SiteVigil v0.9.0

What's new in 0.9.0 (ruleset 2026.11 — now 42 checks)

• Response time — every report now carries response_time_ms for the main document fetch (shown in text and Markdown output), and a main page that takes over 3 seconds end to end earns a slow-response finding. Latency was the one basic signal the audit did not measure.
• Exposed database ports — a plain TCP connect checks whether MySQL/MariaDB (3306), PostgreSQL (5432), Redis (6379) or MongoDB (27017) answer on the audited host's public interface; an open one is a high-severity db-port-exposed finding. Connect only: no banner grab, no login attempt. Runs once per host (crawl does not re-probe per page); --no-ports opts out.

The port check is proxy-aware, for a reason worth writing down: behind an HTTP proxy a naive connect succeeds for every port, because the proxy answers the handshake itself. The first live run of the naive version reported four open database ports — and dropped a 94/A site to 34/F — on a site that has none. The shipped version takes its verdict from the proxy's CONNECT response instead, and a dedicated test with a fake proxy guards it.

Also on PyPI: pip install sitevigil (0.9.0). Full history in CHANGELOG.md.

SiteVigil v0.8.0 — first public release

First public release — also on PyPI: pip install sitevigil

SiteVigil is a one-command website security audit for humans and AI agents: 40 checks across security headers, cookies, TLS, CORS, exposed files, DNS (SPF/DMARC/CAA) and known vulnerabilities — scored 0–100, with a concrete fix for every finding. Zero dependencies, Python 3.10+.

What's new in 0.8.0 (ruleset 2026.11)

• WordPress plugin CVE matching — Elementor, WooCommerce, Contact Form 7 and Akismet fingerprinted from plugin asset URLs and matched against NVD
• MCP over HTTP (--mcp-http PORT) so hosted agents can use the same audit_site / suggest_fix tools; localhost by default

Plus everything from the 0.1–0.7 run-up: NVD CVE matching for server software and jQuery (verified against each CVE's vulnerable version ranges, not raw search results), --fix header configs per platform, --baseline regression diffs, --crawl, --badge, MCP over stdio, and proxy-aware TLS checks.