File permission hardening in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the correct file permission for a WordPress configuration file.

Wordpress

chmod('wp-config.php', intval([1], 8));

Drag options to blanks, or click blank then click option'

A0666

B0777

C0644

D0755

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0777 makes the file writable by everyone, which is insecure.

The wp-config.php file should have permission 0644 to allow the owner to read and write, and others to read only. This helps protect sensitive configuration data.

2fill in blank

medium

Complete the code to set the correct directory permission for WordPress content folders.

Wordpress

chmod('wp-content/uploads', intval([1], 8));

Drag options to blanks, or click blank then click option'

A0755

B0777

C0644

D0666

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0644 on directories prevents access to files inside.

Directories like wp-content/uploads should have permission 0755 to allow the owner full access and others read and execute access, which is needed to access files inside.

3fill in blank

hard

Fix the error in the code that sets file permissions for all PHP files in the theme folder.

Wordpress

foreach (glob('wp-content/themes/mytheme/*.php') as $file) {
    chmod($file, intval([1], 8));
}

Drag options to blanks, or click blank then click option'

A0644

B0666

C0755

D0777

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0755 makes PHP files executable, which is unnecessary and risky.

PHP files should have permission 0644 to allow the owner to read/write and others to read only, preventing unauthorized modifications.

4fill in blank

hard

Fill both blanks to set secure permissions for WordPress core files and directories.

Wordpress

chmod('wp-admin', intval([1], 8));
chmod('index.php', intval([2], 8));

Drag options to blanks, or click blank then click option'

A0755

B0644

C0777

D0666

Attempts:

3 left

💡 Hint

Common Mistakes

Setting 0777 on files or directories exposes security risks.

Directories like wp-admin should have 0755 permission for proper access, while core files like index.php should have 0644 to prevent unauthorized changes.

5fill in blank

hard

Fill all three blanks to create a secure permissions setup for WordPress uploads folder and its files.

Wordpress

chmod('wp-content/uploads', intval([1], 8));
foreach (glob('wp-content/uploads/*') as $item) {
    if (is_dir($item)) {
        chmod($item, intval([2], 8));
    } else {
        chmod($item, intval([3], 8));
    }
}

Drag options to blanks, or click blank then click option'

A0755

B0644

C0777

D0666

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0777 makes files and folders writable by anyone, which is unsafe.

The uploads folder and its subdirectories should have 0755 permission to allow access, while files inside should have 0644 to prevent unauthorized writing.

Practice

1. What is the main purpose of file permission hardening in WordPress?

easy

A. To add more plugins automatically

B. To speed up the website loading time

C. To protect the site from unauthorized changes

D. To change the website theme

Solution

1. Step 1: Understand file permission hardening

   File permission hardening means setting rules on who can read, write, or execute files to keep the site safe.

2. Step 2: Identify the main goal

   The goal is to stop unauthorized users from changing files, which protects the site from harm.

3. Final Answer:

   To protect the site from unauthorized changes -> Option C

4. Quick Check:

   File permission hardening = Protect site [OK]

Hint: Think security first: permissions stop unwanted changes [OK]

Common Mistakes:

• Confusing permission hardening with performance tuning
• Thinking it adds features like plugins or themes
• Believing it changes website design

2. Which chmod command correctly sets safe permissions for WordPress files?

easy

A. chmod 777 wp-config.php

B. chmod 644 index.php

C. chmod 000 wp-content

D. chmod 222 wp-admin

Solution

1. Step 1: Recall safe file permissions

   Files should be readable and writable by the owner, readable by others, usually 644.

2. Step 2: Check each option

   chmod 644 index.php sets 644 on a file, which is safe. Others either give too many rights or none.

3. Final Answer:

   chmod 644 index.php -> Option B

4. Quick Check:

   Safe file permission = 644 [OK]

Hint: Files usually get 644 permission, not 777 or 000 [OK]

Common Mistakes:

• Using 777 which is too open and unsafe
• Setting 000 which blocks all access
• Confusing file and folder permissions

3. Given the command chmod 755 wp-content, what is the effect on the wp-content folder?

medium

A. Owner can read, write, execute; others can read and execute only

B. Everyone can read, write, and execute the folder

C. No one has any permissions on the folder

D. Only the owner can read, write, and execute; others have no access

Solution

1. Step 1: Understand permission digits 755

   7 means owner can read(4), write(2), execute(1) = 7; 5 means others can read(4) and execute(1) = 5.

2. Step 2: Apply to wp-content folder

   Owner has full rights; others can read and execute but not write.

3. Final Answer:

   Owner can read, write, execute; others can read and execute only -> Option A

4. Quick Check:

   755 = Owner full, others read+execute [OK]

Hint: 755 means owner full, others read+execute only [OK]

Common Mistakes:

• Thinking 755 allows others to write
• Confusing execute permission with write
• Assuming no access for others

4. You set chmod 777 wp-config.php to fix a permission error, but the site becomes vulnerable. What is the problem?

medium

A. 777 allows anyone to read, write, and execute the file, risking security

B. 777 blocks all access to the file

C. 777 only allows the owner to access the file

D. 777 is the recommended permission for wp-config.php

Solution

1. Step 1: Understand what 777 permission means

   It gives read, write, and execute rights to everyone, including strangers.

2. Step 2: Assess security risk for wp-config.php

   This file holds sensitive info; open permissions let attackers change or read it.

3. Final Answer:

   777 allows anyone to read, write, and execute the file, risking security -> Option A

4. Quick Check:

   777 = Full access for all = Risk [OK]

Hint: Never use 777 on sensitive files like wp-config.php [OK]

Common Mistakes:

• Thinking 777 restricts access
• Believing 777 is safe for config files
• Confusing execute with write permission

5. To secure wp-config.php, which permission setting is best to prevent unauthorized reading but allow WordPress to function?

hard

A. chmod 644 wp-config.php

B. chmod 777 wp-config.php

C. chmod 000 wp-config.php

D. chmod 400 wp-config.php

Solution

1. Step 1: Understand wp-config.php security needs

   This file contains database passwords and keys, so it must be protected from others.

2. Step 2: Evaluate permission options

   400 means only owner can read; WordPress runs as owner, so it works. 644 allows others to read, 777 is too open, 000 blocks all access.

3. Final Answer:

   chmod 400 wp-config.php -> Option D

4. Quick Check:

   400 = Owner read only = Secure [OK]

Hint: Use 400 to lock wp-config.php to owner read only [OK]

Common Mistakes:

• Using 644 which lets others read sensitive info
• Using 777 which is insecure
• Using 000 which breaks WordPress access