AI-Powered WordPress Security Scanner

A comprehensive WordPress penetration testing plugin powered by AI. This plugin uses FastAPI backend with Google Gemini AI to scan WordPress sites for vulnerabilities and generate detailed security reports.

🌟 Features

• AI-Powered Analysis: Uses Google Gemini AI to analyze vulnerabilities and provide actionable recommendations
• Comprehensive Scanning: Detects multiple vulnerability types including:
  • Outdated WordPress core, plugins, and themes
  • Missing security headers
  • XML-RPC vulnerabilities
  • User enumeration issues
  • Directory listing
  • Exposed sensitive files
  • And more...
• Beautiful Dashboard: Modern, responsive admin interface with real-time scan progress
• Detailed Reports: View, filter, and export reports in PDF or CSV format
• MongoDB Storage: Persistent storage of scan results and historical data
• RESTful API: FastAPI backend with comprehensive API documentation

📋 Requirements

Backend Requirements

• Python 3.8 or higher
• MongoDB (local or cloud instance like MongoDB Atlas)
• Google Gemini API key

WordPress Requirements

• WordPress 5.0 or higher
• PHP 7.4 or higher
• Administrator access

📖 Usage

Running a Security Scan

1. Go to Security Scanner → Dashboard
2. Click "Start Security Scan"
3. Wait for the scan to complete (progress bar shows real-time status)
4. View results and AI-generated recommendations

Viewing Reports

1. Go to Security Scanner → Reports
2. Click on any report to view details
3. Export reports as PDF or CSV

Managing Settings

1. Go to Security Scanner → Settings
2. Configure API URL and other preferences
3. Test API connection

🏗️ Project Structure

ai-security-scanner/
├── backend/
│   ├── models/
│   │   ├── database.py      # MongoDB connection
│   │   └── scan.py          # Data models
│   ├── services/
│   │   ├── scanner.py       # Vulnerability scanner
│   │   └── ai_analyzer.py   # AI analysis
│   ├── routes/
│   │   ├── scan.py          # Scan endpoints
│   │   └── reports.py       # Report endpoints
│   ├── main.py              # FastAPI app
│   ├── config.py            # Configuration
│   ├── requirements.txt     # Python dependencies
│   └── .env.example         # Environment template
├── admin/
│   ├── dashboard.php        # Dashboard page
│   ├── reports.php          # Reports page
│   └── settings.php         # Settings page
├── assets/
│   ├── css/
│   │   └── admin-style.css  # Admin styles
│   └── js/
│       └── admin-script.js  # Admin JavaScript
├── includes/
│   ├── api-client.php       # API client
│   └── export-handler.php   # Export handler
└── ai-security-scanner.php  # Main plugin file

🔌 API Endpoints

Scan Endpoints

• POST /api/scan/start - Start a new scan
• GET /api/scan/status/{scan_id} - Get scan status
• GET /api/scan/result/{scan_id} - Get scan result

Report Endpoints

• GET /api/reports/list - List all reports
• GET /api/reports/detail/{report_id} - Get report details
• GET /api/reports/export/{report_id}/pdf - Export as PDF
• GET /api/reports/export/{report_id}/csv - Export as CSV

Health Check

• GET /health - API health check

🛡️ Security Considerations

• Keep your Gemini API key secure
• Use strong API_SECRET_KEY in production
• Restrict CORS origins to your WordPress site
• Use HTTPS in production
• Regularly update dependencies
• Protect MongoDB with authentication

🐛 Troubleshooting

Backend won't start

• Check MongoDB is running
• Verify .env file exists and has correct values
• Ensure virtual environment is activated
• Check port 8000 is not in use

WordPress can't connect to API

• Verify FastAPI server is running
• Check API URL in WordPress settings
• Ensure CORS origins include your WordPress site
• Check firewall settings

Scans fail

• Verify Gemini API key is valid
• Check MongoDB connection
• Review FastAPI logs for errors
• Ensure site is accessible from backend

📝 License

GPL v2 or later

👨‍💻 Development

Running Tests

cd backend
pytest

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📧 Support

For issues and questions, please open an issue on GitHub.

---

Made with ❤️ using FastAPI, WordPress, and Google Gemini AI