Security testing of WordPress CMS

The thesis deals with the issue of security of websites built on CMS WordPress with emphasis on penetration testing and testing of security plugins. The main objective of this thesis is to verify the security of the WordPress CMS tool and to make security recommendations for eliminating the most common WordPress vulnerabilities. Practical security verification is performed through penetration testing using a custom universal methodology for testing WordPress websites on a sample of three selected WordPress websites. The testing includes both manual vulnerability analysis and automated scanning using tools such as WPScan or Burp Suite. The research also includes an evaluation of the effectiveness of commonly available security plugins in the context of protecting against attacks and their impact on website speed. On the basis of these tests as well as the theoretical part, which focuses on penetration testing methodologies and specifics of WordPress security, practical recommendations for website owners or administrators are formulated. These recommendations cover areas such as updating the system and plugins, configuring permissions or choosing security plugins. The results of the practical testing show that although WordPress often does not contain critical vulnerabilities, there are still frequent weaknesses in WordPress settings that increase the risk of data leakage or site compromise. The thesis also highlights the need for a systematic approach to security and provides specific steps for site owners to minimize the risks associated with cyber threats.