Developer releases open-source WordPress scanner covering 109 security checks in 60 seconds

·1 views

A developer named Damian Hunziker has released wpsec109, a free open-source Python-based tool that audits WordPress sites across 109 security hardening points in approximately 60 seconds. The scanner covers 22 categories including directory listing exposure, PHP execution in upload folders, sensitive file leaks, security headers, and user enumeration vulnerabilities. It runs locally without sending data to third-party servers and does not require API keys for basic scans, though optional WPScan API integration enables CVE cross-referencing for plugins and themes. Each flagged issue comes with an actionable remediation suggestion, such as specific .htaccess rules or file permission changes. The tool is publicly available on GitHub and was built to fill a gap in client-side auditing tools that are both privacy-respecting and provide practical fix guidance.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Angular Dependency Injection Explained: From Constructor Basics to Modern DI

Angular's Dependency Injection (DI) system has evolved well beyond simple constructor-based service injection, now offering tools like the inject() function, InjectionToken, hierarchical injectors, and tree-shakable providers. At its core, DI separates the responsibility of creating dependencies from the classes that use them, reducing tight coupling and improving testability. The system relies on three key concepts — tokens, providers, and injectors — to manage how objects are created, scoped, and supplied across an application. Modern Angular extends DI into an architectural pattern by supporting dependency inversion, allowing high-level modules to depend on abstractions rather than concrete implementations. Features like useClass, useFactory, functional guards, and environment-level providers make Angular DI a powerful tool for building scalable, maintainable applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL MVCC: Table Bloat Does Not Cause Read Amplification, Here's Why

A common misconception holds that PostgreSQL's MVCC mechanism causes reads to slow down as dead row versions accumulate before VACUUM runs, but this is inaccurate. Sequential scans examine heap tuples directly and skip invisible ones, while index scans follow version chains only within a single page, limiting overhead. PostgreSQL also performs lightweight garbage collection during normal reads through hint bits and opportunistic heap pruning, even when autovacuum is disabled. Index scans mark dead entries as LP_DEAD after a single visibility check, preventing repeated heap lookups in future queries. As a result, while space amplification (bloat) is a real concern in PostgreSQL, read performance does not degrade proportionally as dead tuples build up.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apple's September 2026 Event: Key Developer Takeaways from New Hardware

Apple's September 2026 event introduced several devices with significant implications for software developers. The iPhone Duo, priced from $1,999, features a foldable design with a 5.4-inch outer and 7.6-inch inner display, requiring developers to rethink navigation and layout for multiple physical states. The iPhone 18 Pro lineup debuts the A20 Pro chip and a variable-aperture camera system, with Apple opening a new API for third-party apps to access the camera's advanced capabilities. AirPods 5 and Apple Watch Series 12 expand ambient AI and health-sensing features, offering developers richer data for fitness, wellness, and translation-focused applications. Across all announcements, the recurring theme is a blurring boundary between hardware and software, presenting both new building blocks and fresh challenges for the developer community.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Deterministic MCP Tools Proposed to Fix LLMs' Unreliable Financial Arithmetic

A developer has built the Couples Shared Account Engine, a Model Context Protocol (MCP) server designed to handle proportional expense splitting for households rather than relying on a language model's error-prone internal arithmetic. The system uses four calculation primitives — covering income proportions, individual obligations, reconciliation transfers, and partner surplus — to ensure mathematically rigorous, equity-based cost sharing. The approach addresses a known weakness of LLM-driven automation, where probabilistic models often produce plausible-looking but mathematically flawed outputs for deterministic tasks like bill splitting. The engine is part of a broader project called Vinkius, which aims to simplify authentication complexity in agentic workflows through a unified gateway called MCPFusion, replacing per-tool credential management with a single connection token. The developer highlights that financial decision-support tools carry a higher risk profile than standard data queries, making controlled, deterministic logic especially critical when AI agents interact with real bank APIs or sensitive financial data.

0 comments Read more at DEV Community