| 1 |
<?php |
| 2 |
defined('ABSPATH') or die('Unauthorized Access'); |
| 3 |
|
| 4 |
if (!Phpinfo_WP_License::is_valid()) { |
| 5 |
phpinfowp_render_feature_lock([ |
| 6 |
'feature' => 'Security Headers Audit', |
| 7 |
'icon' => 'dashicons-shield', |
| 8 |
'tagline' => 'HTTP response header audit — graded against OWASP recommendations.', |
| 9 |
'previews' => [ |
| 10 |
'Grade: <strong>—</strong>', |
| 11 |
'Secure headers: <strong>— / —</strong>', |
| 12 |
'X-Frame-Options: <strong>—</strong>', |
| 13 |
'Content-Security-Policy: <strong>—</strong>', |
| 14 |
], |
| 15 |
]); |
| 16 |
return; |
| 17 |
} |
| 18 |
|
| 19 |
if (isset($_POST['phpinfowp_recheck']) && check_admin_referer('phpinfowp_sec_nonce')) { |
| 20 |
Phpinfo_WP_Security_Headers::bust_cache(); |
| 21 |
} |
| 22 |
|
| 23 |
$audit = Phpinfo_WP_Security_Headers::get_cached(); |
| 24 |
?> |
| 25 |
|
| 26 |
<div class="phpinfowp-pro-page"> |
| 27 |
|
| 28 |
<div class="phpinfowp-page-header"> |
| 29 |
<div> |
| 30 |
<h1>Security Headers <span class="phpinfowp-pro-badge"><?php _e('PRO', 'phpinfo-wp'); ?></span></h1> |
| 31 |
<p class="phpinfowp-page-subtitle"><?php _e('HTTP response header audit — graded against OWASP recommendations', 'phpinfo-wp'); ?></p> |
| 32 |
</div> |
| 33 |
<form method="post"> |
| 34 |
<?php wp_nonce_field('phpinfowp_sec_nonce'); ?> |
| 35 |
<input type="hidden" name="phpinfowp_recheck" value="1"> |
| 36 |
<button type="submit" class="button button-secondary"><?php _e('Re-check headers', 'phpinfo-wp'); ?></button> |
| 37 |
</form> |
| 38 |
</div> |
| 39 |
|
| 40 |
<?php if (isset($audit['error'])): ?> |
| 41 |
<div class="notice notice-error inline"> |
| 42 |
<p>Could not fetch headers: <strong><?php echo esc_html($audit['error']); ?></strong></p> |
| 43 |
</div> |
| 44 |
<?php else: ?> |
| 45 |
|
| 46 |
<!-- Score card --> |
| 47 |
<div class="phpinfowp-score-card"> |
| 48 |
<div class="phpinfowp-grade-circle grade-<?php echo esc_attr(strtolower(str_replace('+', 'plus', $audit['grade']))); ?>"> |
| 49 |
<?php echo esc_html($audit['grade']); ?> |
| 50 |
</div> |
| 51 |
<div class="phpinfowp-score-card-body"> |
| 52 |
<div class="phpinfowp-score-card-value"><?php echo esc_html($audit['score']); ?><span>/100</span></div> |
| 53 |
<div class="phpinfowp-score-card-meta"> |
| 54 |
<?php |
| 55 |
$passed = count(array_filter($audit['results'], function ($r) { |
| 56 |
return $r['present']; |
| 57 |
})); |
| 58 |
$total = count($audit['results']); |
| 59 |
$missing = $total - $passed; |
| 60 |
?> |
| 61 |
<span style="color:#00a32a"><strong><?php echo $passed; ?></strong> headers set</span> |
| 62 |
· |
| 63 |
<span style="color:<?php echo $missing ? '#d63638' : '#00a32a'; ?>"><strong><?php echo $missing; ?></strong> missing</span> |
| 64 |
· |
| 65 |
<code style="font-size:11px"><?php echo esc_html($audit['url']); ?></code> |
| 66 |
<?php if (!empty($audit['cached'])): ?> |
| 67 |
· <em style="color:#888"><?php _e('cached', 'phpinfo-wp'); ?></em> |
| 68 |
<?php endif; ?> |
| 69 |
</div> |
| 70 |
</div> |
| 71 |
</div> |
| 72 |
|
| 73 |
<!-- Header rows --> |
| 74 |
<div class="phpinfowp-sec-rows" style="margin-top:20px"> |
| 75 |
<?php foreach ($audit['results'] as $row): |
| 76 |
$present = $row['present']; |
| 77 |
$border = $present ? ($row['warning'] ? '#dba617' : '#00a32a') : '#d63638'; |
| 78 |
$bg = $present ? ($row['warning'] ? '#fffbf0' : '#f0faf2') : '#fff4f4'; |
| 79 |
?> |
| 80 |
<div class="phpinfowp-sec-row" style="border-left-color:<?php echo $border; ?>;background:<?php echo $bg; ?>"> |
| 81 |
<div class="phpinfowp-sec-row-icon"> |
| 82 |
<?php if ($present): ?> |
| 83 |
<span class="dashicons <?php echo $row['warning'] ? 'dashicons-warning' : 'dashicons-yes-alt'; ?>" |
| 84 |
style="color:<?php echo $row['warning'] ? '#dba617' : '#00a32a'; ?>"></span> |
| 85 |
<?php else: ?> |
| 86 |
<span class="dashicons dashicons-dismiss" style="color:#d63638"></span> |
| 87 |
<?php endif; ?> |
| 88 |
</div> |
| 89 |
<div class="phpinfowp-sec-row-body"> |
| 90 |
<div class="phpinfowp-sec-row-title"> |
| 91 |
<strong><?php echo esc_html($row['label']); ?></strong> |
| 92 |
<span class="phpinfowp-sec-row-points" style="color:<?php echo $present ? '#00a32a' : '#d63638'; ?>"> |
| 93 |
<?php echo $present ? '+' . esc_html($row['points']) : '0'; ?> pts |
| 94 |
</span> |
| 95 |
</div> |
| 96 |
<div class="phpinfowp-sec-row-desc"><?php echo esc_html($row['desc']); ?></div> |
| 97 |
<?php if ($row['value']): ?> |
| 98 |
<code class="phpinfowp-sec-row-value"><?php echo esc_html($row['value']); ?></code> |
| 99 |
<?php else: ?> |
| 100 |
<span class="phpinfowp-sec-row-missing"><?php _e('not set', 'phpinfo-wp'); ?></span> |
| 101 |
<?php endif; ?> |
| 102 |
<?php if ($row['warning']): ?> |
| 103 |
<div class="phpinfowp-sec-row-note" style="color:<?php echo $present ? '#996800' : '#d63638'; ?>"> |
| 104 |
<?php echo esc_html($row['warning']); ?> |
| 105 |
</div> |
| 106 |
<?php endif; ?> |
| 107 |
</div> |
| 108 |
</div> |
| 109 |
<?php endforeach; ?> |
| 110 |
</div> |
| 111 |
|
| 112 |
<p style="margin-top:16px;font-size:13px;color:#666"> |
| 113 |
<a href="https://owasp.org/www-project-secure-headers/" target="_blank"><?php _e('OWASP Secure Headers', 'phpinfo-wp'); ?></a> |
| 114 |
· |
| 115 |
<a href="<?php echo esc_url('https://securityheaders.com/?q=' . urlencode(get_site_url()) . '&followRedirects=on'); ?>" target="_blank">Verify on SecurityHeaders.com →</a> |
| 116 |
</p> |
| 117 |
|
| 118 |
<?php endif; ?> |
| 119 |
</div> |
| 120 |
|
