Small businesses running WordPress sites have no free, browser-based way to check security. Existing tools are expensive or CLI-only.
A web security scanner with WordPress checks (15+ checks: version disclosure, user enumeration, XML-RPC, debug logs, config backups) and Nikto integration. JWT auth, real-time WebSocket updates, severity charts, scan comparison, API keys for CI/CD.
Wrapping Nikto (a Perl CLI tool) into async Python was tricky — OpenCode helped me design the subprocess + WebSocket bridge pattern. The WordPress passive scanner needed to balance speed vs coverage; OpenCode suggested using concurrent HTTPX clients with timeouts which solved performance bottlenecks.
OpenCode was my pair programmer throughout — it helped me write the 15+ WordPress scanner checks, design the severity inference from raw Nikto output, and structure the React dashboard with Recharts. I learned how to build a production scanner by breaking down each check into small, testable units with OpenCode's guidance.
Add ZAP/nuclei scanners, scheduled recurring scans, and Slack alerts — the modular scanner architecture OpenCode helped me design makes adding new scanners trivial.
Great job addressing a real need for small businesses with a browser‑based WordPress security scanner and integrating Nikto via async subprocesses. To strengthen the project, add a public repository with clear documentation and unit tests for each check, and consider expanding the UI to show remediation steps for detected issues.