Security Agent

Overview

The Security Agent is a monitoring and response system covering both a business CRM platform and its WordPress and WooCommerce storefront. It centralises security event logging, monitors authentication, blocks malicious actors, scores order fraud, surfaces it all on a live dashboard, sends alerts and lets the team investigate using natural-language queries. It serves businesses running a customer platform alongside a public online store. An attack on one side should never leave the other side open.

Challenges

Security signals were scattered across the CRM, WordPress, WooCommerce and the web server logs. There was no single place to see what was actually happening. Brute-force login attempts could hammer accounts unchecked. No failure threshold warned on suspicious activity or locked out attackers automatically. Common web attacks could pass straight through without pattern detection at the request layer. That means SQL injection, cross-site scripting and path traversal. Malformed authentication cookies, session hijacking attempts and quiet privilege escalations such as unexpected role changes or admin grants went completely unnoticed. The online store was exposed to fraudulent and high-risk orders. Geography mismatches, disposable email domains, proxy use, card-testing patterns and abnormal order velocity all passed without any scoring. WordPress-specific abuse vectors lacked dedicated monitoring. Those include XML-RPC brute force, plugin and theme tampering, suspicious uploads and payment interception. A bad actor blocked on one surface could simply keep operating on the other because blocking decisions weren't shared. And attack patterns living only in the web server logs were invisible to application-level monitoring entirely.

Solution highlights

We built a centralised event-logging service backed by dedicated security event and blocked-entity data models. Authentication events, suspicious requests and block actions all land in one place. A blocking service handles block, unblock, expiry and status checks. It goes beyond IP addresses to users and email addresses. Authentication monitoring covers login, logout and failed-login events. Brute-force detection warns at one threshold and blocks automatically at another. Protective middleware enforces blocked entities, applies rate limiting, adds security headers, logs requests and detects injection, scripting and traversal patterns at the request layer. A WordPress connector plugin wires the storefront into critical hooks for authentication, XML-RPC, file integrity, uploads, orders and payment events. It was built with retry logic, a local event queue and a deliberate fail-open design. Rule-based fraud scoring flags high-risk orders against clear signals with defined thresholds and risk levels. Cross-platform blocking means a block on one side is reflected on the other automatically. A React dashboard gives a live threat feed, incident details, emergency lockdown and manual unblock controls. Email and Slack alerts back it up for critical events. A log parser with scheduled background processing detects attack patterns, denial-of-service signatures and error spikes that application monitoring alone would miss.

Key Features

• Centralised security event logging across CRM, WordPress, WooCommerce and server logs
• IP, user and email blocking with expiry and status checks
• Authentication monitoring with brute-force warning and auto-block thresholds
• Middleware for blocked-entity enforcement, rate limiting, security headers and request logging
• Detection of SQL injection, cross-site scripting and path traversal patterns
• WordPress connector with retry logic, local event queue and fail-open design
• Critical hooks for authentication, XML-RPC, file integrity, uploads, orders and payments
• Rule-based order fraud scoring with defined thresholds and risk levels
• Cross-platform blocking reflected automatically across connected systems
• React dashboard with live threat feed, incident details, emergency lockdown and manual unblock
• Email and Slack notifications for critical-severity events
• Web server log parsing with scheduled background processing and automatic blocking

Our Role & Approach

Our role was to add serious security capability to a live storefront without ever risking the storefront itself. Two decisions came out of that. First the WordPress connector was built fail-open. If the CRM endpoint is unreachable the shop keeps serving customers. It doesn't block them. Events queue locally until the connection returns. Second we rolled out in monitor-only mode on staging before enabling any automatic blocking. Detection accuracy could be validated against real traffic before it was allowed to act. We chose rule-based fraud scoring for the first release rather than a model. Rules are explainable, tunable and auditable from day one. Security API endpoints were hardened with key authentication, rate limiting and input validation before production. And we phased the roadmap so hook coverage, enhanced fraud rules, threat intelligence and advanced dashboards could follow once the core proved itself.

Technology Stack

Backend: Django models, REST API endpoints, middleware, Django signals, Django Admin. AI: AI Security Agent with an agent tool registry. WordPress and WooCommerce: PHP connector plugin with WordPress, WooCommerce and Stripe hooks. Frontend: React security dashboard. Notifications and logs: email alerts, Slack alerts, Nginx access and error logs. Security middleware: rate limiting, security headers, request logging, IP blocking, API key authentication.

Outcomes

The security team now sees events from the CRM, WordPress, WooCommerce and server logs in one unified searchable view with severity badges, filters and metrics. Brute-force attempts and known-bad traffic are detected and blocked automatically once thresholds are crossed. The window of exposure shrank considerably. Injection, scripting and traversal attempts are caught at the request layer. Added security headers cut browser-side attack surface. Suspicious sessions, malformed authentication cookies and privilege-escalation events surface early enough to act on. High-risk orders are scored against clear fraud rules that combine payment processor signals with business-specific logic. Operators respond faster with a live threat feed, incident details, emergency lockdown and one-click unblock. Critical alerts are pushed to the right people immediately. Cross-platform blocking means an actor shut out of one system can't quietly continue in another. The fail-open connector design means security hardening never takes the shop offline. And the monitor-only staging rollout let the team validate detection safely before automatic blocking went live.