WPFather is a single-binary WordPress security scanner and reconnaissance tool written in Go. It runs a fixed set of non-destructive, read-only checks against a WordPress site and prints results directly to the terminal — no config files, no flags, no output files.
Built for authorized penetration testing, bug bounty recon, and WordPress hardening audits.
GOPROXY=direct go install github.com/ps1-blacklist/wpfather@latest🔍 16 Scan Modules | 🎯 Zero Config | ⚡ Single Binary | 🔒 Read-Only | 📋 Copy-Paste Ready Output
WPFather runs 16 scan modules per target:
| Module | What it checks |
|---|---|
| 🔄 Redirect Chain | Follows redirects, flags scope/host changes |
| 🔒 TLS/SSL | Protocol version, certificate expiry, self-signed detection |
| 🛡️ WAF/CDN Fingerprint | Cloudflare, Sucuri, Akamai, CloudFront, Fastly |
| 🤖 robots.txt & sitemap | Parses disallowed paths for sensitive references |
| 📡 HTTP Methods | Detects risky methods (PUT, DELETE, TRACE, CONNECT) |
| 🍪 Cookie Flags | Missing Secure / HttpOnly / SameSite / Path attributes |
| ⚙️ WordPress Core | Version disclosure, debug mode, readme/install/cron exposure |
| 📨 XML-RPC | pingback SSRF vector, multicall brute-force vector, user validation |
| 👥 Users | REST API user enumeration, author-ID enumeration |
| 🔌 Plugins & Themes | Slug/version detection, NVD CVE lookup |
| 📁 Sensitive Files | Backups, .git, .env, config backups, logs (25+ paths) |
| 📂 Directory Listing | Open directory index detection |
| 🛡️ Security Headers | HSTS, CSP, X-Frame-Options, and more |
| 💧 Info Leaks | Internal IPs, emails, API keys, AWS keys, private keys |
| 🎯 SSRF Confirmation | Verifies pingback SSRF against internal/metadata targets |
Every finding includes the exact URL that triggered it, so results can be copy-pasted straight into a browser or curl for manual verification.
No flags, no arguments. Run the binary and follow the prompts:
wpfather📥 Your Domain: example.com Type 'yes' to confirm you are authorized to scan example.com:
The tool confirms authorization, runs all 16 modules, and prints findings live as they're found, followed by a summary with a risk score out of 100.
Only run WPFather against systems you own or have explicit written authorization to test. Unauthorized scanning may violate the CFAA or equivalent laws in your jurisdiction.
Built by ps1-blacklist — Red Squad Bangladesh
🔗 GitHub: github.com/ps1-blacklist
❤️ 👍
Made with ❤️ for the security community