WordPress Security Essentials

Participants will utilize the browser-based WordPress Playground environment, which requires no prior security knowledge, accounts, or logins. Working directly within the WordPress 7.0 dashboard interface, attendees will perform a live security audit, inspecting software updates, managing user permissions, and identifying potential system vulnerabilities. The session culminates in a hands-on technical configuration where participants install and activate the contributor-supported Two Factor plugin, establishing functional multi-factor authentication protocols using email validation or a live mobile authenticator app QR-code test workflow.

Learning Objectives

By the end of this activity, participants will be able to:

• Audit System Vulnerabilities: Inspect the WordPress dashboard and the Updates screen to identify pending core, plugin, and theme updates that expose the application to automated scanners and known CVE exploits.
• Evaluate User Permissions: Analyze accounts within the Users menu to restrict Administrator access to essential personnel and eliminate unauthorized profiles or legacy “admin” usernames.
• Validate Technical Profiles: Review profile settings to test real-time password complexity scores using the built-in password strength indicator, verify secure HTTPS protocol execution, and confirm administration email routing.
• Configure Multi-Factor Authentication: Deploy the lightweight Two Factor plugin to establish, activate, and test secure authentication pathways, specifically isolating the Authenticator App, Recovery Codes, and Email parameters.
• Diagnose Extraneous Software Risks: Assess the installed plugin list to safely deactivate and permanently delete unmaintained or redundant software, thereby minimizing the site’s active attack surface.