I've used https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

It isn't PHP specific, but it is actively maintained and you get to run it locally.

Is it time to just make RioCar.org static ? I'm wondering how much work it would be to spider it and then add some htaccess mappings/tweak some of the static output ?
_________________________
Remind me to change my signature to something more interesting someday