# Aardwolf Security Scanner

A WordPress plugin by [Aardwolf Security](https://aardwolfsecurity.com/) that scans your WordPress site for the common attack vectors a penetration tester would probe first, and gives you prioritised, plain-English remediation steps.

All checks are **passive and read-only** — the plugin never attacks your server, exploits anything, or sends data off-site. Every check runs locally against your own install (a few loopback HTTP requests are made to your own site to inspect response headers and exposed files).

## What it checks

The scanner runs 22 checks across six categories, each returning a status (Pass / Warning / Fail / Info), a severity band (Low / Medium / High), a summary of what was found, and a concrete remediation.

| Category | Checks |
| --- | --- |
| **Software Updates** | Core update available · Plugin updates · Theme updates · Dormant (inactive) plugins & themes |
| **Accounts & Authentication** | Default `admin` username · Username enumeration (author archives + REST API) · Registration default role · Login brute-force protection |
| **Configuration Hardening** | Dashboard file editor (`DISALLOW_FILE_EDIT`) · Exposed debug output · Secret keys & salts · Default `wp_` table prefix · `FORCE_SSL_ADMIN` · Critical file permissions |
| **Information Exposure** | XML-RPC reachable · `readme.html` version leak · Generator version tag · Directory browsing · Sensitive files (`debug.log`, `.git`, `.env`, config backups) |
| **HTTP Security Headers** | `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Content-Security-Policy`, HSTS |
| **Transport & Environment** | Site served over HTTPS · Supported PHP version |
| **Known Vulnerabilities** | Plugins removed from the WordPress.org directory (often a sign a plugin was pulled for an unresolved security issue) |

Every scan produces a **0–100 security score** and letter grade so you can track progress over time.

## Scheduled scans & email alerts

Enable a **daily or weekly** background scan (via WP-Cron). The plugin emails the
configured address when your posture regresses — the score drops, problems
increase, or a high-risk issue appears — or after every scan if you prefer.

## Export

Export the latest scan as a **CSV** file, or open a clean, print-styled **PDF
report** (rendered as HTML and saved via the browser's *Save as PDF*, so there's
no heavy PDF dependency to bundle).

## Known-vulnerability detection

The scanner flags any installed plugin that has been **removed from the
WordPress.org directory** — often a sign it was pulled for an unresolved
security issue — using the free wordpress.org Plugin API. Lookups are cached in
transients and degrade gracefully if the server can't make outbound requests.

> Deeper vulnerability intelligence (CVE cross-referencing) and one-click
> hardening are planned for a future Aardwolf Security **Pro** add-on.

## Installation

1. Copy the plugin folder into `wp-content/plugins/aardwolf-security-scanner/` (or zip it and upload via **Plugins → Add New → Upload Plugin**).
2. Activate it from the **Plugins** screen.
3. Open **Security Scanner** in the admin menu and click **Run Security Scan**.

Requires WordPress 5.6+ and PHP 7.2+.

## Project structure

```
aardwolf-security-scanner.php      Main plugin file (header, constants, bootstrap)
includes/
  class-aardwolf-check-result.php  Value object for a single finding
  abstract-aardwolf-check.php      Base class for all checks
  class-aardwolf-scanner.php       Registers/runs checks, computes the score
  class-aardwolf-admin.php         Admin menu, AJAX endpoint, asset loading
  class-aardwolf-security-scanner.php  Plugin orchestrator + settings
  class-aardwolf-cron.php          Scheduled scans + email alerts
  class-aardwolf-export.php        CSV + printable PDF export
  checks/                          The individual check modules
templates/
  dashboard.php                    Admin page shell + settings form
  results.php                      Score card + grouped findings
assets/css/admin.css               Admin styling
assets/js/admin.js                 AJAX scan behaviour
uninstall.php                      Removes all plugin data on delete
```

## Extending

Register your own checks by extending `Aardwolf_Check` and hooking the
`aardwolf_sc_checks` filter:

```php
add_filter( 'aardwolf_sc_checks', function ( $checks ) {
    $checks[] = new My_Custom_Check();
    return $checks;
} );
```

## Branding

The plugin ships the official Aardwolf Security logo kit in `assets/img/`
(horizontal/vertical, blue/white, and circle-badge variants), plus an
extracted wolf mark used for the admin menu icon and empty state. The admin UI
uses the exact brand navy (`#001f81`). Logo assets are referenced through the
`Aardwolf_Admin::logo_url()` / `logo_img()` / `logo_inline()` helpers, so
swapping or adding a variant is a one-line change.

## Disclaimer

Automated checks are a valuable first line of defence, but they are **not** a substitute for a manual penetration test by a qualified assessor. For a full assessment of your website, [get in touch with Aardwolf Security](https://aardwolfsecurity.com/).

## License

GPL-2.0-or-later. See [LICENSE](LICENSE).