vigilante / includes / security-analyzer / class-sa-category-access.php

class-sa-category-access.php in Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 2.9.8, at includes/security-analyzer/class-sa-category-access.php

289 lines 11.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Security Analyzer — Access/Auth category (20 pts).
4	*
5	* Checks: wp_login_path (5), xmlrpc (5), wp_admin_direct (2),
6	* rest_users_me (2), login_rate_limit (3), two_factor_enabled (3).
7	*
8	* @package Vigilante
9	* @since 2.1.0
10	*/
11
12	// Prevent direct access.
13	if ( ! defined( 'ABSPATH' ) ) {
14	exit;
15	}
16
17	/**
18	* Authentication and access-control checks.
19	*/
20	class Vigilante_SA_Category_Access {
21
22	const SLUG = 'access';
23
24	/**
25	* @var Vigilante_Settings
26	*/
27	private $settings;
28
29	public function __construct( Vigilante_Settings $settings ) {
30	$this->settings = $settings;
31	}
32
33	/**
34	* Run the category.
35	*
36	* @param string $phase 'fast' \| 'slow' \| 'all'.
37	* @return Vigilante_SA_Check_Result[]
38	*/
39	public function run( $phase = 'all' ) {
40	$results = array();
41
42	if ( 'fast' === $phase \|\| 'all' === $phase ) {
43	$results[] = $this->check_custom_login_url();
44	$results[] = $this->check_xmlrpc_setting();
45	$results[] = $this->check_login_rate_limit();
46	$results[] = $this->check_two_factor_enabled();
47	}
48
49	if ( 'slow' === $phase \|\| 'all' === $phase ) {
50	$results[] = $this->check_wp_admin_direct();
51	$results[] = $this->check_rest_users_me();
52	}
53
54	return $results;
55	}
56
57	private function check_custom_login_url() {
58	$args = array(
59	'id' => 'wp_login_path',
60	'category' => self::SLUG,
61	'max' => 5,
62	'label' => __( 'Custom login URL', 'vigilante' ),
63	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'login', 'field-custom-login-url' ),
64	);
65
66	$url = trim( (string) $this->settings->get_option( 'login_security', 'custom_login_url', '' ) );
67	if ( '' === $url ) {
68	$args['detail'] = __( 'The login page is still the default /wp-login.php — a known bot target.', 'vigilante' );
69	return Vigilante_SA_Check_Result::fail( $args );
70	}
71
72	$args['detail'] = sprintf(
73	/* translators: %s: slug */
74	__( 'Custom login URL set to /%s. Remember to bookmark it.', 'vigilante' ),
75	$url
76	);
77	return Vigilante_SA_Check_Result::pass( $args );
78	}
79
80	private function check_xmlrpc_setting() {
81	$args = array(
82	'id' => 'xmlrpc',
83	'category' => self::SLUG,
84	'max' => 5,
85	'label' => __( 'XML-RPC status', 'vigilante' ),
86	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'wp-hardening', 'vigilante-section-hardening-xmlrpc' ),
87	);
88
89	// Read the setting through the module's own resolver rather than the raw
90	// option: XML-RPC is now a three-way choice, and sites upgrading from the
91	// old pair of checkboxes still store only those. Reading disable_xmlrpc
92	// directly made this check fail on sites whose XML-RPC was in fact fully
93	// blocked, which is the contradiction the /wp/v2/users/me check had.
94	$mode = 'none';
95	if ( class_exists( 'Vigilante_Comment_Security' ) ) {
96	$mode = Vigilante_Comment_Security::resolve_xmlrpc_mode( $this->settings );
97	} elseif ( $this->settings->get_option( 'login_security', 'disable_xmlrpc', 0 ) ) {
98	$mode = 'full';
99	}
100
101	$args['data'] = array( 'mode' => $mode );
102
103	if ( 'full' === $mode ) {
104	$args['detail'] = __( 'XML-RPC is fully disabled; brute-force and pingback amplification vectors closed.', 'vigilante' );
105	return Vigilante_SA_Check_Result::pass( $args );
106	}
107
108	if ( 'pingback' === $mode ) {
109	$args['detail'] = __( 'Pingback methods are blocked, which closes the amplification vector, and the rest of XML-RPC stays available for the mobile app or Jetpack.', 'vigilante' );
110	return Vigilante_SA_Check_Result::pass( $args );
111	}
112
113	$args['detail'] = __( 'XML-RPC is fully enabled. Under WP Hardening, disable it completely, or block at least the pingback methods if something still needs XML-RPC.', 'vigilante' );
114	return Vigilante_SA_Check_Result::fail( $args );
115	}
116
117	private function check_login_rate_limit() {
118	$args = array(
119	'id' => 'login_rate_limit',
120	'category' => self::SLUG,
121	'max' => 3,
122	'label' => __( 'Brute-force lockout threshold', 'vigilante' ),
123	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'login', 'field-max-attempts' ),
124	);
125
126	$max = (int) $this->settings->get_option( 'login_security', 'max_attempts', 0 );
127	$args['data'] = array( 'max_attempts' => $max );
128
129	if ( 0 === $max ) {
130	$args['detail'] = __( 'Login lockout is not configured. Any IP can try passwords without limit.', 'vigilante' );
131	return Vigilante_SA_Check_Result::fail( $args );
132	}
133	if ( $max > 10 ) {
134	$args['detail'] = sprintf(
135	/* translators: %d: configured attempts */
136	__( 'Lockout after %d attempts is too permissive. Lower it to 5 or fewer.', 'vigilante' ),
137	$max
138	);
139	return Vigilante_SA_Check_Result::warn( $args );
140	}
141	if ( $max > 5 ) {
142	$args['detail'] = sprintf(
143	/* translators: %d: configured attempts */
144	__( 'Lockout after %d attempts is acceptable but tighter is better.', 'vigilante' ),
145	$max
146	);
147	return Vigilante_SA_Check_Result::warn( $args );
148	}
149
150	$args['detail'] = sprintf(
151	/* translators: %d: configured attempts */
152	__( 'Lockout after %d failed attempts.', 'vigilante' ),
153	$max
154	);
155	return Vigilante_SA_Check_Result::pass( $args );
156	}
157
158	private function check_two_factor_enabled() {
159	$args = array(
160	'id' => 'two_factor_enabled',
161	'category' => self::SLUG,
162	'max' => 3,
163	'label' => __( 'Two-factor authentication status', 'vigilante' ),
164	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'login', 'vigilante-section-login-2fa' ),
165	);
166
167	$two_factor = $this->settings->get_option( 'login_security', 'two_factor', array() );
168	if ( ! empty( $two_factor['enabled'] ) ) {
169	$method = isset( $two_factor['method'] ) ? $two_factor['method'] : 'email';
170	$args['detail'] = sprintf(
171	/* translators: %s: 2FA method */
172	__( '2FA enabled globally using %s.', 'vigilante' ),
173	strtoupper( $method )
174	);
175	return Vigilante_SA_Check_Result::pass( $args );
176	}
177
178	$args['detail'] = __( 'Two-factor authentication is disabled. Enable it at least for administrators.', 'vigilante' );
179	return Vigilante_SA_Check_Result::fail( $args );
180	}
181
182	private function check_wp_admin_direct() {
183	$args = array(
184	'id' => 'wp_admin_direct',
185	'category' => self::SLUG,
186	'max' => 2,
187	'label' => __( '/wp-admin/ public access', 'vigilante' ),
188	'fix_link' => '',
189	);
190
191	$url = trailingslashit( admin_url() );
192	$response = Vigilante_SA_Helpers::get( $url, array( 'redirection' => 0 ) );
193
194	if ( is_wp_error( $response ) ) {
195	$args['detail'] = __( 'Could not probe /wp-admin/.', 'vigilante' );
196	return Vigilante_SA_Check_Result::skip( $args );
197	}
198
199	$code = (int) wp_remote_retrieve_response_code( $response );
200	$location = (string) wp_remote_retrieve_header( $response, 'location' );
201
202	// Anonymous access to /wp-admin/ is considered safe when it either
203	// redirects to a login page (typical) or is blocked/hidden (4xx).
204	// A 200 with an HTML body is the only truly bad outcome.
205	if ( in_array( $code, array( 301, 302, 303, 307, 308 ), true ) && $location ) {
206	$args['detail'] = __( '/wp-admin/ redirected anonymous visits to the login page.', 'vigilante' );
207	$args['data'] = array( 'code' => $code, 'location' => $location );
208	return Vigilante_SA_Check_Result::pass( $args );
209	}
210
211	// 4xx => camouflaged URL, firewall rule, or permission denied. All good.
212	if ( $code >= 400 && $code < 500 ) {
213	$args['detail'] = sprintf(
214	/* translators: %d: HTTP status code */
215	__( '/wp-admin/ returned %d to anonymous visitors.', 'vigilante' ),
216	$code
217	);
218	$args['data'] = array( 'code' => $code );
219	return Vigilante_SA_Check_Result::pass( $args );
220	}
221
222	if ( 200 === $code ) {
223	$args['detail'] = __( '/wp-admin/ returned 200 OK to an anonymous request. Verify nothing sensitive is exposed.', 'vigilante' );
224	$args['data'] = array( 'code' => $code );
225	return Vigilante_SA_Check_Result::fail( $args );
226	}
227
228	// 5xx or other weirdness — server issue, not a hardening problem on our side.
229	$args['detail'] = sprintf(
230	/* translators: %d: HTTP status code */
231	__( '/wp-admin/ responded with %d. This usually indicates a server error rather than a security issue.', 'vigilante' ),
232	$code
233	);
234	$args['data'] = array( 'code' => $code );
235	return Vigilante_SA_Check_Result::warn( $args );
236	}
237
238	private function check_rest_users_me() {
239	$args = array(
240	'id' => 'rest_users_me',
241	'category' => self::SLUG,
242	'max' => 2,
243	'label' => __( 'REST /wp/v2/users/me access', 'vigilante' ),
244	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'rest-api', 'vigilante-section-rest-api-main' ),
245	);
246
247	$url = rest_url( 'wp/v2/users/me' );
248	$response = Vigilante_SA_Helpers::get( $url, array( 'redirection' => 0 ) );
249
250	if ( is_wp_error( $response ) ) {
251	$args['detail'] = __( 'Could not probe /wp/v2/users/me.', 'vigilante' );
252	return Vigilante_SA_Check_Result::skip( $args );
253	}
254
255	$code = (int) wp_remote_retrieve_response_code( $response );
256	$body = (string) wp_remote_retrieve_body( $response );
257
258	if ( 401 === $code ) {
259	$args['detail'] = __( 'The endpoint returns 401 to unauthenticated requests.', 'vigilante' );
260	return Vigilante_SA_Check_Result::pass( $args );
261	}
262	if ( 403 === $code ) {
263	$args['detail'] = __( 'The endpoint returns 403 to unauthenticated requests.', 'vigilante' );
264	return Vigilante_SA_Check_Result::pass( $args );
265	}
266
267	// 404 with rest_no_route => Vigilant's own rest_endpoints filter removed
268	// the route, which is what "Block user enumeration" does by default. An
269	// unregistered route cannot answer 401, so demanding one made the check
270	// fail on a stock install and pushed users to disable a real protection
271	// to recover the points. Same treatment as the sibling /wp/v2/users check.
272	if ( 404 === $code ) {
273	if ( false !== strpos( $body, 'rest_no_route' ) ) {
274	$args['detail'] = __( 'The /wp/v2/users/me route is unregistered for anonymous clients.', 'vigilante' );
275	return Vigilante_SA_Check_Result::pass( $args );
276	}
277	$args['detail'] = __( 'The /wp/v2/users/me route returned 404 to the anonymous probe (likely a firewall rule).', 'vigilante' );
278	return Vigilante_SA_Check_Result::pass( $args );
279	}
280
281	$args['detail'] = sprintf(
282	/* translators: %d: HTTP status code */
283	__( '/wp/v2/users/me responded with %d — should be 401 for anonymous.', 'vigilante' ),
284	$code
285	);
286	return Vigilante_SA_Check_Result::fail( $args );
287	}
288	}
289