Enterprise-grade, non-destructive WordPress security assessment and posture management platform.
SentinelWP is an advanced security auditing and reconnaissance tool designed to evaluate the security posture of WordPress websites and web applications. It provides detailed analysis of attack surfaces, misconfigurations, sensitive information exposure, and HTTP security header compliance without performing destructive actions.
- Initial Setup Wizard: Zero default credentials. A guided setup wizard (/setup) forces the creation of a custom primary Administrator account on first launch.
- SSRF Protection & Target Safety: Integrated SSRF protection mechanism that automatically blocks requests to private IP subnets (127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, etc.) and local hostnames.
- Async Background Scans & Live Progress: Non-blocking thread-pool scan execution with real-time progress meter (0–100%) and AJAX status polling.
- 3 Scan Modes:
- Passive (Default): Zero-impact analysis of the homepage and linked public assets.
- Safe-Active: Non-destructive checks against known WordPress endpoints and public files.
- Full: Includes audit of common default credentials (limited to a maximum of 20 attempts).
- Multi-Signal WordPress Detection: Fingerprinting algorithm with aggregate confidence scoring (0.0 to 1.0) based on 8 independent signals (meta generator, asset paths, REST API, cookies, RSS feeds, etc.).
- Live Vulnerability Intelligence: Automatic matching of detected plugins and themes against official CVE databases via OSV.dev REST API.
- Scheduled Recurring Audits: Background scheduler for automated periodic security scans (every 12h, 24h, or 7 days).
- SMTP Email & Webhook Alerting: Automated alert dispatching via SMTP email and Webhooks (Slack, Microsoft Teams, or custom endpoints) upon detecting Critical or High severity findings.
- REST API & Cookie Audit:
- Full route discovery and namespace inspection via /wp-json/ with privacy-first user endpoint auditing (no personal data stored).
- Security flag analysis for HTTP response cookies (Secure, HttpOnly, SameSite).
- Passive Plugin & Theme Discovery: Zero-request extraction of plugins and themes from HTML page source.
- Exposure & Hardening Checks: Identification of backup files (wp-config.php.bak), debug logs, directory listing, HTTPS redirection, and visible PHP error messages.
- Executive Reporting & SARIF: Automated report generation in PDF, HTML, Excel, JSON, and OASIS SARIF v2.1.0 formats for CI/CD integration.
- Rate Limiting & Anti-DDoS: In-memory sliding window rate limiter per client IP address (HTTP 429).
- Role-Based Access Control (RBAC): Multi-user management (Admin, Analyst, Viewer) with secure sessions.
- Python 3.10+
- Virtual environment (
venv)
-
Clone the repository:
git clone https://github.com/melillopietro/SentinelWP.git cd SentinelWP -
Activate virtual environment and install dependencies:
python3 -m venv .venv source .venv/bin/activate pip install -r requirements.txt -
Launch the platform:
python3 app.py
-
Complete Initial Setup:
- Access: http://localhost:8080
- Follow the Initial Setup Wizard (/setup) to create your custom Administrator username and password.
- Backend & Web UI: Python 3, Flask, Jinja2, Vanilla CSS (Dark Theme)
- Database: SQLite3 (WAL mode enabled, automatic schema management)
- Async & Scheduling: ThreadPoolExecutor, background daemon scheduler
- Reporting Engine: ReportLab (PDF), OpenPyXL (Excel), SARIF v2.1.0 JSON generator
- Security Core: Requests, Python ipaddress/socket validation, in-memory rate limiter
SentinelWP is developed following safe security assessment practices:
- No default credentials; mandatory initial administrator account creation.
- No destructive exploitation techniques or target database modifications.
- Automatic redaction of credentials and secrets detected in exposed configuration files (
content_redacted: True). - Alignment with OWASP web application security testing guidelines.
This project is licensed under the MIT License - see the LICENSE file for details.