Reduce attack surface and keep the application maintainable
You should be able to demonstrate the result described in the lesson and explain why each step was necessary.
Step-by-step
Patch quickly
Keep WordPress core, themes, plugins, PHP, and the operating system current.
Use unique admin credentials
Avoid shared accounts and enable two-factor authentication when practical.
Remove unused code
Delete inactive plugins and themes you do not need; inactive vulnerable code can still be a liability.
Protect backups
Do not leave database dumps or zip backups inside publicly readable web directories.
Review permissions
Avoid 777 permissions. Files should be writable only where WordPress or the site user actually needs write access.
You should be able to demonstrate the result described in the lesson and explain why each step was necessary.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.