argus-wp-watcher

---

In Action

Scan overview · severity breakdown

Findings · CVE/OWASP badges · filter bar

---

🎯 What is Argus?

Argus is a production-ready WordPress security scanner that puts ethics first. Built for penetration testers, security researchers, and WordPress administrators, it combines traditional vulnerability scanning with cutting-edge AI analysis to deliver actionable insights.

Why Argus?

• 🔒 Ethical by Design: Consent token system prevents unauthorized scanning
• 🔍 Real CVE Data: Live correlation with WPVulnerability.net + CVSS scores from NVD (both free, no key)
• 🗂️ OWASP Mapping: Every finding mapped to OWASP Top 10 2021
• 📈 Scan Diffing: --diff last compares scans to track remediation progress
• 🤖 AI-Powered: GPT-4, Claude, or local Ollama — with streaming, agent mode, and multi-LLM compare
• 📊 Professional Reports: Rich HTML with CVE/CWE/OWASP/CVSS badges + machine-readable JSON
• 🚀 Fast & Efficient: Concurrent scanning with intelligent rate limiting
• 💾 Persistent Tracking: SQLite database for scan history
• 🐳 Docker Ready: Containerized scanning + vulnerable test lab included

What It Scans

Check Category	Safe Mode	Aggressive	Details
WordPress Detection	✅	✅	Version fingerprinting via meta tags, readme, RSS, assets
Plugins & Themes	100 plugins	447 plugins	Version detection (4 methods) + real-time CVE/CVSS correlation
Sensitive Files	74 paths	437 paths	wp-config backups, .env, SQL dumps, .git, debug logs, PHP tools
User Enumeration	3 methods	6 methods	Author IDOR, REST API, HTML parsing + oEmbed, login error, XML-RPC
Security Headers	✅	✅	HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy
Misconfigurations	✅	✅	XML-RPC, debug mode, directory listing, file editor
Login Security	❌	✅	2FA, CAPTCHA, brute-force protection, open registration, password policy
Web Crawl	❌	✅	robots.txt, sitemap.xml, HTML comments, link discovery (depth 1)

---

✨ Features

🛡️ Core Security Scanning

# One command, comprehensive analysis
python -m argus --target https://example.com --html

• Multi-Method Fingerprinting: Detects WordPress 4.x-6.x with zero false positives
• Real-Time CVE Correlation: Checks every detected plugin, theme, and core version against WPVulnerability.net (free, no API key)
• CVSS Scoring: Fetches scores from NVD for each CVE (critical ≥9.0, high ≥7.0, medium ≥4.0)
• Latest Version Detection: WordPress.org API shows the current stable version alongside detected version
• OWASP Top 10 2021: Every finding mapped to its OWASP category (A01–A10)
• Concurrent Scanning: Thread pool + rate limiting for fast, respectful scans
• Smart Detection: Early abort for non-WordPress sites (99% faster rejection)
• Evidence Collection: HTTP responses, headers, and file contents preserved

📈 Scan Diff Reports (v0.2.0)

Track remediation progress between scans:

# Compare this scan against the previous one
python -m argus --target https://example.com --html --diff last

# Or reference a specific scan ID
python -m argus --target https://example.com --html --diff 42

The diff section shows:

• New findings (appeared since last scan) — in red
• Fixed findings (remediated since last scan) — in green with strikethrough
• Persisting findings (present in both scans) — collapsed by default
• Mode mismatch warning when comparing safe vs aggressive scans

🤖 AI-Powered Analysis

Choose your AI provider based on your needs:

Provider	Best For	Speed	Cost/scan	Privacy
OpenAI gpt-4o-mini (default)	Best value	⚡ ~40s	💰 ~$0.006	🔒 Standard
OpenAI gpt-4o	Production quality	⚡ ~40s	💰 ~$0.05	🔒 Standard
Anthropic claude-3-5-haiku	Privacy-focused	⚡ ~55s	💰 ~$0.02	🔒 Enhanced
Ollama (Local)	Complete privacy	🐢 ~28min	💰 Free	🔐 100% Offline

Analysis Modes:

• Technical: Step-by-step remediation with WP-CLI commands and configuration snippets
• Executive: Plain-language summaries for stakeholders and management
• Agent (--ai-agent): Enriched with live NVD CVE data and WPVulnerability.net lookups (free APIs)
• Compare (--ai-compare): Side-by-side analysis from multiple providers in parallel
• Stream (--ai-stream): Real-time token output as the AI generates
• Budget (--ai-budget): Cost cap enforcement with configurable abort threshold

📊 Professional Reporting

JSON Reports (Machine-Readable)