WordPress Security and Hardening
A defensive security course for WordPress 7.0: threat modelling, sanitisation and escaping, capability checks, database safety, hardening and incident response.
- Modules
- 03
- Lessons
- 09
- Reading time
- 4H 50M
- Words
- 17,064
What you will be able to do
- Threat model a plugin or a site and rank what is actually worth protecting.
- Sanitise every input and escape every output at the right layer.
- Write capability checks that survive an object-level attack.
- Eliminate SQL injection and unsafe file handling from PHP code.
- Harden a live site without breaking it.
- Run an incident from detection through recovery and a written post-mortem.
Before you start
Comfortable reading and writing PHP, and a WordPress install you control and can restore from a backup.
Still being written
3 of 6 modules are finished and readable now. The remaining 3 are in progress and will appear here as they are published. Nothing already written is removed, and the lessons below will not change underneath you.
WordPress security writing tends to arrive in one of two shapes: a list of configuration tweaks with no threat model, or a disclosure advisory nobody outside the project can learn from. Neither helps the person who has to decide, on a Tuesday, whether this request should be allowed to do that thing.
This course teaches defensive technique for WordPress 7.0 in the order the decisions actually arrive. It begins with threat modelling, because "add a nonce" is not advice until you know what a nonce does and does not prove. Input handling and authorisation follow, then the two areas where mistakes are catastrophic rather than embarrassing: database access and anything that executes code.
The last two modules are about the situations nobody plans for. Hardening covers what to change on a live site and in what order, so that a security improvement does not become an outage. Incident response covers what to do when the assumption of safety has already failed, including the part most guides skip: writing down what happened so the same thing does not happen twice.
Curriculum
3 modules, 9 lessons
The threat model
Trust boundaries, what an attacker controls, what is worth protecting, and how to rank findings.
3 lessons · 1H 35M
Input and output
Sanitisation, validation, escaping in context, and file uploads done safely.
3 lessons · 1H 40M
Authorisation
Capabilities, map_meta_cap, nonces, REST permissions, and object-level checks.
3 lessons · 1H 35M
Go deeper