Module 1 – Introduction to WordPress Security

This module is designed to introduce the course and the basic concepts of WordPress security, including common terminology.

• Introduction to the course and the learning outcomes
• Why do bad actors compromise sites
• Life cycle of a hack
• Security Concepts
• OWASP Top 10 as a classification of common hacks
• OWAP ASVS and how to apply it to WordPress sites
• Common WordPress Compromises
• Common security myths

Module 2 – User Management

This module is designed to help harden user security, from understanding the concept of what a user is and what they can do, through to auditing who is and isn’t accessing the site

• What is a user
• Understanding user roles and capabilities
• Password & Session Management
• Multi-Factor Authentication
• Single Sign-on and alternative login mechanisms
• Auditing users

Module 3 – Update Management

This module covers keeping everything up to date and the best approaches to maintaining secure sites..

• Why updating is so important
• Building a SBOM (Software bill of materials)
• Identifying critical updates
• The Pros and Cons of Automatic Updates
• Testing and Process Flows
• Patching vs updating
• Package Management

Module 4 – Browser Security

This module introduces concepts around browser security, such as security headers, and how they provide a layer of defence as well as reporting potential issues

• Introduction to Security Headers
• Introduction to Content Security Policies
• Introduction to CORS
• Implementing Security Headers

Module 5 – Configuration Management

This module covers configuration changes to WordPress to improve the security of a site, as well as hardening individual components..

• WordPress Config Hardening
• Database hardening
• API Hardening XML-RPC/REST
• SMTP Email hardening
• Managing Secrets

Module 6 – Hosting & Backups

This module covers the role of services that are often outside of our direct control, including hosting, backups, and offsite services such as Cloudflare.

• Understanding the role of Hosting in security
• Choosing between Managed and Non Managed Hosting
• Managing Backups
• Managing PHP
• Managing Apache/Nginx
• Working with CDNs and proxy based WAF

Module 7 – Monitoring

This module covers the basics of user and site monitoring, and introduces the process of building a SIEM (Security Information and Event Management) solution.

• Introduction to logging, monitoring solutions and SIEM
• Introduction to User activity monitoring
• Introduce to access/error and PHP specific logging
• Identifying compromises with logging
• Alerting and proactive monitoring

Module 8 – Compliance

This module covers the main requirements and differences between the major information security compliance standards, and how they apply to WordPress.

• Why Compliance can sometimes be a good thing
• WordPress and EU Cyber Resilience Act (CRA) ( & UK proposed bill)
• WordPress and GDPR
• WordPress and CyberEssentials
• WordPress and PCI-DSS
• WordPress and ISO27001

Module 9 – Putting it all together

This final module focuses on taking everything we have learnt and putting it into practice.

• Risk Management
• Starting from scratch
• Auditing Existing Sites
• Incremental changes