AI penetration testingIn draft
How to check your website for weak spots before AI attackers do
A plain checklist to run on your own site before an automated attacker does.
Background: AI penetration testing → How the Protect guides work
Start with your situation
Each guide is a short, plain checklist. Pick the situation that sounds like you, work down its guides in order, and read the background explainer when you want the why.
- Situation 1I run a business website Find weak spots, patch what matters, and keep bad bots out. 5 guides →
- Situation 2My team uses AI tools Store API credentials safely, cap spending, and know what to do if they leak. 2 guides →
- Situation 3We're building an AI product Distillation, prompt injection and agent security, without the jargon. 3 guides →
01
I run a business website
Find weak spots, patch what matters, and keep bad bots out.
AI bots and crawlersIn draft
How to block AI crawlers without disappearing from AI search
Which AI bots to allow, which to block, and how to do it in robots.txt and your CDN.
Background: AI bots and crawlers → WordPress and PHP patchesIn draft
WordPress security now that AI finds bugs faster
Updates, plugins and settings to check, in the order that matters.
Background: WordPress and PHP patches → WordPress and PHP patchesIn draft
How to check your PHP version and why it matters now
Find your PHP version in a few minutes, and what to do if it's out of support.
Background: WordPress and PHP patches → AI bots and crawlersIn draft
How to stop AI-driven login attacks
Rate limits, two-factor sign-in and bot checks that stop automated password guessing.
Background: AI bots and crawlers → 02
My team uses AI tools
Store API credentials safely, cap spending, and know what to do if they leak.
Leaked AI API credentialsIn draft
Leaked OpenAI or Anthropic API credentials: what to do in the first hour
Revoke, rotate, check usage, then find the leak. A first-hour checklist.
Background: Leaked AI API credentials → Leaked AI API credentialsIn draft
How to store AI API credentials safely
Where keys should live, who should hold them, and how to cap spend in case one leaks.
Background: Leaked AI API credentials → 03
We're building an AI product
Distillation, prompt injection and agent security, without the jargon.
Distillation attacksIn draft
How to spot and limit distillation on your own AI API
Signs someone is copying your model through your API, and the limits that slow them down.
Background: Distillation attacks → AI penetration testingIn draft
Using AI agents to test your own site, safely
How to point an AI agent at your own systems, with permission, scope and limits.
Background: AI penetration testing → Prompt injectionIn draft
AI agent security: permissions, MCP and credentials
What to lock down before an agent with tool access goes live.
Background: Prompt injection →