phpinfo-wp / includes / class-security-headers.php

class-security-headers.php in phpinfo() WP – Site Health, PHP Compatibility & Server Audit 7.2.5, at includes/class-security-headers.php

116 lines 4.8 KB

Raw Download Zip

1	<?php
2	defined('ABSPATH') or die('Unauthorized Access');
3
4	class Phpinfo_WP_Security_Headers {
5
6	private static function _pro(): bool { return Phpinfo_WP_License::is_valid(); }
7
8	// Points per header — total 100
9	/**
10	* @var mixed[]
11	*/
12	private static $headers = [
13	'content-security-policy' => ['label' => 'Content-Security-Policy', 'points' => 30, 'desc' => 'Prevents XSS and data injection attacks by declaring approved content sources.'],
14	'strict-transport-security' => ['label' => 'Strict-Transport-Security', 'points' => 25, 'desc' => 'Forces HTTPS connections, preventing protocol downgrade attacks.'],
15	'x-frame-options' => ['label' => 'X-Frame-Options', 'points' => 15, 'desc' => 'Prevents clickjacking by controlling whether the page can be framed.'],
16	'x-content-type-options' => ['label' => 'X-Content-Type-Options', 'points' => 15, 'desc' => 'Stops MIME-type sniffing, forcing the declared Content-Type.'],
17	'referrer-policy' => ['label' => 'Referrer-Policy', 'points' => 10, 'desc' => 'Controls how much referrer information is sent with requests.'],
18	'permissions-policy' => ['label' => 'Permissions-Policy', 'points' => 5, 'desc' => 'Restricts which browser features the page can use (camera, mic, etc.).'],
19	];
20
21	public static function audit(string $url = ''): array {
22	if (!self::_pro()) return ['error' => 'Pro license required.'];
23	if (!$url) $url = get_site_url();
24
25	$response = wp_remote_head($url, [
26	'timeout' => 15,
27	'redirection'=> 5,
28	'sslverify' => false,
29	'user-agent' => 'phpinfo-WP-auditor/' . PHPINFOWP_VERSION,
30	]);
31
32	if (is_wp_error($response)) {
33	return ['error' => $response->get_error_message()];
34	}
35
36	$raw = wp_remote_retrieve_headers($response);
37	$status = wp_remote_retrieve_response_code($response);
38	$results = [];
39	$score = 0;
40
41	foreach (self::$headers as $key => $meta) {
42	$value = $raw[$key] ?? null;
43	$present = $value !== null;
44	if ($present) $score += $meta['points'];
45
46	$results[] = [
47	'key' => $key,
48	'label' => $meta['label'],
49	'points' => $meta['points'],
50	'desc' => $meta['desc'],
51	'present' => $present,
52	'value' => $present ? (string) $value : null,
53	'warning' => self::_warn($key, $present ? (string) $value : null),
54	];
55	}
56
57	return [
58	'url' => $url,
59	'status' => $status,
60	'results' => $results,
61	'score' => $score,
62	'grade' => self::_grade($score),
63	'cached' => false,
64	];
65	}
66
67	// Results are expensive (HTTP call) — cache per site for 1 hour
68	public static function get_cached(): array {
69	if (!self::_pro()) return ['error' => 'Pro license required.'];
70	$cached = get_transient('phpinfowp_sec_headers');
71	if ($cached !== false) {
72	$cached['cached'] = true;
73	return $cached;
74	}
75	$result = self::audit();
76	if (!isset($result['error'])) {
77	set_transient('phpinfowp_sec_headers', $result, HOUR_IN_SECONDS);
78	}
79	return $result;
80	}
81
82	public static function bust_cache(): void {
83	delete_transient('phpinfowp_sec_headers');
84	}
85
86	private static function _grade(int $score): string {
87	if ($score >= 95) return 'A+';
88	if ($score >= 80) return 'A';
89	if ($score >= 65) return 'B';
90	if ($score >= 50) return 'C';
91	if ($score >= 35) return 'D';
92	return 'F';
93	}
94
95	// Returns a short actionable warning if header is missing or misconfigured
96	private static function _warn(string $key, ?string $value): ?string {
97	if ($value === null) return 'Missing — add this header in your web server config or .htaccess.';
98
99	switch ($key) {
100	case 'strict-transport-security':
101	if (strpos($value, 'max-age') === false) return 'max-age directive is missing.';
102	preg_match('/max-age=(\d+)/', $value, $m);
103	if (isset($m[1]) && (int)$m[1] < 31536000) return 'max-age is below recommended 31536000 (1 year).';
104	break;
105	case 'x-frame-options':
106	$v = strtoupper($value);
107	if (!in_array($v, ['DENY', 'SAMEORIGIN'], true)) return 'Value should be DENY or SAMEORIGIN.';
108	break;
109	case 'x-content-type-options':
110	if (strtolower(trim($value)) !== 'nosniff') return 'Value must be exactly "nosniff".';
111	break;
112	}
113	return null;
114	}
115	}
116