user, it cannot write to the directory. Changing ownership to the web server user fixes this.

❓ state_output

expert

Result of applying restrictive permissions on wp-config.php

If the wp-config.php file is set to permission 400 (read-only by owner) and owned by the web server user, what will be the effect on WordPress operation?

A WordPress will fail to load because it cannot write to wp-config.php.

B WordPress will function normally, as it only needs to read wp-config.php.

C WordPress will throw a permission denied error when updating plugins.

D WordPress will automatically change the permission to 644.

💡 Hint

Consider if WordPress needs to write to wp-config.php during normal operation.

WordPress only reads wp-config.php to get configuration. Setting it to 400 (read-only by owner) is secure and does not affect normal operation since no writing is needed.