WordPress-Docker/README.md

@@ -28,6 +28,12 @@ This repository provides a Dockerized environment for running WordPress locally
    docker-compose up -d
    ```
 
+   OR
+
+  ```bash
+   docker compose up -d
+   ```
+
 4. **Access WordPress:**
 
    Open your browser and navigate to:
@@ -40,9 +46,9 @@ This repository provides a Dockerized environment for running WordPress locally
 
 ### Access sites:
 - **Student org sites**:
-  - http://localhost:8080/~studentorg1
-  - http://localhost:8080/~studentorg2
-  - http://localhost:8080/~studentorg3
+  - http://localhost:8080/~studentorg1 (Default, no plugins)
+  - http://localhost:8080/~studentorg2 (Legit plugins)
+  - http://localhost:8080/~studentorg3 (BAD BAD plugins)
 - **WordPress**: http://localhost:8081
 
 ### Add new student org:
@@ -58,6 +64,19 @@ chown -R www-data:www-data /home/neworg
 docker logs ocf_apache_server
 ```
 
+## Virtual machine (isolated testing)
+
+If you plan to experiment with or reverse-engineer malicious plugins, do this work only in an isolated virtual machine (VM). We provide a link to a VMware download here:
+
+https://drive.google.com/drive/folders/1lGABtrC7S9C2OpGTAlL6uG4DqqE-1zuR
+
+Guidance:
+- Use VMware and create a VM running a disposable OS such as Ubuntu or Kali Linux.
+- Perform any development, testing, or analysis of intentionally malicious plugins only inside that VM. Do not deploy or test them on your host machine or any production network.
+- Keep the VM network isolated from your production network when possible and snapshot the VM before risky experiments so you can revert changes.
+
+Only analyze or test malware and malicious plugins in controlled, authorized environments. Do not use these techniques to attack or harm others.
+
 ## Volume management
 
 > [!WARNING] Contact JQ or another officer if you are editing the default setup and don't understand the following documentation.