@pbpyrojust/universal-security-audit 0.2.0 → 0.3.0

package/README.md

@@ -4,6 +4,13 @@ Technical security & attack-surface audit CLI. Companion tool to [universal-seo-
 
 Runs a battery of unauthenticated, publicly-visible checks against a website and produces a risk-graded HTML/PDF dashboard, CSV data files, a ticket-ready backlog, and run-over-run comparisons.
 
+## What's new in 0.3.0
+
+- **Pentest checks need confirmed permission.** The active checks (exposed paths and admin/login pages, GraphQL introspection, subdomain liveness, the port scan, open-redirect/HTTP-method/user-enumeration/error-disclosure probes, and the authenticated admin audit) only run when you confirm you own the site or have the owner's written permission: `--authorized`, or typing "yes" at the prompt. Without it a run is passive only. The confirmation (exact statement, time, user, how) is saved in `summary.json` and `full-report.json`. **Scripts and CI that relied on the active checks need `--authorized` added.**
+- **Open redirect:** only a redirect whose destination is the test host counts. Sites that redirect www → apex (or http → https) keep the query string, which made every redirect parameter a false positive.
+- **WPScan:** a refused key (WPScan answers 403 for a missing or invalid token) now stops the lookups after the first one with one message.
+- **Wordfence Intelligence** as a second source of WordPress core/plugin/theme vulnerabilities, with your own free key (`--wordfence-key` or `WORDFENCE_API_KEY`). Only for sites detected as WordPress. The feed is downloaded at most once a day and kept as a compact index in `~/.cache/universal-security-audit/`; components WPScan already reported aren't repeated. See [WordPress CVE lookups](#wordpress-cve-lookups).
+
 ## What's new in 0.2.0
 
 - **security.txt (RFC 9116) validation:** finds it at `/.well-known/security.txt` (or the legacy `/security.txt`) and checks the required Contact and Expires fields, an expiry date that hasn't passed (and isn't more than a year out), HTTPS, `text/plain`, Canonical and Policy; reports PGP signing. A missing or expired file is a finding.
@@ -12,11 +19,22 @@ Runs a battery of unauthenticated, publicly-visible checks against a website and
 
 ## Part of Vinny
 
-This scanner is the free, open-source engine behind the security checks in [Vinny](https://vinny.justwhat.net) and the [WordPress plugins](https://wordpress.justwhat.net). Everything here stays free.
+This scanner is the free, open-source engine behind the [security checks in Vinny](https://vinny.justwhat.net/features/#security). Everything here stays free. [Vinny](https://vinny.justwhat.net) runs the same header grading on a schedule for any website, alongside [accessibility](https://vinny.justwhat.net/features/#accessibility), [SEO and rank tracking](https://vinny.justwhat.net/features/#seo), with history, alerts and fix tickets ([free for one site](https://vinny.justwhat.net/pricing/)). For WordPress, the [Universal Security Audit plugin](https://wordpress.justwhat.net/#plugins-heading) is coming soon.
+
+## ⚠️ Authorized use only: pentest checks need written permission
+
+**Only run this tool against sites and infrastructure you own, or that you have the owner's explicit written permission to test.** Some of what it does is the recon phase of a penetration test, and in many places requests like these count as security testing that needs permission, even when every request is harmless on its own. Unauthorized scanning can break computer-misuse laws (such as the US CFAA or the UK Computer Misuse Act) and hosting providers' terms. Permission from a site's owner doesn't cover the hosting company's own servers: many hosts forbid port scans of their network, so add `--skip-port-scan` unless the host allows it.
 
-## ⚠️ Authorized use only
+The checks come in two kinds:
 
-This tool actively sends requests to well-known admin/login/config paths, DNS-probes common subdomains, TCP-connects to common service ports, and queries third-party vulnerability databases. **Only run it against sites/infrastructure you own or have explicit written permission to test.** Every probe is a single unauthenticated GET/OPTIONS/DNS/TCP-connect to a publicly documented path, record, or port — no auth bypass, brute force, fuzzing, or payload injection is performed, and destructive HTTP verbs (PUT/DELETE) are only *introspected* via OPTIONS, never sent. The one exception is the **authenticated admin audit** (see below), which requires you to supply valid login credentials yourself — it only ever reads screens the logged-in account already has access to. Unauthorized scanning of third-party infrastructure may still violate computer-fraud laws or terms of service even when every individual request is "harmless" on its own.
+- **Passive (always on):** what any visitor gets. The pages, response headers and cookies, TLS, DNS and WHOIS, security.txt, the scripts and libraries the pages load, and public vulnerability databases (OSV.dev, WPScan).
+- **Active (pentest-style, need confirmed permission):** exposed config/backup/admin/login/API paths and GraphQL introspection, subdomain liveness, a TCP port scan, open-redirect, HTTP-method, WordPress user-enumeration and error-disclosure probes, and the authenticated WordPress/Drupal admin audit.
+
+The active checks only run after you confirm: pass `--authorized` (for scripts and CI), or type "yes" when an interactive run asks. Without that, a run is passive only and says what it skipped. The confirmation is written into the run's `summary.json` and `full-report.json` (`authorization`: the exact statement and its version, the time, your OS user name and how it was given), so each report shows what was agreed.
+
+Even the active checks stay gentle: every probe is a single GET, OPTIONS, DNS lookup or TCP connect to a publicly documented path, record or port. No auth bypass, brute force, fuzzing or payload injection; destructive HTTP verbs (PUT/DELETE) are only *introspected* via OPTIONS, never sent. The authenticated admin audit only uses credentials you supply and only reads screens that account can already see.
+
+**No warranty, no liability.** This software is provided "as is" under the MIT License (see `LICENSE`): the authors aren't liable for any claim or damage arising from its use. You are solely responsible for having permission for every site you test and for how you use the results.
 
 ## What it checks
 
@@ -123,6 +141,7 @@ node bin/universal-security-audit.mjs audit --site https://www.example.com
 | Flag | Description |
 | --- | --- |
 | `--site <url>` | **(required)** Target website URL |
+| `--authorized` | Confirm you own the site or have the owner's written permission, so the active (pentest-style) checks run; recorded in the report. Without it, an interactive run asks, and a non-interactive one (CI, `--json`, batch) is passive only. Alias `--i-have-permission` |
 | `--max-pages <n>` | Max pages to scan. Omit it and there's no limit — sitemap discovery pulls every URL it finds, and `--crawl` follows links until it exhausts the site; pass a number to cap either one on large sites |
 | `--crawl` | Discover pages by following internal links instead of using the sitemap |
 | `--max-per-url-pattern <n>` | Crawl-trap guard (default 3): caps how many pages matching the same URL "shape" get crawled — path segments that look like IDs/hashes/years (`/participants/mypage/1174017/2026`) are collapsed to a placeholder (`/participants/mypage/:id/:id`) for this comparison, so a site with thousands of per-record pages (fundraiser pages, product pages, forum threads) doesn't turn an uncapped `--crawl` into tens of thousands of near-duplicate requests |
@@ -138,6 +157,7 @@ node bin/universal-security-audit.mjs audit --site https://www.example.com
 | `--skip-subdomain-enum` | Skip crt.sh subdomain enumeration |
 | `--skip-whois` | Skip the WHOIS/RDAP domain-registration lookup |
 | `--skip-admin-audit` | Skip the authenticated admin audit even if credentials are supplied |
+| `--wordfence-key <key>` | Your own Wordfence Intelligence API key (or set `WORDFENCE_API_KEY`): free, commercial use allowed with attribution. WordPress sites only; see [WordPress CVE lookups](#wordpress-cve-lookups) |
 | `--wpscan-key <key>` | Your own WPScan Vulnerability API token (or set `WPSCAN_API_KEY` env var) — free tier is 25 requests/day; see [WordPress CVE lookups](#wordpress-cve-lookups) |
 | `--brand-config <path>` | JSON file to white-label the HTML/PDF report (see below) |
 | `--proxy <url>` | Route all traffic (fetch + browser) through an upstream proxy, e.g. Burp Suite / OWASP ZAP, for manual inspection/replay |
@@ -174,7 +194,10 @@ node scripts/run-security-audit.mjs --site https://www.example.com \
 
 ### WordPress CVE lookups
 
-WordPress core/plugin/theme vulnerability matching uses the [WPScan Vulnerability Database API](https://wpscan.com/api), which requires an API key — there's no shared/bundled key in this repo, so each user registers their own for free at wpscan.com. Set it either way:
+WordPress core/plugin/theme vulnerability matching only runs for sites detected as WordPress, and only with a key you supply. Two sources, use either or both:
+
+- **[Wordfence Intelligence](https://www.wordfence.com/threat-intel/)** (`WORDFENCE_API_KEY` or `--wordfence-key`): free for commercial and personal use with attribution; create a key at wordfence.com under Account → Integrations. The full feed (~160 MB) is downloaded at most once every 24 hours and kept as a compact index (~18 MB) in `~/.cache/universal-security-audit/wordfence-index.json` (or `$XDG_CACHE_HOME`); the key's download limit is small, so if a refresh is refused the cached copy is used. Findings credit Wordfence and Defiant Inc. as its license requires.
+- **WPScan**: uses the [WPScan Vulnerability Database API](https://wpscan.com/api), which requires an API key — there's no shared/bundled key in this repo, so each user registers their own at wpscan.com. WPScan's free key is for non-commercial use; for client or commercial work use Wordfence or a paid WPScan plan. Set it either way:
 
 ```bash
 export WPSCAN_API_KEY=your-key-here
@@ -307,10 +330,10 @@ node bin/universal-security-audit.mjs audit --site https://www.example.com \
 
 ### Quick first-pass on a live WordPress site
 
-Default posture — fast, unauthenticated, safe to run against a client's live production site without asking anyone first (still get permission):
+Fast and unauthenticated, but the active checks still need the client's written permission first (`--authorized` records that you have it):
 
 ```bash
-node bin/universal-security-audit.mjs audit --site https://www.example.com --intensity light
+node bin/universal-security-audit.mjs audit --site https://www.example.com --intensity light --authorized
 ```
 
 ### Full authenticated WordPress security review
@@ -320,7 +343,7 @@ Agency-style deep audit: create an Application Password in the client's wp-admin
 ```bash
 node bin/universal-security-audit.mjs audit --site https://www.example.com \
   --wp-app-user admin --wp-app-password "xxxx xxxx xxxx xxxx xxxx xxxx" \
-  --wpscan-key YOUR_WPSCAN_KEY --crawl --max-pages 50
+  --wpscan-key YOUR_WPSCAN_KEY --crawl --max-pages 50 --authorized
 node bin/universal-security-audit.mjs tickets --run-dir ./reports/<run-id>
 ```
 
@@ -332,7 +355,7 @@ Same shape, form-login only (no Application Passwords in Drupal core):
 
 ```bash
 node bin/universal-security-audit.mjs audit --site https://www.example.com \
-  --login-url https://www.example.com/user/login --username admin --password your-password
+  --login-url https://www.example.com/user/login --username admin --password your-password --authorized
 ```
 
 ### E-commerce / donation site
@@ -356,7 +379,7 @@ node bin/universal-security-audit.mjs audit --site https://staging.example.com \
 
 ```bash
 node bin/universal-security-audit.mjs audit --site https://www.example.com \
-  --intensity light --skip-port-scan --skip-subdomain-enum \
+  --intensity light --skip-port-scan --skip-subdomain-enum --authorized \
   --baseline ./security-baseline.json --fail-on high --json > report.json
 node bin/universal-security-audit.mjs sarif --run-dir "$(ls -td reports/*/ | head -1)" --out results.sarif
 ```
@@ -367,7 +390,7 @@ Then upload `results.sarif` with `github/codeql-action/upload-sarif` so findings
 
 ```bash
 node bin/universal-security-audit.mjs batch-audit --sites-file ./client-sites.txt \
-  --intensity light --skip-cve --concurrency 2
+  --intensity light --skip-cve --concurrency 2 --authorized
 ```
 
 Pair with a cron/scheduled job and diff each site's `summary.json` week over week (or use `compare` against the prior run per site) to catch regressions before a client notices.
@@ -397,7 +420,7 @@ Maximum coverage, routed through Burp Suite so a human can inspect/replay anythi
 node bin/universal-security-audit.mjs audit --site https://www.example.com \
   --intensity aggressive --crawl --max-pages 100 \
   --wordlist ./my-wordlist.txt --proxy http://127.0.0.1:8080 \
-  --wp-app-user admin --wp-app-password "xxxx xxxx xxxx xxxx xxxx xxxx" --wpscan-key YOUR_KEY
+  --wp-app-user admin --wp-app-password "xxxx xxxx xxxx xxxx xxxx xxxx" --wpscan-key YOUR_KEY --authorized
 ```
 
 ## Risk grading

package/bin/universal-security-audit.mjs

@@ -36,7 +36,8 @@ Commands:
 Examples:
   universal-security-audit audit --site https://www.example.com
   universal-security-audit audit --site https://www.example.com --crawl --max-pages 25
-  universal-security-audit audit --site https://www.example.com --intensity aggressive
+  universal-security-audit audit --site https://www.example.com --authorized --intensity aggressive
+  universal-security-audit audit --site https://www.example.com --wordfence-key YOUR_KEY
   universal-security-audit audit --site https://www.example.com --wpscan-key YOUR_KEY
   universal-security-audit audit --site https://www.example.com --skip-exposed-paths --skip-recon
   universal-security-audit audit --site https://www.example.com --login-url https://www.example.com/wp-login.php --username U --password P
@@ -51,7 +52,11 @@ Examples:
   universal-security-audit baseline --run-dir ./reports/<run-id> --out ./security-baseline.json
   universal-security-audit batch-audit --sites-file ./sites.txt --intensity light
 
+Pentest-style (active) checks need the site owner's written permission: pass --authorized,
+or answer "yes" when asked. Without it a run is passive only.
+
 Key flags (see README for the full list):
+  --authorized                          Confirm written permission; runs the active checks
   --intensity light|normal|aggressive   Concurrency/delay/probe-size dial
   --max-pages <n>                       Cap pages scanned (default: no limit)
   --max-depth <n>                        Link-hops from homepage to follow during --crawl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pbpyrojust/universal-security-audit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "packageManager": "pnpm@10.8.0",
   "description": "Technical security & attack-surface audit CLI: security header grading, CMS/hosting fingerprinting, exposed-path & admin/API discovery, third-party script + CVE lookups (OSV.dev/WPScan), PII & payment-processor detection, and a risk-graded HTML/PDF report.",

package/scripts/lib/authorization.mjs

@@ -0,0 +1,54 @@
+// ── Permission for the active (pentest-style) checks ──
+// Passive checks only read what any visitor gets: the pages, response headers, TLS, DNS/WHOIS,
+// the files and libraries the pages load, and public vulnerability databases. The active checks
+// request what a visitor wouldn't (exposed config/backup paths, admin and login pages, GraphQL
+// introspection, open-redirect and HTTP-method probes, WordPress user enumeration, error
+// disclosure, subdomain liveness, a TCP port scan) or log in with credentials you supply. Those
+// need the site owner's written permission, so they only run once it's confirmed, and the
+// confirmation is written into the run's report.
+import os from 'node:os';
+import readline from 'node:readline/promises';
+
+/** Bump the version whenever the wording changes; each report keeps the exact text confirmed. */
+export const AUTHORIZATION_STATEMENT_VERSION = '2026-10-31';
+export const AUTHORIZATION_STATEMENT =
+  'I own this site, or I have the site owner\'s written permission to security-test it, including requests a normal visitor wouldn\'t make (admin, login and configuration paths, port and subdomain checks, redirect and method probes). I am responsible for having that permission. The tool and its authors accept no liability for how it is used.';
+
+export const ACTIVE_CHECKS = [
+  'exposed paths, admin/login pages and GraphQL introspection',
+  'subdomain liveness',
+  'TCP port scan',
+  'recon probes (open redirect, HTTP methods, WordPress user enumeration, error disclosure)',
+  'authenticated WordPress/Drupal admin audit',
+];
+
+/**
+ * Resolves whether the active checks may run. `--authorized` (or `--i-have-permission`) confirms
+ * up front, for scripts and CI. Otherwise an interactive terminal is asked to type "yes"; anything
+ * else, or no terminal (CI, --json, batch-audit children), means passive checks only.
+ */
+export async function resolveAuthorization(args, site, { interactive = process.stdin.isTTY && process.stdout.isTTY } = {}) {
+  const record = (how) => ({
+    confirmed: true,
+    how,
+    site,
+    statement: AUTHORIZATION_STATEMENT,
+    statementVersion: AUTHORIZATION_STATEMENT_VERSION,
+    at: new Date().toISOString(),
+    user: safeUser(),
+  });
+  if (args['authorized'] || args['i-have-permission']) return record('flag');
+  if (!interactive || args['json']) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    process.stderr.write(`\n  Active checks on ${site} need the site owner's written permission:\n  "${AUTHORIZATION_STATEMENT}"\n`);
+    const answer = (await rl.question('  Type "yes" to confirm and run them, or press Enter for passive checks only: ')).trim().toLowerCase();
+    return answer === 'yes' ? record('prompt') : null;
+  } finally {
+    rl.close();
+  }
+}
+
+function safeUser() {
+  try { return os.userInfo().username; } catch { return null; }
+}

package/scripts/lib/pentest-recon.mjs

@@ -83,7 +83,12 @@ export async function checkOpenRedirect(origin) {
     if (!res) continue;
     if (res.status >= 300 && res.status < 400) {
       const loc = res.headers.get('location') || '';
-      if (loc.startsWith(CANARY) || loc.includes('open-redirect-canary.invalid')) {
+      // Only a redirect *to* the canary host counts. A site that redirects www → apex (or http →
+      // https) keeps the query string, so the canary appears inside a same-site Location; that
+      // isn't an open redirect. Resolving against the request also catches //host and \\host.
+      let host = '';
+      try { host = new URL(loc.replace(/\\/g, '/'), testUrl).hostname; } catch { /* unparseable */ }
+      if (host === new URL(CANARY).hostname) {
         findings.push({ param, testUrl, location: loc });
       }
     }

package/scripts/lib/wordfence.mjs

@@ -0,0 +1,112 @@
+// ── Wordfence Intelligence: known WordPress core/plugin/theme vulnerabilities ──
+// Free for commercial use with attribution; each user brings their own API key (wordfence.com →
+// Integrations). The feed is one ~160 MB JSON object, and the key's download limit is small and
+// unpublished, so it's fetched at most once a day and kept as a compact index (slug → ranges) in
+// the user's cache folder; later runs read only the index. Only used for sites detected as
+// WordPress, and only when a key is given.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const FEED = 'https://www.wordfence.com/api/intelligence/v3/vulnerabilities/production';
+const MAX_AGE_MS = 24 * 3600_000;
+
+export const WORDFENCE_ATTRIBUTION = 'Vulnerability data: Wordfence Intelligence (https://www.wordfence.com/threat-intel/). Copyright Defiant Inc., used under the Wordfence Intelligence license (https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/).';
+
+function cacheFile() {
+  const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache');
+  return path.join(base, 'universal-security-audit', 'wordfence-index.json');
+}
+
+/** -1, 0 or 1, comparing dotted versions number by number ("6.10.2" > "6.9.10"). */
+export function compareVersions(a, b) {
+  const pa = String(a).split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+  const pb = String(b).split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+export function isAffected(version, ranges) {
+  return ranges.some((r) => {
+    const above = r.from === '*' || (r.fi ? compareVersions(version, r.from) >= 0 : compareVersions(version, r.from) > 0);
+    const below = r.to === '*' || (r.ti ? compareVersions(version, r.to) <= 0 : compareVersions(version, r.to) < 0);
+    return above && below;
+  });
+}
+
+/** Feed records → { "plugin:slug": [{ id, title, cve, rating, score, ranges, patched, url }] }. Exported for tests. */
+export function buildIndex(feed) {
+  const index = {};
+  for (const [id, v] of Object.entries(feed)) {
+    if (v.informational) continue;
+    for (const s of v.software ?? []) {
+      const kind = ['core', 'plugin', 'theme'].includes(s.type) ? s.type : null;
+      const slug = kind === 'core' ? 'wordpress' : String(s.slug ?? '').toLowerCase();
+      if (!kind || !slug) continue;
+      const ranges = Object.values(s.affected_versions ?? {}).map((r) => ({ from: String(r.from_version ?? '*'), fi: r.from_inclusive !== false, to: String(r.to_version ?? '*'), ti: r.to_inclusive !== false }));
+      if (!ranges.length) continue;
+      const key = `${kind}:${slug}`;
+      const list = (index[key] ??= []);
+      const same = list.find((x) => x.id === id);
+      if (same) {
+        // Core vulnerabilities list WordPress once per release branch.
+        same.ranges.push(...ranges);
+        same.patched = [...new Set([...same.patched, ...(s.patched_versions ?? []).map(String)])];
+        continue;
+      }
+      list.push({
+        id,
+        title: String(v.title ?? ''),
+        cve: v.cve ?? null,
+        rating: v.cvss?.rating ? String(v.cvss.rating).toLowerCase() : null,
+        score: v.cvss?.score ?? null,
+        ranges,
+        patched: (s.patched_versions ?? []).map(String),
+        url: (v.references ?? []).find((u) => /wordfence\.com/.test(u)) ?? `https://www.wordfence.com/threat-intel/vulnerabilities/id/${id}`,
+      });
+    }
+  }
+  return index;
+}
+
+/** The cached index, refreshed when older than a day. Returns { index, error }. */
+export async function loadIndex(apiKey, { file = cacheFile(), now = Date.now() } = {}) {
+  let cached = null;
+  try {
+    const stat = fs.statSync(file);
+    cached = { index: JSON.parse(fs.readFileSync(file, 'utf8')), fresh: now - stat.mtimeMs < MAX_AGE_MS };
+  } catch {}
+  if (cached?.fresh) return { index: cached.index, error: null };
+  try {
+    const res = await fetch(FEED, { headers: { Authorization: `Bearer ${apiKey}` }, signal: AbortSignal.timeout(300_000) });
+    if (!res.ok) {
+      const why = res.status === 401 ? 'Wordfence refused the API key (check WORDFENCE_API_KEY)' : res.status === 429 ? 'the Wordfence key\'s download limit was reached; try again in a few hours' : `Wordfence answered HTTP ${res.status}`;
+      // An older copy is better than nothing.
+      return cached ? { index: cached.index, error: `${why}; used the copy from ${new Date(fs.statSync(file).mtimeMs).toISOString().slice(0, 10)}` } : { index: null, error: why };
+    }
+    const index = buildIndex(await res.json());
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(index));
+    return { index, error: null };
+  } catch (e) {
+    return cached ? { index: cached.index, error: `couldn't refresh the Wordfence feed (${e?.message || e}); used the cached copy` } : { index: null, error: `couldn't download the Wordfence feed (${e?.message || e})` };
+  }
+}
+
+/** Vulnerabilities affecting one component at this exact version, each with the first fixed version above it. */
+export function lookup(index, kind, slug, version) {
+  if (!index || !version) return [];
+  return (index[`${kind}:${String(slug).toLowerCase()}`] ?? [])
+    .filter((v) => isAffected(version, v.ranges))
+    .map((v) => ({ ...v, fixedIn: v.patched.filter((p) => compareVersions(p, version) > 0).sort(compareVersions)[0] ?? null }));
+}
+
+/** Finding severity from Wordfence's rating, or the CVSS score. */
+export function severityOf(v) {
+  if (['critical', 'high', 'medium', 'low'].includes(v.rating)) return v.rating;
+  const s = Number(v.score);
+  return s >= 9 ? 'critical' : s >= 7 ? 'high' : s >= 4 ? 'medium' : 'low';
+}

package/scripts/run-security-audit.mjs

@@ -41,6 +41,8 @@ import {
 import { enumerateTlsProtocols, getWeakProtocolFindings } from './lib/tls-enum.mjs';
 import { introspectGraphQL } from './lib/graphql-introspect.mjs';
 import { loadBaseline, applyBaseline } from './lib/baseline.mjs';
+import { resolveAuthorization, ACTIVE_CHECKS } from './lib/authorization.mjs';
+import { loadIndex as loadWordfenceIndex, lookup as wordfenceLookup, severityOf as wordfenceSeverity, WORDFENCE_ATTRIBUTION } from './lib/wordfence.mjs';
 
 // ── CLI / generic helpers ───────────────────────────────────────────────
 function parseArgs(argv) {
@@ -279,14 +281,18 @@ const maxPerTemplate = args['max-per-url-pattern'] ? Number(args['max-per-url-pa
 const maxDepth = args['max-depth'] ? Number(args['max-depth']) : Infinity;
 const slowMode = Boolean(args['slow']);
 const respectRobots = Boolean(args['respect-robots']);
-const skipExposedPaths = Boolean(args['skip-exposed-paths']);
+// Active checks only run with the owner's written permission confirmed (lib/authorization.mjs).
+const authorization = await resolveAuthorization(args, site);
+const activeAllowed = Boolean(authorization);
+const skipExposedPaths = Boolean(args['skip-exposed-paths']) || !activeAllowed;
 const skipCve = Boolean(args['skip-cve']);
-const skipRecon = Boolean(args['skip-recon']);
-const skipPortScan = Boolean(args['skip-port-scan']);
-const skipSubdomainEnum = Boolean(args['skip-subdomain-enum']);
+const skipRecon = Boolean(args['skip-recon']) || !activeAllowed;
+const skipPortScan = Boolean(args['skip-port-scan']) || !activeAllowed;
+const skipSubdomainEnum = Boolean(args['skip-subdomain-enum']) || !activeAllowed;
 const skipWhois = Boolean(args['skip-whois']);
-const skipAdminAudit = Boolean(args['skip-admin-audit']);
+const skipAdminAudit = Boolean(args['skip-admin-audit']) || !activeAllowed;
 const wpscanApiKey = args['wpscan-key'] || process.env.WPSCAN_API_KEY || '';
+const wordfenceApiKey = args['wordfence-key'] || process.env.WORDFENCE_API_KEY || '';
 const branding = loadBranding(fs, path, args['brand-config']);
 const intensity = resolveIntensity(args['intensity']);
 const proxyUrl = args['proxy'] || '';
@@ -310,10 +316,14 @@ out(`  ${rainbow('╚═══════════════════
 out('');
 out(`  ${c.brightMagenta}🎯${c.reset} ${c.bold}Target:${c.reset}     ${c.brightCyan}${site}${c.reset}`);
 out(`  ${c.brightMagenta}📁${c.reset} ${c.bold}Output:${c.reset}     ${c.dim}${outDir}${c.reset}`);
-out(`  ${c.brightMagenta}🔑${c.reset} ${c.bold}WPScan key:${c.reset} ${wpscanApiKey ? `${c.brightGreen}configured${c.reset}` : `${c.dim}not set (WordPress CVE lookups will be skipped)${c.reset}`}`);
+out(`  ${c.brightMagenta}🔑${c.reset} ${c.bold}WordPress CVE data:${c.reset} ${[wordfenceApiKey && `${c.brightGreen}Wordfence${c.reset}`, wpscanApiKey && `${c.brightGreen}WPScan${c.reset}`].filter(Boolean).join(' + ') || `${c.dim}no key (set WORDFENCE_API_KEY or WPSCAN_API_KEY to look up WordPress vulnerabilities)${c.reset}`}`);
 out(`  ${c.brightMagenta}⚡${c.reset} ${c.bold}Intensity:${c.reset}  ${args['intensity'] || 'normal'}${proxyUrl ? `  ${c.dim}·${c.reset} proxying via ${proxyUrl}` : ''}`);
 if (authSettings.httpCredentials || authSettings.formAuth) console.log(`  ${c.brightMagenta}🔐${c.reset} ${c.bold}Auth:${c.reset}       ${authSettings.formAuth ? 'form login configured' : 'HTTP basic credentials configured'}`);
-statusMsg('⚠', c.brightYellow, 'Authorized-use only — this tool actively probes admin/config paths and login forms. Only run it against sites you own or have written permission to test.');
+if (activeAllowed) {
+  statusMsg('⚠', c.brightYellow, `Active checks ON (permission confirmed ${authorization.how === 'flag' ? 'with --authorized' : 'at the prompt'}; recorded in the report). Only run them on sites you own or have the owner's written permission to test.`);
+} else {
+  statusMsg('🔒', c.brightYellow, `Passive checks only. These need the owner's written permission and were skipped: ${ACTIVE_CHECKS.join('; ')}. Confirm with --authorized to run them.`);
+}
 
 let robotsCfg = { isAllowedUrl: null };
 if (respectRobots) robotsCfg = await buildRobotsMatcher(site);
@@ -826,7 +836,7 @@ if (!skipCve) {
 
   if (primaryPlatform === 'WordPress') {
     if (!wpscanApiKey) {
-      statusMsg('⏭', c.dim, 'No WPSCAN_API_KEY set — skipping live WordPress CVE lookups (core/plugin/theme version + EOL heuristics still reported).');
+      if (!wordfenceApiKey) statusMsg('⏭', c.dim, 'No WORDFENCE_API_KEY or WPSCAN_API_KEY set — skipping live WordPress CVE lookups (core/plugin/theme version + EOL heuristics still reported).');
     } else {
       let wpscanRateLimited = false;
       const warnRateLimit = () => {
@@ -834,6 +844,15 @@ if (!skipCve) {
         wpscanRateLimited = true;
         statusMsg('⚠', c.brightYellow, 'WPScan free-tier daily limit (25 requests/day) reached — remaining WordPress CVE lookups skipped for this run. Limit resets daily; see https://wpscan.com/api for paid tiers.');
       };
+      // A refused key (WPScan answers 403 for a missing or invalid token) fails every lookup the
+      // same way, so stop after the first one instead of repeating the warning per plugin/theme.
+      const stopOnRefusal = (res, what) => {
+        if (!res.error || res.rateLimited) return false;
+        if (!/unauthorized/.test(res.error)) { statusMsg('⚠', c.brightYellow, `WPScan ${what} lookup: ${res.error}`); return false; }
+        wpscanRateLimited = true;
+        statusMsg('⚠', c.brightYellow, 'WPScan refused the API key (missing, mistyped or revoked) — WordPress CVE lookups skipped for this run. Check WPSCAN_API_KEY / --wpscan-key.');
+        return true;
+      };
 
       if (wpCore.version) {
         const coreRes = await wpscanCoreLookup(wpCore.version, wpscanApiKey);
@@ -842,7 +861,7 @@ if (!skipCve) {
           for (const v of coreRes.vulns) addFinding({ category: 'cve', severity: 'critical', title: `WordPress core ${wpCore.version}: ${v.title}`, detail: v.fixedIn ? `Fixed in ${v.fixedIn}.` : 'No fix version listed.', url: Array.isArray(v.references) ? v.references[0] : String(v.references || '') });
         }
         if (coreRes.rateLimited) warnRateLimit();
-        else if (coreRes.error) statusMsg('⚠', c.brightYellow, `WPScan core lookup: ${coreRes.error}`);
+        else stopOnRefusal(coreRes, 'core');
       }
       for (const p of wpPlugins) {
         if (wpscanRateLimited) break;
@@ -855,7 +874,7 @@ if (!skipCve) {
           }
         }
         if (res.rateLimited) { warnRateLimit(); break; }
-        if (res.error) statusMsg('⚠', c.brightYellow, `WPScan plugin lookup (${p.slug}): ${res.error}`);
+        if (stopOnRefusal(res, `plugin (${p.slug})`)) break;
         await sleep(250); // stay well under WPScan free-tier rate limit
       }
       for (const t of wpThemes) {
@@ -869,11 +888,36 @@ if (!skipCve) {
           }
         }
         if (res.rateLimited) { warnRateLimit(); break; }
-        if (res.error) statusMsg('⚠', c.brightYellow, `WPScan theme lookup (${t.slug}): ${res.error}`);
+        if (stopOnRefusal(res, `theme (${t.slug})`)) break;
         await sleep(250);
       }
     }
   }
+
+  // Wordfence Intelligence, with the user's own key (free, commercial use allowed with attribution).
+  if (primaryPlatform === 'WordPress' && wordfenceApiKey) {
+    const { index, error } = await loadWordfenceIndex(wordfenceApiKey);
+    if (error) statusMsg('⚠', c.brightYellow, `Wordfence: ${error}.`);
+    if (index) {
+      // Components WPScan already reported aren't repeated.
+      const seen = new Set(vulnResults.map((r) => r.component.replace(/@.*$/, '')));
+      const components = [
+        ...(wpCore.version ? [{ kind: 'core', slug: 'wordpress', version: wpCore.version, label: `WordPress core ${wpCore.version}`, key: `WordPress core ${wpCore.version}` }] : []),
+        ...wpPlugins.map((p) => ({ kind: 'plugin', slug: p.slug, version: p.version, label: `WP plugin "${p.slug}"`, key: `plugin:${p.slug}` })),
+        ...wpThemes.map((t) => ({ kind: 'theme', slug: t.slug, version: t.version, label: `WP theme "${t.slug}"`, key: `theme:${t.slug}` })),
+      ];
+      let wfFound = 0;
+      for (const comp of components) {
+        if (!comp.version || seen.has(comp.key.replace(/@.*$/, ''))) continue;
+        const vulns = wordfenceLookup(index, comp.kind, comp.slug, comp.version);
+        if (!vulns.length) continue;
+        wfFound += 1;
+        vulnResults.push({ component: comp.kind === 'core' ? comp.key : `${comp.key}@${comp.version}`, source: 'Wordfence', vulns: vulns.map((v) => ({ id: v.id, title: v.title, fixedIn: v.fixedIn, references: [v.url] })) });
+        for (const v of vulns) addFinding({ category: 'cve', severity: wordfenceSeverity(v), title: `${comp.label}: ${v.title}`, detail: `Installed: ${comp.version}. ${v.fixedIn ? `Fixed in ${v.fixedIn}.` : 'No fix yet.'}${v.cve ? ` ${v.cve}.` : ''} ${WORDFENCE_ATTRIBUTION}`, url: v.url });
+      }
+      statusMsg('🛡️', c.dim, `Wordfence: ${wfFound} component(s) with known vulnerabilities.`);
+    }
+  }
   statusMsg('🛡️', c.dim, `${vulnResults.length} component(s) with known vulnerabilities found.`);
   phaseDone('CVE lookups', Date.now() - cveStart);
 } else {
@@ -1092,6 +1136,8 @@ const summaryData = {
   wpAdminAudit,
   drupalAdminAudit,
   suppressedFindingsCount: suppressedCount,
+  activeChecks: activeAllowed,
+  authorization,
 };
 fs.writeFileSync(path.join(outDir, 'summary.json'), JSON.stringify(summaryData, null, 2), 'utf8');