<?php
/**
 * Admin Class
 *
 * Handles admin interface and settings page
 *
 * @package Vigilante
 */

// Prevent direct access
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// Load AJAX trait
require_once VIGILANTE_ADMIN_DIR . 'class-admin-ajax.php';

// Load promotional banner class
require_once VIGILANTE_INCLUDES_DIR . 'class-ayudawp-promo-banner.php';

/**
 * Class Vigilante_Admin
 *
 * Manages the admin settings interface
 */
class Vigilante_Admin {

    use Vigilante_Admin_Ajax;
    use Vigilante_Admin_Analyzer_Ajax;
    use Vigilante_Admin_Audit_Alerts_Ajax;
    use Vigilante_Admin_Recovery_Ajax;

    /**
     * Settings instance
     *
     * @var Vigilante_Settings
     */
    private $settings;

    /**
     * Database instance
     *
     * @var Vigilante_Database
     */
    private $database;

    /**
     * Activity log instance
     *
     * @var Vigilante_Activity_Log
     */
    private $activity_log;

    /**
     * Current tab
     *
     * @var string
     */
    private $current_tab = 'dashboard';

    /**
     * Available tabs
     *
     * @var array
     */
    private $tabs = array();

    /**
     * Constructor
     *
     * @param Vigilante_Settings     $settings     Settings instance.
     * @param Vigilante_Database     $database     Database instance.
     * @param Vigilante_Activity_Log $activity_log Activity log instance.
     */
    public function __construct( $settings, $database, $activity_log ) {
        $this->settings     = $settings;
        $this->database     = $database;
        $this->activity_log = $activity_log;

        $this->setup_tabs();
        $this->init_hooks();
    }

    /**
     * Setup available tabs
     */
    private function setup_tabs() {
        $this->tabs = array(
            'dashboard'      => __( 'Dashboard', 'vigilante' ),
            'firewall'       => __( 'Firewall', 'vigilante' ),
            'headers'        => __( 'Security Headers', 'vigilante' ),
            'login'          => __( 'Login Security', 'vigilante' ),
            'rest-api'       => __( 'REST API', 'vigilante' ),
            'users'          => __( 'User Security', 'vigilante' ),
            'wp-hardening'   => __( 'WP Hardening', 'vigilante' ),
            'file-integrity' => __( 'File Integrity', 'vigilante' ),
            'activity-log'   => __( 'Security Audit', 'vigilante' ),
            'tools'          => __( 'Settings & Tools', 'vigilante' ),
        );
    }

    /**
     * Initialize hooks
     */
    private function init_hooks() {
        add_action( 'admin_menu', array( $this, 'add_menu' ) );
        add_action( 'admin_init', array( $this, 'redirect_submenu_shortcuts' ) );
        add_action( 'admin_init', array( $this, 'register_settings' ) );
        add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_assets' ) );
        add_action( 'admin_notices', array( $this, 'show_admin_notices' ) );

        // Highlight correct submenu based on active tab
        add_filter( 'submenu_file', array( $this, 'highlight_submenu_tab' ) );

        // Set browser tab title to show plugin name and active tab
        add_filter( 'admin_title', array( $this, 'set_admin_page_title' ), 10, 2 );

        // AJAX handlers
        add_action( 'wp_ajax_vigilante_save_settings', array( $this, 'ajax_save_settings' ) );
        add_action( 'wp_ajax_vigilante_apply_preset', array( $this, 'ajax_apply_preset' ) );
        add_action( 'wp_ajax_vigilante_reset_section', array( $this, 'ajax_reset_section' ) );
        add_action( 'wp_ajax_vigilante_clear_lockouts', array( $this, 'ajax_clear_lockouts' ) );
        add_action( 'wp_ajax_vigilante_clear_logs', array( $this, 'ajax_clear_logs' ) );
        add_action( 'wp_ajax_vigilante_run_scan', array( $this, 'ajax_run_scan' ) );
        add_action( 'wp_ajax_vigilante_clear_scan', array( $this, 'ajax_clear_scan' ) );
        add_action( 'wp_ajax_vigilante_ignore_file', array( $this, 'ajax_ignore_file' ) );
        add_action( 'wp_ajax_vigilante_unignore_file', array( $this, 'ajax_unignore_file' ) );
        add_action( 'wp_ajax_vigilante_bulk_ignore_files', array( $this, 'ajax_bulk_ignore_files' ) );
        add_action( 'wp_ajax_vigilante_bulk_unignore_files', array( $this, 'ajax_bulk_unignore_files' ) );
        add_action( 'wp_ajax_vigilante_clear_ignored', array( $this, 'ajax_clear_ignored' ) );
        add_action( 'wp_ajax_vigilante_ignore_closed_plugin', array( $this, 'ajax_ignore_closed_plugin' ) );
        add_action( 'wp_ajax_vigilante_unignore_closed_plugin', array( $this, 'ajax_unignore_closed_plugin' ) );
        add_action( 'wp_ajax_vigilante_clear_ignored_closed_plugins', array( $this, 'ajax_clear_ignored_closed_plugins' ) );
        add_action( 'wp_ajax_vigilante_approve_critical_file', array( $this, 'ajax_approve_critical_file' ) );
        add_action( 'wp_ajax_vigilante_export_settings', array( $this, 'ajax_export_settings' ) );
        add_action( 'wp_ajax_vigilante_import_settings', array( $this, 'ajax_import_settings' ) );
        add_action( 'wp_ajax_vigilante_get_logs', array( $this, 'ajax_get_logs' ) );
        add_action( 'wp_ajax_vigilante_test_headers', array( $this, 'ajax_test_headers' ) );
        add_action( 'wp_ajax_vigilante_download_files_backup', array( $this, 'ajax_download_files_backup' ) );
        
        // 2FA AJAX handlers
        add_action( 'wp_ajax_vigilante_search_users_2fa', array( $this, 'ajax_search_users_2fa' ) );
        add_action( 'wp_ajax_vigilante_send_2fa_notification', array( $this, 'ajax_send_2fa_notification' ) );
        add_action( 'wp_ajax_vigilante_search_totp_users', array( $this, 'ajax_search_totp_users' ) );
        add_action( 'wp_ajax_vigilante_reset_totp_users', array( $this, 'ajax_reset_totp_users' ) );
        add_action( 'wp_ajax_vigilante_totp_get_setup', array( $this, 'ajax_totp_get_setup' ) );
        add_action( 'wp_ajax_vigilante_notify_login_url', array( $this, 'ajax_notify_login_url' ) );

        // Password Reset AJAX handlers
        add_action( 'wp_ajax_vigilante_search_users_password_reset', array( $this, 'ajax_search_users_password_reset' ) );
        add_action( 'wp_ajax_vigilante_force_password_reset', array( $this, 'ajax_force_password_reset' ) );
        add_action( 'wp_ajax_vigilante_force_password_reset_all', array( $this, 'ajax_force_password_reset_all' ) );
        add_action( 'wp_ajax_vigilante_force_password_reset_by_role', array( $this, 'ajax_force_password_reset_by_role' ) );

        // User approval AJAX handlers
        add_action( 'wp_ajax_vigilante_approve_user', array( $this, 'ajax_approve_user' ) );
        add_action( 'wp_ajax_vigilante_reject_user', array( $this, 'ajax_reject_user' ) );

        // Session management AJAX handlers
        add_action( 'wp_ajax_vigilante_get_user_sessions', array( $this, 'ajax_get_user_sessions' ) );
        add_action( 'wp_ajax_vigilante_revoke_session', array( $this, 'ajax_revoke_session' ) );
        add_action( 'wp_ajax_vigilante_revoke_all_sessions', array( $this, 'ajax_revoke_all_sessions' ) );

        // Under Attack mode AJAX handlers
        add_action( 'wp_ajax_vigilante_activate_under_attack', array( $this, 'ajax_activate_under_attack' ) );
        add_action( 'wp_ajax_vigilante_deactivate_under_attack', array( $this, 'ajax_deactivate_under_attack' ) );
        add_action( 'wp_ajax_vigilante_under_attack_status', array( $this, 'ajax_under_attack_status' ) );

        // Database backup AJAX handlers
        add_action( 'wp_ajax_vigilante_get_db_tables', array( $this, 'ajax_get_db_tables' ) );
        add_action( 'wp_ajax_vigilante_download_db_backup', array( $this, 'ajax_download_db_backup' ) );

        // Database prefix AJAX handlers
        add_action( 'wp_ajax_vigilante_generate_prefix', array( $this, 'ajax_generate_prefix' ) );
        add_action( 'wp_ajax_vigilante_change_prefix', array( $this, 'ajax_change_prefix' ) );

        // Firewall list management from activity log popup
        add_action( 'wp_ajax_vigilante_add_to_firewall_list', array( $this, 'ajax_add_to_firewall_list' ) );
        add_action( 'wp_ajax_vigilante_unblock_firewall_ip', array( $this, 'ajax_unblock_firewall_ip' ) );

        // Security Analyzer AJAX handlers (v2.1.0)
        add_action( 'wp_ajax_vigilante_analyzer_run', array( $this, 'ajax_analyzer_run' ) );
        add_action( 'wp_ajax_vigilante_analyzer_history', array( $this, 'ajax_analyzer_history' ) );
        add_action( 'wp_ajax_vigilante_analyzer_dismiss_notice', array( $this, 'ajax_analyzer_dismiss_notice' ) );
        add_action( 'wp_ajax_vigilante_analyzer_save_settings', array( $this, 'ajax_analyzer_save_settings' ) );

        // Security Headers settings recovery (2.10.0)
        add_action( 'wp_ajax_vigilante_headers_recovery_restore', array( $this, 'ajax_headers_recovery_restore' ) );
        add_action( 'wp_ajax_vigilante_headers_recovery_undo', array( $this, 'ajax_headers_recovery_undo' ) );
        add_action( 'wp_ajax_vigilante_headers_recovery_dismiss', array( $this, 'ajax_headers_recovery_dismiss' ) );

        // Shared "Send test email" handler — Notification settings, File Integrity, Audit Alerts (v2.8.0)
        add_action( 'wp_ajax_vigilante_send_test_email', array( $this, 'ajax_send_test_email' ) );

        // Run migrations on admin load
        add_action( 'admin_init', array( $this, 'run_migrations' ) );
    }

    /**
     * Run database migrations based on stored version
     */
    public function run_migrations() {
        /*
         * admin-ajax.php fires admin_init before it decides who is asking
         * (wp-admin/admin-ajax.php:45), so until 2.11.10 an anonymous POST to
         * admin-ajax.php with any action ran every pending migration. That is
         * not a read: the migrations rewrite wp-config.php through
         * apply_security_constants(), rewrite the root .htaccess, move user meta
         * of the whole network and can rebuild the file integrity baseline,
         * taking whatever is on disk as approved. Reproduced on 12 sep 2026 with
         * curl and no cookies, and found by the file-by-file review of 2.11.10.
         *
         * Migrations are maintenance for whoever administers the site, so they
         * wait for an administrator to load a screen. Nothing is lost by
         * waiting: every migration is idempotent and version gated.
         */
        if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
            return;
        }

        $db_version = get_option( 'vigilante_db_version', '0' );

        // 1.2.3: Fix IP lists corrupted by sanitize_text_field stripping newlines
        if ( version_compare( $db_version, '1.2.3', '<' ) ) {
            $this->migrate_fix_ip_lists();
            update_option( 'vigilante_db_version', '1.2.3' );
        }

        // 1.3.0: Add request_method column to activity log table
        if ( version_compare( $db_version, '1.3.0', '<' ) ) {
            $this->database->run_migrations();
        }

        // 1.9.0: Re-apply wp-config constants (performance constants removed from managed list)
        if ( version_compare( $db_version, '1.9.0', '<' ) ) {
            if ( $this->settings->is_module_enabled( 'wp_hardening' ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-wpconfig-security.php';
                $wpconfig = new Vigilante_Wpconfig_Security( $this->settings );
                $wpconfig->apply_security_constants();
            }
            update_option( 'vigilante_db_version', '1.9.0' );
        }

        // 1.10.0: Clean up orphaned email fields (centralized notification recipients)
        if ( version_compare( $db_version, '1.10.0', '<' ) ) {
            $this->migrate_cleanup_email_fields();
            update_option( 'vigilante_db_version', '1.10.0' );
        }

        // 1.11.0: Remove stale 'enabled' key from activity_log settings
        // + Convert additional_recipients from string to array
        if ( version_compare( $db_version, '1.11.0', '<' ) ) {
            $options = get_option( Vigilante_Settings::OPTION_NAME, array() );
            $changed = false;

            if ( isset( $options['activity_log']['enabled'] ) ) {
                unset( $options['activity_log']['enabled'] );
                $changed = true;
            }

            // Convert corrupted string to array for additional_recipients
            if ( isset( $options['email']['additional_recipients'] ) && is_string( $options['email']['additional_recipients'] ) ) {
                $raw = trim( $options['email']['additional_recipients'] );
                if ( ! empty( $raw ) ) {
                    $emails = array_filter( array_map( 'trim', preg_split( '/[\r\n,; ]+/', $raw ) ) );
                    $options['email']['additional_recipients'] = array_values( array_filter( $emails, 'is_email' ) );
                } else {
                    $options['email']['additional_recipients'] = array();
                }
                $changed = true;
            }

            if ( $changed ) {
                update_option( Vigilante_Settings::OPTION_NAME, $options );
            }
            update_option( 'vigilante_db_version', '1.11.0' );
        }

        // 1.12.1: Regenerate htaccess (WooCommerce IPN exclusion in bot blocking rule)
        if ( version_compare( $db_version, '1.12.1', '<' ) ) {
            if ( ! empty( $this->settings->get_section( 'firewall' )['block_bad_bots'] ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-protection.php';
                $htaccess = new Vigilante_Htaccess_Protection( $this->settings );
                $htaccess->apply_rules();
            }
            update_option( 'vigilante_db_version', '1.12.1' );
        }

        // 1.14.0: Generate critical config files baseline (wp-config.php, .htaccess)
        if ( version_compare( $db_version, '1.14.0', '<' ) ) {
            if ( ! class_exists( 'Vigilante_File_Integrity' ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-file-integrity.php';
            }
            $fi = new Vigilante_File_Integrity( $this->settings, $this->database, $this->activity_log );

            /*
             * Only when there is nothing on record. This migration exists to
             * create the baseline that did not exist, never to discard the one
             * the owner approved: rebuilding it from the files takes whatever
             * is on disk right now as approved, so a wp-config.php modified and
             * awaiting review would be blessed in silence.
             *
             * And this is not theory. vigilante_db_version is written on two
             * different scales into the same option: this file counts in plugin
             * versions (2.11.0) and Vigilante_Database counts in schema
             * versions, currently 1.4.0 (class-database.php:322 and :380). For
             * version_compare, 1.4.0 is LOWER than 1.14.0, so any site whose
             * option was last written by the schema runs this migration again.
             * Measured on the Multisite install on 10 sep 2026: one of the three
             * sites was sitting on 1.4.0.
             */
            if ( ! $fi->get_critical_files_baseline() ) {
                $fi->regenerate_all_baselines();
            }

            update_option( 'vigilante_db_version', '1.14.0' );
        }

        // 2.0.0: Move hide_server_signature and remove_fingerprinting_headers
        // from firewall section to security_headers section
        if ( version_compare( $db_version, '2.0.0', '<' ) ) {
            $options = get_option( Vigilante_Settings::OPTION_NAME, array() );
            $changed = false;

            foreach ( array( 'hide_server_signature', 'remove_fingerprinting_headers' ) as $key ) {
                if ( isset( $options['firewall'][ $key ] ) ) {
                    if ( ! isset( $options['security_headers'][ $key ] ) ) {
                        $options['security_headers'][ $key ] = $options['firewall'][ $key ];
                    }
                    unset( $options['firewall'][ $key ] );
                    $changed = true;
                }
            }

            if ( $changed ) {
                update_option( Vigilante_Settings::OPTION_NAME, $options );
            }
            update_option( 'vigilante_db_version', '2.0.0' );
        }

        // 2.6.1: Two things happen here.
        //
        // 1. Re-apply wp-config constants so the block is rewritten with
        //    "if ( ! defined() )" guards around every define(). Without guards,
        //    non-standard setups that pre-define WordPress constants outside
        //    wp-config.php (custom bootstraps that load constants from .env or
        //    similar) hit a fatal "Constant already defined" when wp-config.php
        //    is parsed and reaches our block.
        //
        // 2. Drop the cached Security Check report. The cached "max" per
        //    category was frozen at scan time; with the internal category
        //    bumping from 22 to 28 points (closed_plugins added in 2.6.0),
        //    the cached report would keep displaying 22/22 until the next
        //    full scan. Clearing it forces a fresh scan with the new caps.
        if ( version_compare( $db_version, '2.6.1', '<' ) ) {
            if ( $this->settings->is_module_enabled( 'wp_hardening' ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-wpconfig-security.php';
                $wpconfig = new Vigilante_Wpconfig_Security( $this->settings );
                $wpconfig->apply_security_constants();
            }
            delete_option( 'vigilante_analyzer_last_scan' );

            // Schedule an immediate background scan so the dashboard widget
            // doesn't display "Last scan: never" right after the upgrade.
            // Reuses the same hook the post-Under-Attack flow uses.
            if ( ! wp_next_scheduled( 'vigilante_under_attack_post_scan' ) ) {
                wp_schedule_single_event( time() + 5, 'vigilante_under_attack_post_scan' );
            }

            update_option( 'vigilante_db_version', '2.6.1' );
        }

        // 2.9.3: Regenerate the .htaccess protection block. The bad-bots
        // User-Agent list dropped substring-prone tokens that 403'd
        // legitimate clients (e.g. "rma" matched inside "Performance" and
        // blocked WP Rocket's page fetch), and the blocking rules now honour
        // the firewall IP / User-Agent whitelists as negated exceptions.
        // Existing sites only rewrite the block when Server Protection is
        // saved, so the upgrade has to refresh it once itself (same pattern
        // as the 1.12.1 WooCommerce IPN migration).
        if ( version_compare( $db_version, '2.9.3', '<' ) ) {
            require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-protection.php';
            $htaccess = new Vigilante_Htaccess_Protection( $this->settings );

            if ( $htaccess->are_rules_active() ) {
                $htaccess->apply_rules();
            }

            update_option( 'vigilante_db_version', '2.9.3' );
        }

        /*
         * 2.9.8: the mixed content handling changes shape. "Upgrade Insecure
         * Requests" becomes a setting of its own, and Fix Mixed Content ships
         * off, where before it shipped on and carried the directive with it.
         * Both have to be written down for sites that are updating, so their
         * pages keep loading exactly what they loaded yesterday.
         *
         * Read the RAW stored options, not get_section(): that one merges the
         * defaults, so a site that never stored the key would be read with the
         * new default and silently lose the behaviour it had. Absent means the
         * site was running on the old default, which was on.
         */
        if ( version_compare( $db_version, '2.9.8', '<' ) ) {
            $raw     = get_option( Vigilante_Settings::OPTION_NAME, array() );
            $stored  = ( is_array( $raw ) && isset( $raw['security_headers'] ) && is_array( $raw['security_headers'] ) ) ? $raw['security_headers'] : array();
            $had_fix = array_key_exists( 'fix_mixed_content', $stored ) ? ! empty( $stored['fix_mixed_content'] ) : true;

            /*
             * Merge, never replace. update_section() overwrites the whole
             * section, so passing just these two keys wiped every other header
             * setting the site had stored (HSTS, CSP, cross-origin policies,
             * the HTTPS switches, Server Identity) and left the screen showing
             * factory defaults while the .htaccess kept serving the old values.
             */
            $this->settings->update_section(
                'security_headers',
                array_merge(
                    $stored,
                    array(
                        'fix_mixed_content'         => $had_fix,
                        'upgrade_insecure_requests' => $had_fix,
                    )
                )
            );

            update_option( 'vigilante_db_version', '2.9.8' );
        }

        /*
         * 2.9.9: drop the settings that no code has read for versions.
         *
         * They were carried in the defaults and therefore written into every
         * saved configuration, they show up in an exported configuration, and
         * anyone reading them assumes a feature exists behind them. Removing
         * them from the defaults is not enough: the stored copies survive, so
         * they are swept here too. Nothing reads them, so nothing changes.
         */
        if ( version_compare( $db_version, '2.9.9', '<' ) ) {
            $raw  = get_option( Vigilante_Settings::OPTION_NAME, array() );
            $dead = array(
                'firewall'       => array( 'country_blocking', 'protected_file_extensions' ),
                'file_integrity' => array( 'suspicious_patterns' ),
                'backup'         => array( 'auto_backup', 'backup_before_update' ),
                'advanced'       => array( 'block_author_archives', 'disable_embeds', 'uninstall_cleanup', 'debug_mode' ),
            );

            $changed = false;
            foreach ( $dead as $section => $keys ) {
                if ( ! isset( $raw[ $section ] ) || ! is_array( $raw[ $section ] ) ) {
                    continue;
                }
                foreach ( $keys as $key ) {
                    if ( array_key_exists( $key, $raw[ $section ] ) ) {
                        unset( $raw[ $section ][ $key ] );
                        $changed = true;
                    }
                }
            }

            if ( $changed ) {
                update_option( Vigilante_Settings::OPTION_NAME, $raw );
            }

            update_option( 'vigilante_db_version', '2.9.9' );
        }

        /*
         * 2.11.0: security release (audit of 28 Aug 2026). Runs here and not
         * from Vigilante_Database::needs_update(): this option is shared with
         * that class, and on any updated site it already holds a plugin version
         * (2.9.9 or later), so a bump of DB_VERSION would never fire.
         * create_tables() widens the email code column through dbDelta (varchar
         * 6 to 64, the code is stored hashed since 2.11.0) and purge_for_2_11_0()
         * does what dbDelta cannot: it empties the trusted devices, which were
         * identified by User-Agent until now (S1), and the pending email codes,
         * stored in clear until now (S11). Every remembered device asks for the
         * second factor once more after this update, and the changelog says so.
         */
        if ( version_compare( $db_version, '2.11.0', '<' ) ) {
            $this->database->create_tables();
            $this->database->purge_for_2_11_0();

            update_option( 'vigilante_db_version', '2.11.0' );
        }

        /*
         * 2.11.9: clear the raw .htaccess copies that older versions left in
         * options, on the first admin load after the update. Uninstall already
         * removes them, but that only fires when the plugin is deleted, so a
         * site that keeps the plugin carried them until now. Three stores, each
         * a copy of a file that can hold secrets (a SetEnv token, an
         * Authorization header): the same exposure the wp.org review flagged as
         * 4.4, on the paths its fix did not reach.
         *
         * - vigilante_htaccess_history: up to five raw copies, by design, until
         *   2.11.8. The writer is gone, nothing reads it, so it is deleted.
         * - vigilante_htaccess_backup: the single rollback buffer, normally
         *   cleared in the finally of each write; a copy only lingers if a write
         *   crashed mid-operation. Nothing outside one write reads it, so a
         *   leftover is deleted.
         * - vigilante_htaccess_pre_migration: still read by the header recovery,
         *   but older versions stored the whole file where only our own block is
         *   ever used. Truncated to that block, so the feature keeps working and
         *   nothing outside our markers stays in the option.
         */
        if ( version_compare( $db_version, '2.11.9', '<' ) ) {
            delete_option( 'vigilante_htaccess_history' );
            delete_option( 'vigilante_htaccess_backup' );

            $snapshot = get_option( 'vigilante_htaccess_pre_migration' );
            if ( is_array( $snapshot ) && isset( $snapshot['content'] ) && '' !== (string) $snapshot['content'] ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-recovery.php';
                $block = Vigilante_Htaccess_Recovery::get_raw_block();

                if ( '' === $block ) {
                    delete_option( 'vigilante_htaccess_pre_migration' );
                } elseif ( $block !== $snapshot['content'] ) {
                    $snapshot['content'] = $block;
                    update_option( 'vigilante_htaccess_pre_migration', $snapshot, false );
                }
            }

            update_option( 'vigilante_db_version', '2.11.9' );
        }

        /*
         * 2.11.10: the pending-approval flag becomes one per site on a network.
         * Until 2.11.9 it was a single global user meta, so the queue was shared
         * across the whole network. Moving the key is not enough: the accounts
         * already waiting carry the old key, and reading only the new one would
         * let them log in. So they are moved here, each to the site it belongs
         * to, and the old key is removed only once the new one is written.
         */
        if ( version_compare( $db_version, '2.11.10', '<' ) ) {
            $this->migrate_pending_approval_per_site();

            update_option( 'vigilante_db_version', '2.11.10' );
        }
    }

    /**
     * Move the pending-approval flag of a network to a key per site
     *
     * Runs once for the whole network, not once per site: the data it moves is
     * global, so the guard is a network option and any site may be the one that
     * does it. On a single site the key does not change and there is nothing to
     * do.
     *
     * Each waiting account goes to its primary site, or to the only site it
     * belongs to; one that belongs to none goes to the main site rather than
     * nowhere, because losing the flag would silently approve it.
     *
     * @since 2.11.10
     */
    private function migrate_pending_approval_per_site() {
        global $wpdb;

        if ( ! is_multisite() ) {
            return;
        }

        if ( get_site_option( 'vigilante_pending_per_site_done' ) ) {
            return;
        }

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- One-off migration of the plugin's own user meta; the meta API has no "list every user with this key".
        $user_ids = $wpdb->get_col(
            $wpdb->prepare( "SELECT DISTINCT user_id FROM {$wpdb->usermeta} WHERE meta_key = %s", 'vigilante_pending_approval' )
        );

        foreach ( (array) $user_ids as $user_id ) {
            $user_id = (int) $user_id;
            if ( ! $user_id ) {
                continue;
            }

            $pending = get_user_meta( $user_id, 'vigilante_pending_approval', true );
            $since   = get_user_meta( $user_id, 'vigilante_pending_since', true );

            /*
             * Every site the account belongs to, not its primary one. The global
             * flag does not say where the registration happened, and the first
             * version of this guessed the primary blog: an account that
             * registered on B while its primary was A came out pending on A and
             * free to log in on B, which is the very site it had never been
             * approved on. Found by the cross review of 2.11.10.
             *
             * Marking every site it belongs to fails closed instead: the account
             * stays blocked wherever it can log in, and shows up in the queue of
             * each of those sites so somebody can actually act on it. An account
             * that belongs to no site goes to the main one rather than nowhere,
             * because losing the flag would silently approve it.
             */
            /*
             * With $all true, because the default leaves out archived, spam and
             * deleted sites (wp-includes/user.php:1113-1117): a site archived on
             * the day this runs would lose the flag, and the account would walk
             * in unapproved the moment it was brought back. Found by the second
             * cross review of 2.11.10.
             */
            $blog_ids = array();

            foreach ( get_blogs_of_user( $user_id, true ) as $blog ) {
                if ( ! empty( $blog->userblog_id ) ) {
                    $blog_ids[] = (int) $blog->userblog_id;
                }
            }

            if ( empty( $blog_ids ) ) {
                $blog_ids[] = (int) get_main_site_id();
            }

            foreach ( array_unique( $blog_ids ) as $blog_id ) {
                $prefix = $wpdb->get_blog_prefix( $blog_id );

                update_user_meta( $user_id, $prefix . 'vigilante_pending_approval', $pending );
                if ( '' !== $since && false !== $since ) {
                    update_user_meta( $user_id, $prefix . 'vigilante_pending_since', $since );
                }
            }

            delete_user_meta( $user_id, 'vigilante_pending_approval' );
            delete_user_meta( $user_id, 'vigilante_pending_since' );
        }

        update_site_option( 'vigilante_pending_per_site_done', 1 );
    }

    /**
     * Migration: Remove orphaned email fields from saved options
     *
     * v1.10.0 centralized notification recipients into email section.
     * Old per-module notify_email fields and dead email section fields
     * are removed to avoid confusion.
     */
    private function migrate_cleanup_email_fields() {
        $options = get_option( Vigilante_Settings::OPTION_NAME, array() );
        $modified = false;

        // Remove orphaned fields from email section
        $dead_email_keys = array( 'enabled', 'from_name', 'from_email', 'admin_email', 'send_activation_email', 'custom_email' );
        if ( isset( $options['email'] ) && is_array( $options['email'] ) ) {
            foreach ( $dead_email_keys as $key ) {
                if ( array_key_exists( $key, $options['email'] ) ) {
                    unset( $options['email'][ $key ] );
                    $modified = true;
                }
            }
            // Ensure new fields exist with defaults
            if ( ! array_key_exists( 'send_to_admin_email', $options['email'] ) ) {
                $options['email']['send_to_admin_email'] = true;
                $modified = true;
            }
            if ( ! array_key_exists( 'additional_recipients', $options['email'] ) ) {
                $options['email']['additional_recipients'] = '';
                $modified = true;
            }
        }

        // Remove notify_email from login_security
        if ( isset( $options['login_security']['notify_email'] ) ) {
            unset( $options['login_security']['notify_email'] );
            $modified = true;
        }

        // Remove notify_email from file_integrity
        if ( isset( $options['file_integrity']['notify_email'] ) ) {
            unset( $options['file_integrity']['notify_email'] );
            $modified = true;
        }

        if ( $modified ) {
            update_option( Vigilante_Settings::OPTION_NAME, $options );
            // Clear settings cache so the plugin uses clean data immediately
            $this->settings->clear_cache();
        }
    }

    /**
     * Migration: Fix IP whitelist/blacklist entries merged into single line
     *
     * Prior to 1.2.3, sanitize_text_field() stripped newlines from textarea data,
     * causing multiple IPs to be stored as a single space-separated string.
     */
    private function migrate_fix_ip_lists() {
        $options = get_option( Vigilante_Settings::OPTION_NAME, array() );
        $fixed   = false;

        foreach ( array( 'ip_whitelist', 'ip_blacklist' ) as $key ) {
            if ( ! empty( $options['firewall'][ $key ] ) && is_array( $options['firewall'][ $key ] ) ) {
                $new_list = array();
                foreach ( $options['firewall'][ $key ] as $entry ) {
                    // Split entries that were joined by spaces
                    $parts = preg_split( '/\s+/', trim( $entry ) );
                    foreach ( $parts as $part ) {
                        $part = trim( $part );
                        if ( '' !== $part ) {
                            $new_list[] = $part;
                        }
                    }
                }
                if ( count( $new_list ) !== count( $options['firewall'][ $key ] ) ) {
                    $options['firewall'][ $key ] = array_unique( $new_list );
                    $fixed = true;
                }
            }
        }

        if ( $fixed ) {
            update_option( Vigilante_Settings::OPTION_NAME, $options );
            // Clear settings cache so changes take effect immediately
            $this->settings->clear_cache();
        }
    }

    /**
     * Add admin menu page in last position
     */
    public function add_menu() {
        $menu_title = __( 'Vigilant', 'vigilante' );
        
        // Count pending approvals (separate concern, always red if present)
        $pending_count = $this->get_pending_approvals_count();
        
        // Get security issues with severity
        $security_status = $this->get_security_status_for_badge();
        
        // Total count for badge
        $total_badge = $pending_count + $security_status['count'];
        
        if ( $total_badge > 0 ) {
            // Determine badge color:
            // - Red (awaiting-mod): pending approvals OR critical modules disabled
            // - Orange (update-plugins): only non-critical modules disabled
            if ( $pending_count > 0 || $security_status['has_critical'] ) {
                $badge_class = 'awaiting-mod';
            } else {
                $badge_class = 'update-plugins vigilante-badge-warning';
            }
            
            $menu_title .= sprintf(
                ' <span class="%s count-%d"><span class="pending-count">%d</span></span>',
                esc_attr( $badge_class ),
                $total_badge,
                $total_badge
            );
        }

        add_menu_page(
            __( 'Vigilant', 'vigilante' ),
            $menu_title,
            'manage_options',
            'vigilante',
            array( $this, 'render_settings_page' ),
            'dashicons-shield',
            999
        );

        // Rename auto-generated first submenu to "Dashboard"
        add_submenu_page(
            'vigilante',
            __( 'Dashboard', 'vigilante' ),
            __( 'Dashboard', 'vigilante' ),
            'manage_options',
            'vigilante',
            array( $this, 'render_settings_page' )
        );

        // Security Audit shortcut
        add_submenu_page(
            'vigilante',
            __( 'Security Audit', 'vigilante' ),
            __( 'Security Audit', 'vigilante' ),
            'manage_options',
            'vigilante-activity-log',
            array( $this, 'redirect_to_tab' )
        );

        // File Integrity shortcut
        add_submenu_page(
            'vigilante',
            __( 'File Integrity', 'vigilante' ),
            __( 'File Integrity', 'vigilante' ),
            'manage_options',
            'vigilante-file-integrity',
            array( $this, 'redirect_to_tab' )
        );
    }

    /**
     * Redirect submenu shortcuts early, before headers are sent
     */
    public function redirect_submenu_shortcuts() {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Just reading page slug for redirect
        $page = isset( $_GET['page'] ) ? sanitize_key( $_GET['page'] ) : '';

        $tab_map = array(
            'vigilante-activity-log'   => 'activity-log',
            'vigilante-file-integrity' => 'file-integrity',
        );

        if ( isset( $tab_map[ $page ] ) ) {
            wp_safe_redirect( admin_url( 'admin.php?page=vigilante&tab=' . $tab_map[ $page ] ) );
            exit;
        }
    }

    /**
     * Fallback redirect for submenu shortcuts (JS-based)
     */
    public function redirect_to_tab() {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Just reading page slug for redirect
        $page = isset( $_GET['page'] ) ? sanitize_key( $_GET['page'] ) : '';

        $tab_map = array(
            'vigilante-activity-log'   => 'activity-log',
            'vigilante-file-integrity' => 'file-integrity',
        );

        if ( isset( $tab_map[ $page ] ) ) {
            $url = admin_url( 'admin.php?page=vigilante&tab=' . $tab_map[ $page ] );
            echo '<script>window.location.replace(' . wp_json_encode( esc_url( $url ) ) . ');</script>';
        }
    }

    /**
     * Highlight the correct submenu item based on active tab
     *
     * @param string $submenu_file Current submenu file.
     * @return string
     */
    public function highlight_submenu_tab( $submenu_file ) {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading tab for menu highlight only
        $page = isset( $_GET['page'] ) ? sanitize_key( $_GET['page'] ) : '';
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
        $tab  = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : '';

        if ( 'vigilante' !== $page || empty( $tab ) ) {
            return $submenu_file;
        }

        $tab_to_submenu = array(
            'activity-log'   => 'vigilante-activity-log',
            'file-integrity' => 'vigilante-file-integrity',
        );

        if ( isset( $tab_to_submenu[ $tab ] ) ) {
            return $tab_to_submenu[ $tab ];
        }

        return $submenu_file;
    }

    /**
     * Set browser tab title to show plugin name and active tab
     *
     * Changes "Dashboard ‹ Site Name — WordPress" to
     * "Vigilant > Dashboard ‹ Site Name — WordPress"
     *
     * @param string $admin_title Full admin title.
     * @param string $title       Page title from add_menu_page/add_submenu_page.
     * @return string Modified title.
     */
    public function set_admin_page_title( $admin_title, $title ) {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading page slug for title only
        $page = isset( $_GET['page'] ) ? sanitize_key( $_GET['page'] ) : '';

        // Only modify on Vigilante pages
        if ( 0 !== strpos( $page, 'vigilante' ) ) {
            return $admin_title;
        }

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
        $tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'dashboard';

        if ( isset( $this->tabs[ $tab ] ) ) {
            $tab_label = $this->tabs[ $tab ];
        } else {
            $tab_label = __( 'Dashboard', 'vigilante' );
        }

        $plugin_title = __( 'Vigilant', 'vigilante' ) . ' &rsaquo; ' . $tab_label;

        // Replace the original page title portion
        return str_replace( $title, $plugin_title, $admin_title );
    }

    /**
     * Get count of users pending approval
     *
     * @return int Count of pending users.
     */
    private function get_pending_approvals_count() {
        // Prevent early execution before WordPress is ready
        if ( ! did_action( 'plugins_loaded' ) ) {
            return 0;
        }
        
        /*
         * Counted whether the feature is on or off. An account already waiting
         * stays blocked when it is switched off (see init_enforcement_hooks()),
         * so reporting zero there hid people who cannot log in and whom nobody
         * could see to approve. Found by the cross review of 2.11.10.
         */

        // phpcs:disable WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- Limited results in admin context.
        $args = array(
            'meta_key'   => Vigilante_User_Security::site_user_meta_key( 'vigilante_pending_approval' ),
            'meta_value' => '1',
            'fields'     => 'ID',
        );
        // phpcs:enable WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value

        // Same query as Vigilante_User_Security::get_pending_users(), and for the
        // same reason: the meta key already scopes this to the site, and adding
        // core's membership filter on top hid the accounts that have no role yet.
        if ( is_multisite() ) {
            $args['blog_id'] = 0;
        }

        $pending_users = get_users( $args );

        return count( $pending_users );
    }

    /**
     * Calculate comprehensive security score (0-100)
     *
     * @param array $options Plugin options.
     * @return int Security score.
     */
    private function calculate_security_score( $options ) {
        $score = 0;
        $max_score = 0;

        // Module scores (60 points total)
        $module_weights = array(
            'firewall'          => 10,
            'security_headers'  => 8,
            'login_security'    => 10,
            'rest_api_security' => 6,
            'user_security'     => 8,
            'wp_hardening'      => 8,
            'file_integrity'    => 5,
            'activity_log'      => 5,
        );

        foreach ( $module_weights as $module => $weight ) {
            $max_score += $weight;
            if ( ! empty( $options['modules'][ $module ] ) ) {
                $score += $weight;
            }
        }

        // Firewall details (10 points)
        if ( ! empty( $options['modules']['firewall'] ) ) {
            $firewall = $options['firewall'] ?? array();
            $max_score += 10;
            
            $firewall_checks = array(
                'block_sql_injection',
                'block_xss_attacks',
                'block_bad_query_strings',
                'block_file_inclusion',
                'block_directory_traversal',
            );
            
            $firewall_enabled = 0;
            foreach ( $firewall_checks as $check ) {
                if ( ! empty( $firewall[ $check ] ) ) {
                    $firewall_enabled++;
                }
            }
            $score += min( 10, $firewall_enabled * 2 );
        }

        // Login security details (10 points)
        if ( ! empty( $options['modules']['login_security'] ) ) {
            $login = $options['login_security'] ?? array();
            $max_score += 10;
            
            // Max attempts configured
            if ( isset( $login['max_attempts'] ) && $login['max_attempts'] <= 5 ) {
                $score += 3;
            }
            // XML-RPC disabled
            if ( ! empty( $login['disable_xmlrpc'] ) ) {
                $score += 3;
            }
            // 2FA enabled
            if ( ! empty( $login['two_factor']['enabled'] ) ) {
                $score += 4;
            }
        }

        // Security headers details (10 points)
        if ( ! empty( $options['modules']['security_headers'] ) ) {
            $headers = $options['security_headers'] ?? array();
            $max_score += 10;
            
            if ( ! empty( $headers['x_frame_options'] ) ) {
                $score += 2;
            }
            if ( ! empty( $headers['x_content_type_options'] ) ) {
                $score += 2;
            }
            if ( ! empty( $headers['hsts']['enabled'] ) ) {
                $score += 3;
            }
            if ( ! empty( $headers['csp']['enabled'] ) ) {
                $score += 3;
            }
        }

        // User security details (10 points)
        if ( ! empty( $options['modules']['user_security'] ) ) {
            $user = $options['user_security'] ?? array();
            $max_score += 10;
            
            if ( ! empty( $user['block_insecure_usernames'] ) ) {
                $score += 3;
            }
            if ( ! empty( $user['force_strong_passwords'] ) ) {
                $score += 3;
            }
            if ( ! empty( $user['password_expiration']['enabled'] ) ) {
                $score += 2;
            }
            if ( ! empty( $user['email_verification']['enabled'] ) ) {
                $score += 2;
            }
        }

        // Audit alerts details (6 points) - only when Security Audit is on,
        // because the alerting layer rides on top of the activity log. Leaving
        // both alert legs off keeps these points unearned.
        if ( ! empty( $options['modules']['activity_log'] ) ) {
            $alerts = isset( $options['audit_alerts'] ) ? (array) $options['audit_alerts'] : array();
            $max_score += 6;
            if ( Vigilante_Audit_Alerts::immediate_is_active( $alerts ) ) {
                $score += 3;
            }
            if ( Vigilante_Audit_Alerts::threshold_is_active( $alerts ) ) {
                $score += 3;
            }
        }

        // Environment checks (8 points) - penalize insecure server configuration
        $max_score += 8;
        $env_score = 8;

        // WP_DEBUG active in production is a security risk (exposes paths, errors)
        if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
            $env_score -= 5;
        }

        // Accounts with insecure usernames (targeted by brute force attacks)
        $insecure_admins = $this->get_insecure_admin_usernames();
        if ( ! empty( $insecure_admins ) ) {
            $env_score -= 3;
        }

        $score += max( 0, $env_score );

        return $max_score > 0 ? round( ( $score / $max_score ) * 100 ) : 0;
    }

    /**
     * Get security recommendations based on current settings
     *
     * @param array $options Plugin options.
     * @return array Array of recommendations.
     */
    private function get_security_recommendations( $options ) {
        $recommendations = array();

        // Critical: Firewall disabled
        if ( empty( $options['modules']['firewall'] ) ) {
            $recommendations[] = array(
                'icon'     => 'warning',
                'priority' => 'critical',
                'message'  => __( 'Enable Firewall to protect against common attacks.', 'vigilante' ),
            );
        }

        // Critical: Login security disabled
        if ( empty( $options['modules']['login_security'] ) ) {
            $recommendations[] = array(
                'icon'     => 'warning',
                'priority' => 'critical',
                'message'  => __( 'Enable Login Security to prevent brute force attacks.', 'vigilante' ),
            );
        }

        // High: Security headers disabled
        if ( empty( $options['modules']['security_headers'] ) ) {
            $recommendations[] = array(
                'icon'     => 'admin-generic',
                'priority' => 'high',
                'message'  => __( 'Enable Security Headers to protect against clickjacking and XSS.', 'vigilante' ),
            );
        }

        // High: User security disabled
        if ( empty( $options['modules']['user_security'] ) ) {
            $recommendations[] = array(
                'icon'     => 'admin-users',
                'priority' => 'high',
                'message'  => __( 'Enable User Security to enforce password policies and username protection.', 'vigilante' ),
            );
        }

        // High: 2FA not enabled (only if login security is active)
        $login = $options['login_security'] ?? array();
        if ( ! empty( $options['modules']['login_security'] ) && empty( $login['two_factor']['enabled'] ) ) {
            $recommendations[] = array(
                'icon'     => 'shield',
                'priority' => 'high',
                'message'  => __( 'Enable Two-Factor Authentication for enhanced login security.', 'vigilante' ),
                'tab'      => 'login',
            );
        }

        // Medium: REST API security disabled
        if ( empty( $options['modules']['rest_api_security'] ) ) {
            $recommendations[] = array(
                'icon'     => 'rest-api',
                'priority' => 'medium',
                'message'  => __( 'Enable REST API Security to control API access and prevent enumeration.', 'vigilante' ),
            );
        }

        // Medium: WP Hardening disabled
        if ( empty( $options['modules']['wp_hardening'] ) ) {
            $recommendations[] = array(
                'icon'     => 'lock',
                'priority' => 'medium',
                'message'  => __( 'Enable WP Hardening to remove version info and protect core files.', 'vigilante' ),
            );
        }

        // Medium: File integrity disabled
        if ( empty( $options['modules']['file_integrity'] ) ) {
            $recommendations[] = array(
                'icon'     => 'media-text',
                'priority' => 'medium',
                'message'  => __( 'Enable File Integrity to detect unauthorized file changes.', 'vigilante' ),
            );
        }

        // Medium: Security Audit disabled
        if ( empty( $options['modules']['activity_log'] ) ) {
            $recommendations[] = array(
                'icon'     => 'list-view',
                'priority' => 'medium',
                'message'  => __( 'Enable Security Audit to track security events.', 'vigilante' ),
            );
        }

        // Low: XML-RPC enabled (only if login security is active)
        if ( ! empty( $options['modules']['login_security'] ) && empty( $login['disable_xmlrpc'] ) ) {
            $recommendations[] = array(
                'icon'     => 'info',
                'priority' => 'low',
                'message'  => __( 'Disable XML-RPC if not needed (reduces attack surface).', 'vigilante' ),
                'tab'      => 'login',
            );
        }

        // Low: Strong passwords not enforced (only if user security is active)
        $user = $options['user_security'] ?? array();
        if ( ! empty( $options['modules']['user_security'] ) && empty( $user['force_strong_passwords'] ) ) {
            $recommendations[] = array(
                'icon'     => 'admin-users',
                'priority' => 'low',
                'message'  => __( 'Enforce strong passwords for all users.', 'vigilante' ),
                'tab'      => 'users',
            );
        }

        // High: WP_DEBUG active in production (regardless of Vigilante settings)
        if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
            $recommendations[] = array(
                'icon'     => 'warning',
                'priority' => 'high',
                'message'  => __( 'WP_DEBUG is active. Debug mode exposes sensitive information and should be disabled in production.', 'vigilante' ),
                'tab'      => 'wp-hardening',
            );
        }

        // Low: Users with display name matching login username (only if user security active)
        if ( ! empty( $options['modules']['user_security'] ) ) {
            $exposed_users = $this->get_users_with_exposed_login();
            if ( ! empty( $exposed_users ) ) {
                $recommendations[] = array(
                    'icon'     => 'admin-users',
                    'priority' => 'low',
                    'message'  => sprintf(
                        /* translators: %s: Comma-separated list of usernames */
                        __( 'These users have their login username as display name (publicly visible): %s', 'vigilante' ),
                        implode( ', ', $exposed_users )
                    ),
                    'tab'      => 'users',
                );
            }
        }

        // High: Accounts with insecure usernames (regardless of module status)
        $insecure_admins = $this->get_insecure_admin_usernames();
        if ( ! empty( $insecure_admins ) ) {
            $recommendations[] = array(
                'icon'     => 'warning',
                'priority' => 'high',
                'message'  => sprintf(
                    /* translators: %s: Comma-separated list of usernames */
                    __( 'Insecure usernames detected: %s. These are commonly targeted in brute force attacks. Create new accounts with unique usernames and remove these.', 'vigilante' ),
                    implode( ', ', $insecure_admins )
                ),
            );
        }

        // Critical: Closed or removed plugins detected by the daily check.
        // Reads from the cached state map populated by Vigilante_Plugin_Status, so
        // there is no extra HTTP call here. Ignored slugs are filtered out so the
        // recommendation respects the user's per-slug Ignore decisions.
        if ( ! empty( $options['modules']['file_integrity'] ) && ! empty( $options['file_integrity']['check_closed_plugins'] ) ) {
            if ( ! class_exists( 'Vigilante_Plugin_Status' ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-plugin-status.php';
            }
            $closed_checker = new Vigilante_Plugin_Status( $this->settings, $this->activity_log );
            $closed_active  = $closed_checker->get_closed_plugins();
            if ( ! empty( $closed_active ) ) {
                $names = array();
                foreach ( $closed_active as $slug => $entry ) {
                    $names[] = isset( $entry['name'] ) ? $entry['name'] : $slug;
                }
                $recommendations[] = array(
                    'icon'     => 'warning',
                    'priority' => 'critical',
                    'message'  => sprintf(
                        /* translators: 1: count, 2: comma-separated plugin names */
                        _n(
                            '%1$d closed plugin detected on this site: %2$s. Closures in WordPress.org usually indicate malware, security issues or supply chain compromises. Uninstall and replace as soon as possible.',
                            '%1$d closed plugins detected on this site: %2$s. Closures in WordPress.org usually indicate malware, security issues or supply chain compromises. Uninstall and replace as soon as possible.',
                            count( $closed_active ),
                            'vigilante'
                        ),
                        count( $closed_active ),
                        implode( ', ', $names )
                    ),
                    'tab'      => 'file-integrity',
                );
            }
        }

        // Medium: Security Audit is on but no audit alert is configured. The
        // alerting layer only makes sense while the activity log is running.
        if ( ! empty( $options['modules']['activity_log'] ) ) {
            $alerts = isset( $options['audit_alerts'] ) ? (array) $options['audit_alerts'] : array();
            if ( ! Vigilante_Audit_Alerts::has_active_alerts( $alerts ) ) {
                $recommendations[] = array(
                    'icon'     => 'email-alt',
                    'priority' => 'medium',
                    'message'  => __( 'Set up Audit Alerts to get an email when something important happens (a new admin, a closed plugin, or an attack in progress).', 'vigilante' ),
                    'tab'      => 'activity-log',
                );
            }
        }

        // Sort by priority
        $priority_order = array( 'critical' => 0, 'high' => 1, 'medium' => 2, 'low' => 3 );
        usort( $recommendations, function( $a, $b ) use ( $priority_order ) {
            return ( $priority_order[ $a['priority'] ] ?? 99 ) - ( $priority_order[ $b['priority'] ] ?? 99 );
        } );

        return $recommendations;
    }

    /**
     * Get users whose display name matches their login username
     *
     * Limited to administrators and editors for performance and relevance.
     * Cached with transient to avoid repeated queries on every dashboard load.
     *
     * @return array Array of usernames with exposed login.
     */
    private function get_users_with_exposed_login() {
        $cache_key = 'vigilante_exposed_display_names';
        $cached = get_transient( $cache_key );

        if ( false !== $cached ) {
            return $cached;
        }

        $exposed = array();
        $users = get_users( array(
            'role__in' => array( 'administrator', 'editor' ),
            'fields'   => array( 'ID', 'user_login', 'display_name' ),
        ) );

        foreach ( $users as $user ) {
            if ( strcasecmp( $user->display_name, $user->user_login ) === 0 ) {
                $exposed[] = $user->user_login;
            }
        }

        // Cache for 12 hours
        set_transient( $cache_key, $exposed, 12 * HOUR_IN_SECONDS );

        return $exposed;
    }

    /**
     * Get accounts with insecure usernames
     *
     * Checks for common default usernames that are targeted by brute force attacks.
     * Detects any user regardless of role (consistent with username creation blocking).
     * Uses WordPress object cache via get_user_by() so no transient needed.
     *
     * @return array Array of insecure usernames found.
     */
    private function get_insecure_admin_usernames() {
        $priority_usernames = array( 'admin', 'administrator', 'root', 'test', 'user', 'guest', 'info', 'sysadmin', 'webmaster' );
        $found = array();

        foreach ( $priority_usernames as $username ) {
            $user = get_user_by( 'login', $username );
            if ( $user ) {
                $found[] = $username;
            }
        }

        return $found;
    }

    /**
     * Get security status for menu badge
     * 
     * Returns count of disabled modules and whether there are critical issues.
     * Critical = Firewall or Login Security disabled.
     *
     * @return array Array with 'count' and 'has_critical'.
     */
    public function get_security_status_for_badge() {
        $options = $this->settings->get_all_options();
        $modules = $options['modules'] ?? array();
        
        // Count disabled modules
        $disabled_count = 0;
        $has_critical = false;
        
        // Critical modules - if disabled, badge is red
        $critical_modules = array( 'firewall', 'login_security' );
        
        foreach ( $modules as $module => $enabled ) {
            // Handle both boolean and string values ('1', '0', true, false)
            $is_enabled = filter_var( $enabled, FILTER_VALIDATE_BOOLEAN );
            
            if ( ! $is_enabled ) {
                $disabled_count++;
                
                // Check if this is a critical module
                if ( in_array( $module, $critical_modules, true ) ) {
                    $has_critical = true;
                }
            }
        }
        
        return array(
            'count'        => $disabled_count,
            'has_critical' => $has_critical,
        );
    }

    /**
     * Get count of security issues for menu badge (deprecated, use get_security_status_for_badge)
     *
     * @return int Count of critical/high issues.
     */
    public function get_security_issues_count() {
        $status = $this->get_security_status_for_badge();
        return $status['count'];
    }

    /**
     * Register settings
     */
    public function register_settings() {
        register_setting(
            'vigilante_options',
            Vigilante_Settings::OPTION_NAME,
            array( $this->settings, 'validate_options' )
        );
    }

    /**
     * Index behind the settings search box.
     *
     * Each entry points at one settings row. The search matches on the label,
     * on its English original and on 'keywords', which are extra terms someone
     * might type instead of the label itself.
     *
     * Those keywords are wrapped in _x() with the context "settings search
     * keywords" so every locale can supply its own: the source strings are in
     * English, and a Spanish user typing "contrasena" or a German one typing
     * "Kennwort" only reaches the password settings if that locale translated
     * them. Translators can add, drop or replace terms freely, one per space;
     * they are never displayed, only matched against what the user types.
     *
     * The list is maintained by hand, so a new settings row needs an entry here
     * or it cannot be found. It had drifted to 68 of 131 rows before 2.9.7.
     *
     * @return array
     */
    private function get_search_index() {
        return array(
            // Firewall - Main
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Block bad bots', 'vigilante' ), 'label_en' => 'Block bad bots', 'keywords' => _x( 'block bad bots blocking blocked deny malicious harmful bot crawler crawlers spider scraper robots', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Block malicious requests', 'vigilante' ), 'label_en' => 'Block malicious requests', 'keywords' => _x( 'block malicious requests blocking blocked deny attack attacks exploit injection sqli xss rfi lfi request traffic', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Rate limiting', 'vigilante' ), 'label_en' => 'Rate limiting', 'keywords' => _x( 'rate limiting throttle flood burst limit limits', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Brute force protection', 'vigilante' ), 'label_en' => 'Brute force protection', 'keywords' => _x( 'brute force protection bruteforce login', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'IP Whitelist', 'vigilante' ), 'label_en' => 'IP Whitelist', 'keywords' => _x( 'ip whitelist ips address addresses cidr ipv4 ipv6 allowlist allowed trusted', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'IP Blacklist', 'vigilante' ), 'label_en' => 'IP Blacklist', 'keywords' => _x( 'ip blacklist ips address addresses cidr ipv4 ipv6 blocklist denylist banned', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'User-Agent Whitelist', 'vigilante' ), 'label_en' => 'User-Agent Whitelist', 'keywords' => _x( 'user-agent whitelist ua useragent browser allowlist allowed trusted user', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'User-Agent Blacklist', 'vigilante' ), 'label_en' => 'User-Agent Blacklist', 'keywords' => _x( 'user-agent blacklist ua useragent browser blocklist denylist banned user', 'settings search keywords', 'vigilante' ) ),
            // Firewall - Server Protection
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-server', 'label' => __( 'Directory Browsing', 'vigilante' ), 'label_en' => 'Directory Browsing', 'keywords' => _x( 'directory browsing folder folders listing indexing index', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-server', 'label' => __( 'Protect wp-config.php', 'vigilante' ), 'label_en' => 'Protect wp-config.php', 'keywords' => _x( 'protect wp-config php protection secure lock', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'field-protect-wp-cron', 'label' => __( 'Protect wp-cron.php', 'vigilante' ), 'label_en' => 'Protect wp-cron.php', 'keywords' => _x( 'protect wp-cron php protection secure lock cron scheduled tasks block spam', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-server', 'label' => __( 'Protect wp-includes', 'vigilante' ), 'label_en' => 'Protect wp-includes', 'keywords' => _x( 'protect wp-includes protection secure lock', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-server', 'label' => __( 'PHP in Uploads', 'vigilante' ), 'label_en' => 'PHP in Uploads', 'keywords' => _x( 'php in uploads media upload', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-server', 'label' => __( 'Sensitive Files', 'vigilante' ), 'label_en' => 'Sensitive Files', 'keywords' => _x( 'sensitive files private secret file log', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Server Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-server', 'label' => __( 'Limit HTTP Methods', 'vigilante' ), 'label_en' => 'Limit HTTP Methods', 'keywords' => _x( 'limit http methods', 'settings search keywords', 'vigilante' ) ),
            // Security Headers
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'X-Frame-Options', 'vigilante' ), 'label_en' => 'X-Frame-Options', 'keywords' => _x( 'x-frame-options headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'X-Content-Type-Options', 'vigilante' ), 'label_en' => 'X-Content-Type-Options', 'keywords' => _x( 'x-content-type-options content headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Referrer-Policy', 'vigilante' ), 'label_en' => 'Referrer-Policy', 'keywords' => _x( 'referrer-policy headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'HSTS', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'HSTS', 'vigilante' ), 'label_en' => 'HSTS', 'keywords' => _x( 'hsts strict transport security ssl tls https headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Content Security Policy', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Content Security Policy', 'vigilante' ), 'label_en' => 'Content Security Policy', 'keywords' => _x( 'content security policy csp xss headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Server Identity', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Server Signature', 'vigilante' ), 'label_en' => 'Server Signature', 'keywords' => _x( 'server signature fingerprint banner', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Server Identity', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Remove Fingerprinting Headers', 'vigilante' ), 'label_en' => 'Remove Fingerprinting Headers', 'keywords' => _x( 'remove fingerprinting headers fingerprint banner header http', 'settings search keywords', 'vigilante' ) ),
            // Security Headers - Cross-Origin Policies
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Cross-Origin Policies', 'vigilante' ), 'anchor' => 'vigilante-section-headers-cross-origin', 'label' => __( 'Cross-Origin-Opener-Policy (COOP)', 'vigilante' ), 'label_en' => 'Cross-Origin-Opener-Policy (COOP)', 'keywords' => _x( 'coop cross-origin opener policy popup popups window opener tag assistant google isolation browsing context headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Cross-Origin Policies', 'vigilante' ), 'anchor' => 'vigilante-section-headers-cross-origin', 'label' => __( 'Cross-Origin-Embedder-Policy (COEP)', 'vigilante' ), 'label_en' => 'Cross-Origin-Embedder-Policy (COEP)', 'keywords' => _x( 'coep cross-origin embedder policy require-corp credentialless embed embeds iframe fonts headers', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Cross-Origin Policies', 'vigilante' ), 'anchor' => 'vigilante-section-headers-cross-origin', 'label' => __( 'Cross-Origin-Resource-Policy (CORP)', 'vigilante' ), 'label_en' => 'Cross-Origin-Resource-Policy (CORP)', 'keywords' => _x( 'corp cross-origin resource policy hotlink hotlinking cdn images assets headers', 'settings search keywords', 'vigilante' ) ),
            // Login Security
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Custom login URL', 'vigilante' ), 'label_en' => 'Custom login URL', 'keywords' => _x( 'custom login url signin log-in access slug', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Two-Factor Authentication', 'vigilante' ), 'label_en' => 'Two-Factor Authentication', 'keywords' => _x( 'two-factor authentication 2fa mfa otp totp authenticator', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( '2FA', 'vigilante' ), 'label_en' => '2FA', 'keywords' => _x( '2fa two-factor mfa otp totp authenticator', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Failed login attempts', 'vigilante' ), 'label_en' => 'Failed login attempts', 'keywords' => _x( 'failed login attempts signin log-in access tries retries', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Lockout', 'vigilante' ), 'label_en' => 'Lockout', 'keywords' => _x( 'lockout lock ban block login', 'settings search keywords', 'vigilante' ) ),
            // REST API
            array( 'tab' => 'rest-api', 'tab_label' => __( 'REST API', 'vigilante' ), 'section' => __( 'REST API Security', 'vigilante' ), 'anchor' => 'vigilante-section-rest-api-main', 'label' => __( 'Access Mode', 'vigilante' ), 'label_en' => 'Access Mode', 'keywords' => _x( 'access mode rest api', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'rest-api', 'tab_label' => __( 'REST API', 'vigilante' ), 'section' => __( 'REST API Security', 'vigilante' ), 'anchor' => 'vigilante-section-rest-api-main', 'label' => __( 'Block User Enumeration', 'vigilante' ), 'label_en' => 'Block User Enumeration', 'keywords' => _x( 'block user enumeration blocking blocked deny users account author slug', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'rest-api', 'tab_label' => __( 'REST API', 'vigilante' ), 'section' => __( 'REST API Security', 'vigilante' ), 'anchor' => 'vigilante-section-rest-api-main', 'label' => __( 'Disable JSONP', 'vigilante' ), 'label_en' => 'Disable JSONP', 'keywords' => _x( 'disable jsonp', 'settings search keywords', 'vigilante' ) ),
            // User Security
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Username protection', 'vigilante' ), 'label_en' => 'Username protection', 'keywords' => _x( 'username protection admin', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Password strength', 'vigilante' ), 'label_en' => 'Password strength', 'keywords' => _x( 'password strength passwords credentials', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Admin monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-users-admin-monitoring', 'label' => __( 'Admin monitoring', 'vigilante' ), 'label_en' => 'Admin monitoring', 'keywords' => _x( 'admin monitoring administrator administrators', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Registration approval', 'vigilante' ), 'anchor' => 'vigilante-section-users-registration', 'label' => __( 'Registration approval', 'vigilante' ), 'label_en' => 'Registration approval', 'keywords' => _x( 'registration approval signup register approve moderate', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Session limits', 'vigilante' ), 'anchor' => 'vigilante-section-users-sessions', 'label' => __( 'Session limits', 'vigilante' ), 'label_en' => 'Session limits', 'keywords' => _x( 'session limits sessions concurrent', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Password expiration', 'vigilante' ), 'label_en' => 'Password expiration', 'keywords' => _x( 'password expiration passwords credentials expiry expire caducity', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Email verification', 'vigilante' ), 'anchor' => 'vigilante-section-users-email-verify', 'label' => __( 'Email verification', 'vigilante' ), 'label_en' => 'Email verification', 'keywords' => _x( 'email verification mail notification notify verify confirm', 'settings search keywords', 'vigilante' ) ),
            // WP Hardening
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Database Hardening', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-database', 'label' => __( 'Database Hardening', 'vigilante' ), 'label_en' => 'Database Hardening', 'keywords' => _x( 'database hardening db mysql tables', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Database Hardening', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-database', 'label' => __( 'Database prefix', 'vigilante' ), 'label_en' => 'Database prefix', 'keywords' => _x( 'database prefix db mysql tables table', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-wpconfig', 'label' => __( 'Disable file editing', 'vigilante' ), 'label_en' => 'Disable file editing', 'keywords' => _x( 'disable file editing files editor edit', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-wpconfig', 'label' => __( 'Disable plugin/theme installation', 'vigilante' ), 'label_en' => 'Disable plugin/theme installation', 'keywords' => _x( 'disable plugin theme installation install', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-wpconfig', 'label' => __( 'Force SSL admin', 'vigilante' ), 'label_en' => 'Force SSL admin', 'keywords' => _x( 'force ssl admin bruteforce administrator administrators tls https', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'field-disable-wp-cron', 'label' => __( 'Disable WP Cron', 'vigilante' ), 'label_en' => 'Disable WP Cron', 'keywords' => _x( 'disable wp cron scheduled tasks wp-cron', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Comment Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-comments', 'label' => __( 'Comment Security', 'vigilante' ), 'label_en' => 'Comment Security', 'keywords' => _x( 'comment security comments spam honeypot url', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Header Cleanup', 'vigilante' ), 'label_en' => 'Header Cleanup', 'keywords' => _x( 'header cleanup headers http meta generator rsd wlwmanifest', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Remove WordPress version', 'vigilante' ), 'label_en' => 'Remove WordPress version', 'keywords' => _x( 'remove wordpress version generator meta', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'field-remove-wp-version-assets', 'label' => __( 'Remove version from assets', 'vigilante' ), 'label_en' => 'Remove version from assets', 'keywords' => _x( 'remove version from assets', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-xmlrpc', 'label' => __( 'Disable XML-RPC', 'vigilante' ), 'label_en' => 'Disable XML-RPC', 'keywords' => _x( 'disable xml-rpc xmlrpc rpc remote jetpack app pingback trackback', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'RSS Feed Settings', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-rss', 'label' => __( 'RSS Feed Settings', 'vigilante' ), 'label_en' => 'RSS Feed Settings', 'keywords' => _x( 'rss feed settings feeds atom', 'settings search keywords', 'vigilante' ) ),
            // File Integrity
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'File Integrity Monitoring', 'vigilante' ), 'label_en' => 'File Integrity Monitoring', 'keywords' => _x( 'file integrity monitoring files checksum checksums tamper', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Scan schedule', 'vigilante' ), 'label_en' => 'Scan schedule', 'keywords' => _x( 'scan schedule scans scanning check cron', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Instant alert', 'vigilante' ), 'label_en' => 'Instant alert', 'keywords' => _x( 'instant alert alerts notification warning email', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'Ignored Files', 'vigilante' ), 'anchor' => 'vigilante-section-fi-ignored', 'label' => __( 'Ignored Files', 'vigilante' ), 'label_en' => 'Ignored Files', 'keywords' => _x( 'ignored files file exclude', 'settings search keywords', 'vigilante' ) ),
            // Security Audit
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Security Audit Settings', 'vigilante' ), 'anchor' => 'vigilante-section-audit-settings', 'label' => __( 'Retention', 'vigilante' ), 'label_en' => 'Retention', 'keywords' => _x( 'retention keep days storage log', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Security Audit Settings', 'vigilante' ), 'anchor' => 'vigilante-section-audit-settings', 'label' => __( 'Events to Log', 'vigilante' ), 'label_en' => 'Events to Log', 'keywords' => _x( 'events to log', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Security Audit Settings', 'vigilante' ), 'anchor' => 'vigilante-section-audit-settings', 'label' => __( 'Option Tracking', 'vigilante' ), 'label_en' => 'Option Tracking', 'keywords' => _x( 'option tracking', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Security Audit Settings', 'vigilante' ), 'anchor' => 'vigilante-section-audit-settings', 'label' => __( 'Exclusions', 'vigilante' ), 'label_en' => 'Exclusions', 'keywords' => _x( 'exclusions roles ip', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'vigilante-section-audit-alerts', 'label' => __( 'Audit Alerts', 'vigilante' ), 'label_en' => 'Audit Alerts', 'keywords' => _x( 'audit alerts email mail warning critical', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'field-audit-alerts-immediate', 'label' => __( 'Immediate alerts', 'vigilante' ), 'label_en' => 'Immediate alerts', 'keywords' => _x( 'immediate alerts email mail critical warning', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'field-audit-alerts-threshold', 'label' => __( 'Threshold alerts', 'vigilante' ), 'label_en' => 'Threshold alerts', 'keywords' => _x( 'threshold alerts email mail login', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Recent Activity', 'vigilante' ), 'anchor' => 'vigilante-section-audit-recent', 'label' => __( 'Recent Activity', 'vigilante' ), 'label_en' => 'Recent Activity', 'keywords' => _x( 'recent activity log', 'settings search keywords', 'vigilante' ) ),
            // Settings & Tools
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Notification settings', 'vigilante' ), 'anchor' => 'vigilante-section-tools-notifications', 'label' => __( 'Notification settings', 'vigilante' ), 'label_en' => 'Notification settings', 'keywords' => _x( 'notification settings email', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Notification settings', 'vigilante' ), 'anchor' => 'vigilante-section-tools-notifications', 'label' => __( 'Additional Recipients', 'vigilante' ), 'label_en' => 'Additional Recipients', 'keywords' => _x( 'additional recipients email recipient', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Tools', 'vigilante' ), 'anchor' => 'vigilante-section-tools-main', 'label' => __( 'Export Settings', 'vigilante' ), 'label_en' => 'Export Settings', 'keywords' => _x( 'export settings json', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Tools', 'vigilante' ), 'anchor' => 'vigilante-section-tools-main', 'label' => __( 'Import Settings', 'vigilante' ), 'label_en' => 'Import Settings', 'keywords' => _x( 'import settings json', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Tools', 'vigilante' ), 'anchor' => 'vigilante-section-tools-main', 'label' => __( 'Reset to Defaults', 'vigilante' ), 'label_en' => 'Reset to Defaults', 'keywords' => _x( 'reset to defaults', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Tools', 'vigilante' ), 'anchor' => 'vigilante-section-tools-main', 'label' => __( 'Create Backup', 'vigilante' ), 'label_en' => 'Create Backup', 'keywords' => _x( 'create backup', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Tools', 'vigilante' ), 'anchor' => 'vigilante-section-tools-main', 'label' => __( 'Database Backup', 'vigilante' ), 'label_en' => 'Database Backup', 'keywords' => _x( 'database backup db mysql tables', 'settings search keywords', 'vigilante' ) ),
            // Entradas anadidas en la 2.9.7 tras comprobar que el indice cubria 68 de
            // las 131 filas de ajustes: buscar XML-RPC, por ejemplo, no devolvia nada.
            // El indice se mantiene a mano, asi que al anadir una fila de ajustes hay
            // que anadirla tambien aqui.
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Notification settings', 'vigilante' ), 'anchor' => 'vigilante-section-tools-notifications', 'label' => __( 'WordPress Admin Email', 'vigilante' ), 'label_en' => 'WordPress Admin Email', 'keywords' => _x( 'wordpress admin email administrator administrators mail notification notify', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'tools', 'tab_label' => __( 'Settings & Tools', 'vigilante' ), 'section' => __( 'Notification settings', 'vigilante' ), 'anchor' => 'vigilante-section-tools-notifications', 'label' => __( 'Plugin Deactivation', 'vigilante' ), 'label_en' => 'Plugin Deactivation', 'keywords' => _x( 'plugin deactivation', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Block Bad Query Strings', 'vigilante' ), 'label_en' => 'Block Bad Query Strings', 'keywords' => _x( 'block bad query strings blocking blocked deny malicious harmful', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'SQL Injection Protection', 'vigilante' ), 'label_en' => 'SQL Injection Protection', 'keywords' => _x( 'sql injection protection', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'XSS Protection', 'vigilante' ), 'label_en' => 'XSS Protection', 'keywords' => _x( 'xss protection', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'File Inclusion Protection', 'vigilante' ), 'label_en' => 'File Inclusion Protection', 'keywords' => _x( 'file inclusion protection files', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Directory Traversal Protection', 'vigilante' ), 'label_en' => 'Directory Traversal Protection', 'keywords' => _x( 'directory traversal protection folder folders', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Enable Rate Limiting', 'vigilante' ), 'label_en' => 'Enable Rate Limiting', 'keywords' => _x( 'enable rate limiting throttle flood burst limit limits', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Requests per Minute', 'vigilante' ), 'label_en' => 'Requests per Minute', 'keywords' => _x( 'requests per minute request traffic', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Block Duration (seconds)', 'vigilante' ), 'label_en' => 'Block Duration (seconds)', 'keywords' => _x( 'block duration seconds blocking blocked deny', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Progressive Blocking', 'vigilante' ), 'label_en' => 'Progressive Blocking', 'keywords' => _x( 'progressive blocking', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Maximum Block Duration', 'vigilante' ), 'label_en' => 'Maximum Block Duration', 'keywords' => _x( 'maximum block duration blocking blocked deny', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'firewall', 'tab_label' => __( 'Firewall', 'vigilante' ), 'section' => __( 'Firewall Protection', 'vigilante' ), 'anchor' => 'vigilante-section-firewall-main', 'label' => __( 'Visitor IP detection', 'vigilante' ), 'label_en' => 'Visitor IP detection', 'keywords' => _x( 'visitor ip detection ips address addresses cidr ipv4 ipv6', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Max Login Attempts', 'vigilante' ), 'label_en' => 'Max Login Attempts', 'keywords' => _x( 'max login attempts signin log-in access tries retries', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Lockout Duration', 'vigilante' ), 'label_en' => 'Lockout Duration', 'keywords' => _x( 'lockout duration lock ban block', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Progressive Lockout', 'vigilante' ), 'label_en' => 'Progressive Lockout', 'keywords' => _x( 'progressive lockout lock ban block', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Hide Login Errors', 'vigilante' ), 'label_en' => 'Hide Login Errors', 'keywords' => _x( 'hide login errors signin log-in access error debug log', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Disable Application Passwords', 'vigilante' ), 'label_en' => 'Disable Application Passwords', 'keywords' => _x( 'disable application passwords password credentials', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Login URL Slug', 'vigilante' ), 'label_en' => 'Login URL Slug', 'keywords' => _x( 'login url slug signin log-in access path', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Notify users', 'vigilante' ), 'label_en' => 'Notify users', 'keywords' => _x( 'notify users notification alert email user accounts', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Notify on Lockout', 'vigilante' ), 'label_en' => 'Notify on Lockout', 'keywords' => _x( 'notify on lockout notification alert email lock ban block', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Notify on Admin Login', 'vigilante' ), 'label_en' => 'Notify on Admin Login', 'keywords' => _x( 'notify on admin login notification alert email administrator administrators signin log-in access', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Current settings', 'vigilante' ), 'label_en' => 'Current settings', 'keywords' => _x( 'current settings', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Blocked IPs', 'vigilante' ), 'label_en' => 'Blocked IPs', 'keywords' => _x( 'blocked ips', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Enable 2FA', 'vigilante' ), 'label_en' => 'Enable 2FA', 'keywords' => _x( 'enable 2fa two-factor mfa otp totp authenticator', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Verification method', 'vigilante' ), 'label_en' => 'Verification method', 'keywords' => _x( 'verification method verify confirm', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Enforce for roles', 'vigilante' ), 'label_en' => 'Enforce for roles', 'keywords' => _x( 'enforce for roles role capabilities', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Exclude specific users', 'vigilante' ), 'label_en' => 'Exclude specific users', 'keywords' => _x( 'exclude specific users user accounts', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Remember device', 'vigilante' ), 'label_en' => 'Remember device', 'keywords' => _x( 'remember device', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Grace period', 'vigilante' ), 'label_en' => 'Grace period', 'keywords' => _x( 'grace period', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Email sender name', 'vigilante' ), 'label_en' => 'Email sender name', 'keywords' => _x( 'email sender name mail notification notify names', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Reset user TOTP', 'vigilante' ), 'label_en' => 'Reset user TOTP', 'keywords' => _x( 'reset user totp users account 2fa authenticator app', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'login', 'tab_label' => __( 'Login Security', 'vigilante' ), 'section' => __( 'Login Protection Status', 'vigilante' ), 'anchor' => 'vigilante-section-login-main', 'label' => __( 'Notify on enable', 'vigilante' ), 'label_en' => 'Notify on enable', 'keywords' => _x( 'notify on enable notification alert email', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Enable CSP', 'vigilante' ), 'label_en' => 'Enable CSP', 'keywords' => _x( 'enable csp content security policy', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Report Only Mode', 'vigilante' ), 'label_en' => 'Report Only Mode', 'keywords' => _x( 'report only mode', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Redirect HTTP to HTTPS', 'vigilante' ), 'label_en' => 'Redirect HTTP to HTTPS', 'keywords' => _x( 'redirect http to https redirection forward ssl tls secure', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Fix Mixed Content', 'vigilante' ), 'label_en' => 'Fix Mixed Content', 'keywords' => _x( 'fix mixed content insecure http', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'field-upgrade-insecure-requests', 'label' => __( 'Upgrade Insecure Requests', 'vigilante' ), 'label_en' => 'Upgrade Insecure Requests', 'keywords' => _x( 'upgrade insecure requests mixed content csp https external resources', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Rewrite Site Address on Activation', 'vigilante' ), 'label_en' => 'Rewrite Site Address on Activation', 'keywords' => _x( 'rewrite site address on activation', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Enable HSTS', 'vigilante' ), 'label_en' => 'Enable HSTS', 'keywords' => _x( 'enable hsts strict transport security', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Max Age', 'vigilante' ), 'label_en' => 'Max Age', 'keywords' => _x( 'max age', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'headers', 'tab_label' => __( 'Security Headers', 'vigilante' ), 'section' => __( 'Security Headers', 'vigilante' ), 'anchor' => 'vigilante-section-headers-main', 'label' => __( 'Include Subdomains', 'vigilante' ), 'label_en' => 'Include Subdomains', 'keywords' => _x( 'include subdomains', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Block Insecure Usernames', 'vigilante' ), 'label_en' => 'Block Insecure Usernames', 'keywords' => _x( 'block insecure usernames blocking blocked deny weak unsafe', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Enforce Strong Passwords', 'vigilante' ), 'label_en' => 'Enforce Strong Passwords', 'keywords' => _x( 'enforce strong passwords complexity password credentials', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Minimum Password Length', 'vigilante' ), 'label_en' => 'Minimum Password Length', 'keywords' => _x( 'minimum password length passwords credentials characters', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Password Requirements', 'vigilante' ), 'label_en' => 'Password Requirements', 'keywords' => _x( 'password requirements passwords credentials', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Apply Password Rules To', 'vigilante' ), 'label_en' => 'Apply Password Rules To', 'keywords' => _x( 'apply password rules to passwords credentials', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Block Author Scanning', 'vigilante' ), 'label_en' => 'Block Author Scanning', 'keywords' => _x( 'block author scanning blocking blocked deny authors enumeration probing', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Username & password protection', 'vigilante' ), 'anchor' => 'vigilante-section-users-password', 'label' => __( 'Display Name Protection', 'vigilante' ), 'label_en' => 'Display Name Protection', 'keywords' => _x( 'display name protection public visible names', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Admin monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-users-admin-monitoring', 'label' => __( 'New Administrator Alert', 'vigilante' ), 'label_en' => 'New Administrator Alert', 'keywords' => _x( 'new administrator alert alerts notification warning', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Admin monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-users-admin-monitoring', 'label' => __( 'Admin Email Change Alert', 'vigilante' ), 'label_en' => 'Admin Email Change Alert', 'keywords' => _x( 'admin email change alert administrator administrators mail notification notify alerts warning', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Admin monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-users-admin-monitoring', 'label' => __( 'Permission Elevation Alert', 'vigilante' ), 'label_en' => 'Permission Elevation Alert', 'keywords' => _x( 'permission elevation alert alerts notification warning', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Admin monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-users-admin-monitoring', 'label' => __( 'Admin Password Change Alert', 'vigilante' ), 'label_en' => 'Admin Password Change Alert', 'keywords' => _x( 'admin password change alert administrator administrators passwords credentials alerts notification warning', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Registration approval', 'vigilante' ), 'anchor' => 'vigilante-section-users-registration', 'label' => __( 'Enable Registration Approval', 'vigilante' ), 'label_en' => 'Enable Registration Approval', 'keywords' => _x( 'enable registration approval signup register approve moderate', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Registration approval', 'vigilante' ), 'anchor' => 'vigilante-section-users-registration', 'label' => __( 'Notify Admin', 'vigilante' ), 'label_en' => 'Notify Admin', 'keywords' => _x( 'notify admin notification alert email administrator administrators', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Registration approval', 'vigilante' ), 'anchor' => 'vigilante-section-users-registration', 'label' => __( 'Auto-reject After', 'vigilante' ), 'label_en' => 'Auto-reject After', 'keywords' => _x( 'auto-reject after', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Session limits', 'vigilante' ), 'anchor' => 'vigilante-section-users-sessions', 'label' => __( 'Enable Session Limits', 'vigilante' ), 'label_en' => 'Enable Session Limits', 'keywords' => _x( 'enable session limits sessions concurrent', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Session limits', 'vigilante' ), 'anchor' => 'vigilante-section-users-sessions', 'label' => __( 'Maximum Sessions', 'vigilante' ), 'label_en' => 'Maximum Sessions', 'keywords' => _x( 'maximum sessions session concurrent', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Session limits', 'vigilante' ), 'anchor' => 'vigilante-section-users-sessions', 'label' => __( 'When Limit Exceeded', 'vigilante' ), 'label_en' => 'When Limit Exceeded', 'keywords' => _x( 'when limit exceeded', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Session limits', 'vigilante' ), 'anchor' => 'vigilante-section-users-sessions', 'label' => __( 'Exclude Administrators', 'vigilante' ), 'label_en' => 'Exclude Administrators', 'keywords' => _x( 'exclude administrators', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Enable Password Expiration', 'vigilante' ), 'label_en' => 'Enable Password Expiration', 'keywords' => _x( 'enable password expiration passwords credentials expiry expire caducity', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Expire After', 'vigilante' ), 'label_en' => 'Expire After', 'keywords' => _x( 'expire after', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Warning Period', 'vigilante' ), 'label_en' => 'Warning Period', 'keywords' => _x( 'warning period', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Password History', 'vigilante' ), 'label_en' => 'Password History', 'keywords' => _x( 'password history passwords credentials reuse previous', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Email Reminder', 'vigilante' ), 'label_en' => 'Email Reminder', 'keywords' => _x( 'email reminder mail notification notify', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Affected Roles', 'vigilante' ), 'label_en' => 'Affected Roles', 'keywords' => _x( 'affected roles role capabilities', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Password expiration', 'vigilante' ), 'anchor' => 'vigilante-section-users-password-exp', 'label' => __( 'Exclude specific users', 'vigilante' ), 'label_en' => 'Exclude specific users', 'keywords' => _x( 'exclude specific users user accounts', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Email verification', 'vigilante' ), 'anchor' => 'vigilante-section-users-email-verify', 'label' => __( 'Enable Email Verification', 'vigilante' ), 'label_en' => 'Enable Email Verification', 'keywords' => _x( 'enable email verification mail notification notify verify confirm', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Email verification', 'vigilante' ), 'anchor' => 'vigilante-section-users-email-verify', 'label' => __( 'Link Expiration', 'vigilante' ), 'label_en' => 'Link Expiration', 'keywords' => _x( 'link expiration expiry expire caducity', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Email verification', 'vigilante' ), 'anchor' => 'vigilante-section-users-email-verify', 'label' => __( 'Allow Resend', 'vigilante' ), 'label_en' => 'Allow Resend', 'keywords' => _x( 'allow resend', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'users', 'tab_label' => __( 'User Security', 'vigilante' ), 'section' => __( 'Email verification', 'vigilante' ), 'anchor' => 'vigilante-section-users-email-verify', 'label' => __( 'Auto-delete Unverified', 'vigilante' ), 'label_en' => 'Auto-delete Unverified', 'keywords' => _x( 'auto-delete unverified', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Database Hardening', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-database', 'label' => __( 'Current prefix', 'vigilante' ), 'label_en' => 'Current prefix', 'keywords' => _x( 'current prefix database db table tables mysql', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Database Hardening', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-database', 'label' => __( 'New prefix', 'vigilante' ), 'label_en' => 'New prefix', 'keywords' => _x( 'new prefix database db table tables mysql', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-wpconfig', 'label' => __( 'Disable File Editor', 'vigilante' ), 'label_en' => 'Disable File Editor', 'keywords' => _x( 'disable file editor files edit editing', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-wpconfig', 'label' => __( 'Disable File Modifications', 'vigilante' ), 'label_en' => 'Disable File Modifications', 'keywords' => _x( 'disable file modifications files modify install update', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'wp-config.php Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-wpconfig', 'label' => __( 'Hide PHP errors from visitors', 'vigilante' ), 'label_en' => 'Hide PHP errors from visitors', 'keywords' => _x( 'hide php errors from visitors error debug log', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'XML-RPC', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-xmlrpc', 'label' => __( 'XML-RPC access', 'vigilante' ), 'label_en' => 'XML-RPC access', 'keywords' => _x( 'xml-rpc access xmlrpc rpc remote jetpack app', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Comment Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-comments', 'label' => __( 'Disable Pingbacks', 'vigilante' ), 'label_en' => 'Disable Pingbacks', 'keywords' => _x( 'disable pingbacks pingback ping', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Comment Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-comments', 'label' => __( 'Disable Trackbacks', 'vigilante' ), 'label_en' => 'Disable Trackbacks', 'keywords' => _x( 'disable trackbacks trackback ping', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Comment Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-comments', 'label' => __( 'Require Moderation', 'vigilante' ), 'label_en' => 'Require Moderation', 'keywords' => _x( 'require moderation moderate approve', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Comment Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-comments', 'label' => __( 'Close Old Comments', 'vigilante' ), 'label_en' => 'Close Old Comments', 'keywords' => _x( 'close old comments comment discussion', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Comment Security', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-comments', 'label' => __( 'Honeypot Protection', 'vigilante' ), 'label_en' => 'Honeypot Protection', 'keywords' => _x( 'honeypot protection spam bots trap', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Remove Generator', 'vigilante' ), 'label_en' => 'Remove Generator', 'keywords' => _x( 'remove generator version meta', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Remove RSD Link', 'vigilante' ), 'label_en' => 'Remove RSD Link', 'keywords' => _x( 'remove rsd link discovery', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Remove WLW Manifest', 'vigilante' ), 'label_en' => 'Remove WLW Manifest', 'keywords' => _x( 'remove wlw manifest wlwmanifest', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Remove Shortlink', 'vigilante' ), 'label_en' => 'Remove Shortlink', 'keywords' => _x( 'remove shortlink link', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'Header Cleanup', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-headers', 'label' => __( 'Remove REST API Link', 'vigilante' ), 'label_en' => 'Remove REST API Link', 'keywords' => _x( 'remove rest api link json endpoint', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'RSS Feed Settings', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-rss', 'label' => __( 'Disable Feeds', 'vigilante' ), 'label_en' => 'Disable Feeds', 'keywords' => _x( 'disable feeds feed rss atom syndication', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'RSS Feed Settings', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-rss', 'label' => __( 'Disable If No Content', 'vigilante' ), 'label_en' => 'Disable If No Content', 'keywords' => _x( 'disable if no content', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'wp-hardening', 'tab_label' => __( 'WP Hardening', 'vigilante' ), 'section' => __( 'RSS Feed Settings', 'vigilante' ), 'anchor' => 'vigilante-section-hardening-rss', 'label' => __( 'Remove Feed Version', 'vigilante' ), 'label_en' => 'Remove Feed Version', 'keywords' => _x( 'remove feed version feeds rss atom', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'vigilante-section-audit-alerts', 'label' => __( 'Alert on severity', 'vigilante' ), 'label_en' => 'Alert on severity', 'keywords' => _x( 'alert on severity alerts notification warning level critical', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'vigilante-section-audit-alerts', 'label' => __( 'Time window', 'vigilante' ), 'label_en' => 'Time window', 'keywords' => _x( 'time window', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'vigilante-section-audit-alerts', 'label' => __( 'Thresholds per category', 'vigilante' ), 'label_en' => 'Thresholds per category', 'keywords' => _x( 'thresholds per category threshold limit', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'activity-log', 'tab_label' => __( 'Security Audit', 'vigilante' ), 'section' => __( 'Audit Alerts', 'vigilante' ), 'anchor' => 'vigilante-section-audit-alerts', 'label' => __( 'Recipients', 'vigilante' ), 'label_en' => 'Recipients', 'keywords' => _x( 'recipients email recipient', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Automatic Scans', 'vigilante' ), 'label_en' => 'Automatic Scans', 'keywords' => _x( 'automatic scans scan scanning', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Scan Frequency', 'vigilante' ), 'label_en' => 'Scan Frequency', 'keywords' => _x( 'scan frequency scans scanning check', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Email Notifications', 'vigilante' ), 'label_en' => 'Email Notifications', 'keywords' => _x( 'email notifications mail notification notify', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Test email', 'vigilante' ), 'label_en' => 'Test email', 'keywords' => _x( 'test email mail notification notify', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Scan Scope', 'vigilante' ), 'label_en' => 'Scan Scope', 'keywords' => _x( 'scan scope scans scanning check', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Excluded Paths', 'vigilante' ), 'label_en' => 'Excluded Paths', 'keywords' => _x( 'excluded paths exclude exclusions ignore ignored path folder folders', 'settings search keywords', 'vigilante' ) ),
            array( 'tab' => 'file-integrity', 'tab_label' => __( 'File Integrity', 'vigilante' ), 'section' => __( 'File Integrity Monitoring', 'vigilante' ), 'anchor' => 'vigilante-section-fi-monitoring', 'label' => __( 'Excluded Extensions', 'vigilante' ), 'label_en' => 'Excluded Extensions', 'keywords' => _x( 'excluded extensions exclude exclusions ignore ignored extension filetype', 'settings search keywords', 'vigilante' ) ),
        );
    }

    /**
     * Enqueue admin assets
     *
     * @param string $hook Current admin page.
     */
    public function enqueue_assets( $hook ) {
        // toplevel_page_vigilante for top-level menu page
        if ( 'toplevel_page_vigilante' !== $hook ) {
            return;
        }

        wp_enqueue_style(
            'vigilante-admin',
            VIGILANTE_ASSETS_URL . 'css/admin.css',
            array(),
            VIGILANTE_VERSION
        );

        wp_enqueue_script(
            'vigilante-admin',
            VIGILANTE_ASSETS_URL . 'js/admin.js',
            array( 'jquery' ),
            VIGILANTE_VERSION,
            true
        );

        wp_localize_script( 'vigilante-admin', 'vigilanteAdmin', array(
            'ajaxUrl'       => admin_url( 'admin-ajax.php' ),
            'nonce'         => wp_create_nonce( 'vigilante_admin_nonce' ),
            'currentUserId' => get_current_user_id(),
            'logoutUrl'     => wp_logout_url( wp_login_url() ),
            'adminUrl'      => admin_url( 'admin.php?page=vigilante' ),
            'searchIndex'   => $this->get_search_index(),
            // The scan repaints this table from JavaScript, so the same gate
            // has to travel with it or half the screen keeps the dead button.
            'approvalLocked' => $this->critical_approval_locked(),
            'underAttack'   => array(
                'active'    => ( new Vigilante_Under_Attack( $this->settings, $this->activity_log ) )->is_active(),
                'remaining' => ( new Vigilante_Under_Attack( $this->settings, $this->activity_log ) )->get_remaining_time(),
            ),
            'strings'       => array(
                'saving'              => __( 'Saving...', 'vigilante' ),
                'sendingTest'         => __( 'Sending...', 'vigilante' ),
                'saved'               => __( 'Settings saved', 'vigilante' ),
                'error'               => __( 'Error saving settings', 'vigilante' ),
                'confirm'             => __( 'Are you sure?', 'vigilante' ),
                'scanning'            => __( 'Scanning...', 'vigilante' ),
                'scanComplete'        => __( 'Scan complete', 'vigilante' ),
                'loading'             => __( 'Loading...', 'vigilante' ),
                'searching'           => __( 'Searching...', 'vigilante' ),
                'noUsersFound'        => __( 'No users found', 'vigilante' ),
                'searchError'         => __( 'Error searching users', 'vigilante' ),
                'sending'             => __( 'Sending...', 'vigilante' ),
                'sendNotification'    => __( 'Send notification now', 'vigilante' ),
                'notificationsSent'   => __( 'notifications sent', 'vigilante' ),
                'skipped'             => __( 'skipped', 'vigilante' ),
                'failed'              => __( 'failed', 'vigilante' ),
                'customConfig'        => __( 'Custom Configuration', 'vigilante' ),
                // Header tester strings
                'testHeaders'         => __( 'Test Headers', 'vigilante' ),
                'testing'             => __( 'Testing...', 'vigilante' ),
                'score'               => __( 'Score', 'vigilante' ),
                'enabledHeaders'      => __( 'Enabled headers', 'vigilante' ),
                'missingHeaders'      => __( 'Missing headers', 'vigilante' ),
                'warnings'            => __( 'Warnings', 'vigilante' ),
                // File integrity scan results strings
                'scanResults'         => __( 'Scan Results', 'vigilante' ),
                'ok'                  => __( 'OK', 'vigilante' ),
                'modified'            => __( 'Modified', 'vigilante' ),
                'suspicious'          => __( 'Suspicious', 'vigilante' ),
                'totalScanned'        => __( 'Total Scanned', 'vigilante' ),
                'suspiciousFiles'     => __( 'Suspicious Files', 'vigilante' ),
                'suspiciousWarning'   => __( 'These files may contain malicious code or are in unexpected locations. Review immediately!', 'vigilante' ),
                'file'                => __( 'File', 'vigilante' ),
                'reason'              => __( 'Reason', 'vigilante' ),
                'type'                => __( 'Type', 'vigilante' ),
                'unknown'             => __( 'Unknown', 'vigilante' ),
                'modifiedFiles'       => __( 'Modified Files', 'vigilante' ),
                'modifiedDescription' => __( 'These files (apparently) differ from the original WordPress or plugin versions.', 'vigilante' ),
                'extraFiles'          => __( 'Extra Files', 'vigilante' ),
                'extra'               => __( 'Extra', 'vigilante' ),
                'ignored'             => __( 'Ignored', 'vigilante' ),
                'extraDescription'    => __( 'PHP files found in plugins or themes that are not part of the original distribution from WordPress.org.', 'vigilante' ),
                'actions'             => __( 'Actions', 'vigilante' ),
                'ignore'              => __( 'Ignore', 'vigilante' ),
                'ignoring'            => __( 'Ignoring...', 'vigilante' ),
                'fileIgnored'         => __( 'File added to ignored list.', 'vigilante' ),
                'fileUnignored'       => __( 'File removed from ignored list.', 'vigilante' ),
                'confirmClearIgnored' => __( 'Remove all files from the ignored list? They will appear in scan results again.', 'vigilante' ),
                'ignoredCleared'      => __( 'Ignored files list cleared. Page will reload...', 'vigilante' ),
                'selectAll'           => __( 'Select all', 'vigilante' ),
                'bulkIgnoreSelected'  => __( 'Ignore selected', 'vigilante' ),
                'bulkUnignoreSelected'=> __( 'Stop ignoring selected', 'vigilante' ),
                'bulkNoSelection'     => __( 'Select at least one file first.', 'vigilante' ),
                'bulkConfirmIgnore'   => __( 'Ignore the selected files? They will be hidden from future scan results until you remove them from the ignored list.', 'vigilante' ),
                'bulkConfirmUnignore' => __( 'Remove the selected files from the ignored list? They will appear in scan results again.', 'vigilante' ),
                'bulkProcessing'      => __( 'Processing...', 'vigilante' ),
                /* translators: %d: number of files selected for bulk action. */
                'bulkSelectedCount'   => __( '%d selected', 'vigilante' ),
                'allClear'            => __( 'All files verified - no issues found!', 'vigilante' ),
                'criticalConfigTitle' => __( 'Critical config files modified', 'vigilante' ),
                'criticalConfigDesc'  => __( 'These files are common targets for code injection. Review the changes and approve if they are legitimate. Vigilant\'s own blocks are excluded from this check.', 'vigilante' ),
                'approve'             => __( 'Approve', 'vigilante' ),
                'approving'           => __( 'Approving...', 'vigilante' ),
                'approvalLockedNotice' => $this->critical_approval_notice(),
                'criticalApproved'    => __( 'Change approved. Next scan will use the current state as baseline.', 'vigilante' ),
                'reviewChanges'       => __( 'Review changes', 'vigilante' ),
                'hideChanges'         => __( 'Hide changes', 'vigilante' ),
                'changes'             => __( 'Changes', 'vigilante' ),
                'diffUnavailable'     => __( 'Diff not available for this file (baseline was created before diff tracking was added). Approve to enable diff on future changes.', 'vigilante' ),
                'diffNetwork'         => __( 'This file belongs to the whole network, so its line changes are only shown to network administrators, on the main site.', 'vigilante' ),
                'diffRescan'          => __( 'Run a new scan to see the line changes of this file.', 'vigilante' ),
                'diffRedaction'       => __( 'The line changes of this file are not shown because a value in it could not be hidden safely. The change itself is still detected.', 'vigilante' ),
                'diffEmpty'           => __( 'No line-level changes detected (may be whitespace or reordering).', 'vigilante' ),
                'diffLines'           => __( 'lines', 'vigilante' ),
                // Under Attack mode strings
                'underAttackConfirmActivate'   => __( 'Activate Under Attack mode? All visitors will see a verification page for the next 4 hours.', 'vigilante' ),
                'underAttackConfirmDeactivate' => __( 'Deactivate Under Attack mode?', 'vigilante' ),
                'underAttackActivating'        => __( 'Activating...', 'vigilante' ),
                'underAttackDeactivating'      => __( 'Deactivating...', 'vigilante' ),
                // Database backup strings
                'dbBackupDownloading'          => __( 'Generating backup...', 'vigilante' ),
                'dbBackupNoTables'             => __( 'Please select at least one table.', 'vigilante' ),
                'dbBackupSuccess'              => __( 'Database backup downloaded successfully.', 'vigilante' ),
                // Firewall unblock
                'confirmUnblockIp'             => __( 'Unblock this IP from firewall rate limiting?', 'vigilante' ),
                // Database prefix strings
                'dbPrefixConfirm'              => __( 'This operation will change your database prefix. It is irreversible. Make sure you have a current database backup before proceeding.', 'vigilante' ),
                'dbPrefixChanging'             => __( 'Changing prefix...', 'vigilante' ),
                'dbPrefixSuccess'              => __( 'Database prefix changed successfully. The page will reload now.', 'vigilante' ),
                'dbPrefixCheckbox'             => __( 'You must confirm that you have a database backup.', 'vigilante' ),
                /* translators: 1: Hours, 2: Minutes */
                'underAttackRemaining'         => __( '%1$dh %2$dm remaining', 'vigilante' ),
                'underAttackLabel'             => __( 'Under Attack', 'vigilante' ),
                'standardLabel'                => __( 'Standard', 'vigilante' ),
                'maximumLabel'                 => __( 'Maximum Security', 'vigilante' ),
                'deactivate'                   => __( 'Deactivate', 'vigilante' ),
                'underAttackActivate'          => __( 'Activate for 4 hours', 'vigilante' ),
                // Settings strings
                'saveSettings'                 => __( 'Save Settings', 'vigilante' ),
                'settingsResetDefaults'        => __( 'Settings reset to defaults.', 'vigilante' ),
                'confirmOverwrite'             => __( 'This will overwrite your current settings.', 'vigilante' ),
                'importFailed'                 => __( 'Could not import settings. Check the file and try again.', 'vigilante' ),
                /* translators: 1: tests passed, 2: total tests in this category */
                'testsCounter'                 => __( '%1$d/%2$d tests', 'vigilante' ),
                'confirmResetAll'              => __( 'This will reset ALL settings to defaults.', 'vigilante' ),
                'couldNotDetermineSection'     => __( 'Could not determine section.', 'vigilante' ),
                'confirmResetSection'          => __( 'Reset this section to default values? This cannot be undone.', 'vigilante' ),
                'sectionResetDefaults'         => __( 'Section reset to defaults.', 'vigilante' ),
                /* translators: %s: preset name */
                'confirmApplyPreset'           => __( 'Apply the "%s" preset?', 'vigilante' ),
                // Scan strings
                'scanFailed'                   => __( 'Scan failed', 'vigilante' ),
                /* translators: %s: error message */
                'scanError'                    => __( 'Scan error: %s', 'vigilante' ),
                'runScanNow'                   => __( 'Run Scan Now', 'vigilante' ),
                'confirmClearScan'             => __( 'Are you sure you want to clear all scan results?', 'vigilante' ),
                'clearing'                     => __( 'Clearing...', 'vigilante' ),
                'scanResultsCleared'           => __( 'Scan results cleared. Page will reload...', 'vigilante' ),
                'failedClearResults'           => __( 'Failed to clear results', 'vigilante' ),
                /* translators: %s: error message */
                'ajaxError'                    => __( 'AJAX Error: %s', 'vigilante' ),
                // Activity log popup strings
                'logRequest'                   => __( 'Request', 'vigilante' ),
                'logDate'                      => __( 'Date', 'vigilante' ),
                'logMethod'                    => __( 'Method', 'vigilante' ),
                'logType'                      => __( 'Type', 'vigilante' ),
                'logAction'                    => __( 'Action', 'vigilante' ),
                'logSeverity'                  => __( 'Severity', 'vigilante' ),
                'logMessage'                   => __( 'Message', 'vigilante' ),
                'logRequestUri'                => __( 'Address', 'vigilante' ),
                'logClient'                    => __( 'Client', 'vigilante' ),
                'logUser'                      => __( 'User', 'vigilante' ),
                'logIpAddress'                 => __( 'IP Address', 'vigilante' ),
                'logUserAgent'                 => __( 'User Agent', 'vigilante' ),
                'logIpLabel'                   => __( 'IP:', 'vigilante' ),
                'logUaLabel'                   => __( 'UA:', 'vigilante' ),
                'logWhitelist'                 => __( 'Whitelist', 'vigilante' ),
                'logBlacklist'                 => __( 'Blacklist', 'vigilante' ),
                'logInWhitelist'               => __( 'In whitelist', 'vigilante' ),
                'logInBlacklist'               => __( 'In blacklist', 'vigilante' ),
                'logAdded'                     => __( 'Added!', 'vigilante' ),
                'logErrorAddingToList'         => __( 'Error adding to list', 'vigilante' ),
                'logRequestFailed'             => __( 'Request failed', 'vigilante' ),
                // Activity log table strings
                'noLogEntries'                 => __( 'No log entries found.', 'vigilante' ),
                'view'                         => __( 'View', 'vigilante' ),
                'confirmClearLogs'             => __( 'This will delete all audit logs.', 'vigilante' ),
                // Export logs strings
                'exporting'                    => __( 'Exporting...', 'vigilante' ),
                /* translators: %d: number of entries */
                'logsExported'                 => __( 'Logs exported (%d entries)', 'vigilante' ),
                'noLogsToExport'               => __( 'No logs to export', 'vigilante' ),
                'exportFailed'                 => __( 'Export failed', 'vigilante' ),
                'exportLogs'                   => __( 'Export Logs', 'vigilante' ),
                // Backup strings
                'backupCreated'                => __( 'Backup created successfully.', 'vigilante' ),
                'createBackupNow'              => __( 'Download Backup', 'vigilante' ),
                'downloadBackup'               => __( 'Download Backup (.zip)', 'vigilante' ),
                /* translators: %d: number of tables */
                'tablesCount'                  => __( '%d tables', 'vigilante' ),
                /* translators: 1: table count, 2: human-readable size */
                'dbTablesTotal'                => __( '%1$d tables total (%2$s)', 'vigilante' ),
                /* translators: 1: selected count, 2: human-readable size */
                'dbTablesSelected'             => __( '%1$d tables selected (%2$s)', 'vigilante' ),
                // Settings search strings
                'searchNoResults'              => __( 'No matching settings found.', 'vigilante' ),
                /* translators: %d: number of results that did not fit in the list. */
                'searchMoreResults'            => __( '%d more results. Refine the search to see them.', 'vigilante' ),
                'searchInTab'                  => __( 'in', 'vigilante' ),
                // Modules string
                /* translators: 1: enabled count, 2: total count */
                'modulesEnabled'               => __( '%1$d / %2$d modules enabled', 'vigilante' ),
                // Activity log label maps for JS rendering
                'eventTypeLabels'              => array(
                    'login'    => __( 'Login', 'vigilante' ),
                    'user'     => __( 'User', 'vigilante' ),
                    'content'  => __( 'Content', 'vigilante' ),
                    'plugin'   => __( 'Plugin', 'vigilante' ),
                    'theme'    => __( 'Theme', 'vigilante' ),
                    'settings' => __( 'Settings', 'vigilante' ),
                    'comment'  => __( 'Comment', 'vigilante' ),
                    'media'    => __( 'Media', 'vigilante' ),
                    'firewall' => __( 'Firewall', 'vigilante' ),
                    'file'     => __( 'File', 'vigilante' ),
                    'security' => __( 'Security', 'vigilante' ),
                    'system'   => __( 'System', 'vigilante' ),
                ),
                'severityLabels'               => array(
                    'info'     => __( 'Info', 'vigilante' ),
                    'warning'  => __( 'Warning', 'vigilante' ),
                    'critical' => __( 'Critical', 'vigilante' ),
                ),
                // Password reset strings
                'noUsersFoundSearch'           => __( 'No users found', 'vigilante' ),
                /* translators: %d: number of users */
                'confirmForceReset'            => __( 'Force password reset for %d user(s)? A password reset email will be sent to each user.', 'vigilante' ),
                'warningResettingSelf'         => __( 'WARNING: You are including yourself. Your session will end and you will need to set a new password.', 'vigilante' ),
                'processing'                   => __( 'Processing...', 'vigilante' ),
                'anErrorOccurred'              => __( 'An error occurred', 'vigilante' ),
                'forceResetSelected'           => __( 'Force Reset for Selected Users', 'vigilante' ),
                'confirmForceResetAll'         => __( 'This will force ALL users to reset their password. All users will receive a password reset email. Are you sure you want to continue?', 'vigilante' ),
                'warningResettingSelfAll'      => __( 'WARNING: You are including yourself. Your session will end immediately.', 'vigilante' ),
                'forceResetAll'                => __( 'Force Reset for ALL Users', 'vigilante' ),
                // Role-based password reset strings
                /* translators: %d: number of users */
                'confirmForceResetByRole'      => __( 'Force password reset for %d user(s) with the selected roles? A password reset email will be sent to each user.', 'vigilante' ),
                'noRolesSelected'              => __( 'Please select at least one role.', 'vigilante' ),
                'forceResetByRole'             => __( 'Force Reset for Selected Roles', 'vigilante' ),
                // User approval strings
                'confirmApprove'               => __( 'Approve this user?', 'vigilante' ),
                'approve'                      => __( 'Approve', 'vigilante' ),
                'rejectReason'                 => __( 'Enter rejection reason (optional):', 'vigilante' ),
                'reject'                       => __( 'Reject', 'vigilante' ),
                'noPending'                    => __( 'No pending registrations.', 'vigilante' ),
                // Session management strings
                'confirmRevoke'                => __( 'Revoke this session?', 'vigilante' ),
                'confirmRevokeAll'             => __( 'Revoke all other sessions?', 'vigilante' ),
                'revokeOthers'                 => __( 'Revoke All Other Sessions', 'vigilante' ),
                'confirmRevokeAllUser'         => __( 'Revoke ALL sessions for this user? They will be logged out everywhere.', 'vigilante' ),
                'sessionsFor'                  => __( 'Sessions for:', 'vigilante' ),
                'noSessions'                   => __( 'No active sessions', 'vigilante' ),
                'revoke'                       => __( 'Revoke', 'vigilante' ),
                'noUsers'                      => __( 'No users found', 'vigilante' ),
                // Time ago strings
                'timeYear'                     => __( 'year', 'vigilante' ),
                'timeYears'                    => __( 'years', 'vigilante' ),
                'timeMonth'                    => __( 'month', 'vigilante' ),
                'timeMonths'                   => __( 'months', 'vigilante' ),
                'timeDay'                      => __( 'day', 'vigilante' ),
                'timeDays'                     => __( 'days', 'vigilante' ),
                'timeHour'                     => __( 'hour', 'vigilante' ),
                'timeHours'                    => __( 'hours', 'vigilante' ),
                'timeMinute'                   => __( 'minute', 'vigilante' ),
                'timeMinutes'                  => __( 'minutes', 'vigilante' ),
                /* translators: %1$d: count, %2$s: time unit */
                'timeAgo'                      => __( '%1$d %2$s ago', 'vigilante' ),
                'justNow'                      => __( 'Just now', 'vigilante' ),
                // Pagination strings
                /* translators: 1: first item number, 2: last item number, 3: total items */
                'paginationOf'                 => __( '%1$d–%2$d of %3$d', 'vigilante' ),
                'paginationEmpty'              => __( '0 items', 'vigilante' ),
                // Security Analyzer strings
                'analyzerScanNow'              => __( 'Scan now', 'vigilante' ),
                'analyzerScanning'             => __( 'Scanning…', 'vigilante' ),
                'analyzerFastPhase'            => __( 'Running fast checks…', 'vigilante' ),
                'analyzerSlowPhase'            => __( 'Running remote checks…', 'vigilante' ),
                'analyzerScanComplete'         => __( 'Security scan complete.', 'vigilante' ),
                'analyzerScanFailed'           => __( 'Security scan failed.', 'vigilante' ),
                'analyzerShowDetails'          => __( 'Show detailed breakdown', 'vigilante' ),
                'analyzerHideDetails'          => __( 'Hide detailed breakdown', 'vigilante' ),
                'analyzerGoToSetting'          => __( 'Go to setting', 'vigilante' ),
                'analyzerNoData'               => __( 'No data yet — run a scan to populate this category.', 'vigilante' ),
                'analyzerJustNow'              => __( 'just now', 'vigilante' ),
                'analyzerAgo'                  => __( 'ago', 'vigilante' ),
                'analyzerSettingsSaved'        => __( 'Analyzer settings saved.', 'vigilante' ),
                'analyzerLastScanJustNow'      => __( 'Last scan just now', 'vigilante' ),
                'analyzerQualityExcellent'     => __( 'Excellent', 'vigilante' ),
                'analyzerQualityGood'          => __( 'Good', 'vigilante' ),
                'analyzerQualityFair'          => __( 'Fair', 'vigilante' ),
                'analyzerQualityPoor'          => __( 'Poor', 'vigilante' ),
                'analyzerQualityCritical'      => __( 'Critical', 'vigilante' ),
                'analyzerPts'                  => __( 'pts', 'vigilante' ),
                'analyzerLearnMore'            => __( 'Learn more', 'vigilante' ),
                'analyzerInfoAllClear'         => __( 'All clear', 'vigilante' ),
                /* translators: %d: number of findings in an info-only category */
                'analyzerInfoFindings'         => __( '%d findings', 'vigilante' ),
            ),
        ) );

        // 2FA Admin assets
        wp_enqueue_style(
            'vigilante-2fa-admin',
            VIGILANTE_ASSETS_URL . 'css/two-factor-admin.css',
            array( 'vigilante-admin' ),
            VIGILANTE_VERSION
        );

        wp_enqueue_script(
            'vigilante-2fa-admin',
            VIGILANTE_ASSETS_URL . 'js/two-factor-admin.js',
            array( 'jquery', 'vigilante-admin' ),
            VIGILANTE_VERSION,
            true
        );
    }

    /**
     * Show admin notices
     */
    public function show_admin_notices() {
        // Activation notice
        if ( get_transient( 'vigilante_activated' ) ) {
            ?>
            <div class="notice notice-success is-dismissible vigilante-activation-notice">
                <p>
                    <span class="dashicons dashicons-shield vigilante-notice-icon"></span>
                    <strong><?php esc_html_e( 'Vigilant activated successfully!', 'vigilante' ); ?></strong>
                    <?php esc_html_e( 'Security protection is now active.', 'vigilante' ); ?>
                    <a href="<?php echo esc_url( admin_url( 'admin.php?page=vigilante' ) ); ?>">
                        <?php esc_html_e( 'Configure settings', 'vigilante' ); ?>
                    </a>
                </p>
            </div>
            <?php
            delete_transient( 'vigilante_activated' );
        }

        // Under Attack mode notice (non-dismissible, shown on all admin pages)
        $ua_status = get_option( Vigilante_Under_Attack::OPTION_NAME, array() );
        if ( ! empty( $ua_status['active'] ) ) {
            $ua_remaining = ( $ua_status['activated_at'] + $ua_status['duration'] ) - time();
            if ( $ua_remaining > 0 ) {
                $ua_hours = floor( $ua_remaining / 3600 );
                $ua_mins  = floor( ( $ua_remaining % 3600 ) / 60 );
                $dashboard_url = admin_url( 'admin.php?page=vigilante' );
                ?>
                <div class="notice notice-warning vigilante-ua-notice">
                    <p>
                        <span class="dashicons dashicons-shield"></span>
                        <strong><?php esc_html_e( 'Under Attack mode is active', 'vigilante' ); ?></strong>
                        &mdash;
                        <?php
                        printf(
                            /* translators: 1: Hours, 2: Minutes */
                            esc_html__( '%1$dh %2$dm remaining.', 'vigilante' ),
                            absint( $ua_hours ),
                            absint( $ua_mins )
                        );
                        ?>
                        <a href="<?php echo esc_url( $dashboard_url ); ?>">
                            <?php esc_html_e( 'Go to Vigilant dashboard', 'vigilante' ); ?>
                        </a>
                    </p>
                    <p>
                        <em><?php esc_html_e( 'Vigilant has applied the Maximum preset plus extra hardening on top of your previous configuration. Any changes you make to Vigilant settings while this mode is active will be reverted when it ends.', 'vigilante' ); ?></em>
                    </p>
                    <?php
                    // The cache-bypass rules could not be written (a host where
                    // WordPress cannot write files by itself, a held lock, a
                    // failed read-back): show them, so they can be added by hand.
                    $ua_instance = new Vigilante_Under_Attack( $this->settings, $this->activity_log );
                    if ( $ua_instance->cache_rules_missing() ) :
                        ?>
                        <p>
                            <strong><?php esc_html_e( 'The cache-bypass rules could not be written to your .htaccess.', 'vigilante' ); ?></strong>
                            <?php esc_html_e( 'Without them a page cache may keep serving stored pages during the attack. Add this block at the top of the .htaccess in your site root (the activity log records why it was not written):', 'vigilante' ); ?>
                        </p>
                        <textarea readonly rows="9" class="large-text code" onclick="this.select();"><?php echo esc_textarea( Vigilante_Under_Attack::get_cache_bypass_block() ); ?></textarea>
                    <?php endif; ?>
                </div>
                <?php
            }
        }

        // Proxy/CDN detection: if IP detection is set to "direct" but requests
        // arrive with a forwarded-for header carrying a different valid IP, the
        // site is very likely behind a proxy/CDN that has not been declared, so
        // the firewall is seeing the proxy IP for every visitor. Guide the admin.
        //
        // Two deliberate silencers (2.9.2):
        // - A loopback forwarded IP (::1 / 127.x) means the person browsing IS
        //   the machine itself: that only happens in local development stacks
        //   (Local's nginx router, Docker...), never behind a production
        //   proxy/CDN, so the notice would be pure noise there.
        // - The notice is dismissible and the dismissal persists site-wide via
        //   the vigilante_dismissed_notices option (the admin evaluated it and
        //   decided; nagging forever helps nobody).
        $dismissed_notices = get_option( 'vigilante_dismissed_notices', array() );
        if (
            current_user_can( 'manage_options' )
            && '' === Vigilante_IP_Utils::trusted_proxy_header()
            && ! isset( $dismissed_notices['proxy_detection'] )
        ) {
            $remote   = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
            $detected = '';
            foreach ( Vigilante_IP_Utils::trusted_header_map() as $proxy_label => $server_key ) {
                if ( empty( $_SERVER[ $server_key ] ) ) {
                    continue;
                }
                $candidate = sanitize_text_field( wp_unslash( $_SERVER[ $server_key ] ) );
                if ( false !== strpos( $candidate, ',' ) ) {
                    $parts     = explode( ',', $candidate );
                    $candidate = trim( $parts[0] );
                }
                if ( ! filter_var( $candidate, FILTER_VALIDATE_IP ) || $candidate === $remote ) {
                    continue;
                }
                // Loopback forwarded IP = local development, not a real proxy.
                if ( '::1' === $candidate || 0 === strpos( $candidate, '127.' ) ) {
                    continue;
                }
                $detected = $proxy_label;
                break;
            }

            if ( '' !== $detected ) {
                $firewall_url   = admin_url( 'admin.php?page=vigilante&tab=firewall' );
                $detail_message = sprintf(
                    /* translators: %s: detected forwarded header name wrapped in a code tag. */
                    esc_html__( 'Requests are arriving with a %s header, but visitor IP detection is set to direct connection. The firewall is reading the proxy address instead of the real visitor IP, which affects the IP lists and rate limiting.', 'vigilante' ),
                    '<code>' . esc_html( strtoupper( $detected ) ) . '</code>'
                );
                ?>
                <div class="notice notice-warning is-dismissible vigilante-proxy-notice">
                    <p>
                        <span class="dashicons dashicons-shield"></span>
                        <strong><?php esc_html_e( 'Vigilant: this site looks like it is behind a proxy or CDN', 'vigilante' ); ?></strong>
                    </p>
                    <p><?php echo wp_kses_post( $detail_message ); ?></p>
                    <p>
                        <a href="<?php echo esc_url( $firewall_url ); ?>" class="button button-secondary">
                            <?php esc_html_e( 'Set your proxy in Firewall settings', 'vigilante' ); ?>
                        </a>
                    </p>
                </div>
                <script>
                jQuery( function ( $ ) {
                    $( document ).on( 'click', '.vigilante-proxy-notice .notice-dismiss', function () {
                        $.post( ajaxurl, {
                            action: 'vigilante_dismiss_notice',
                            notice_id: 'proxy_detection',
                            nonce: <?php echo wp_json_encode( wp_create_nonce( 'vigilante_dismiss_notice' ) ); ?>
                        } );
                    } );
                } );
                </script>
                <?php
            }
        }
    }

    /**
     * Render settings page
     */
    public function render_settings_page() {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
        $this->current_tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'dashboard';

        if ( ! array_key_exists( $this->current_tab, $this->tabs ) ) {
            $this->current_tab = 'dashboard';
        }
        ?>
        <div class="wrap vigilante-admin-wrap">
            <div class="vigilante-header-row">
                <h1 class="vigilante-page-title">
                    <img src="<?php echo esc_url( VIGILANTE_ASSETS_URL . 'images/icon.png' ); ?>" alt="Vigilante" class="vigilante-title-icon">
                    <?php esc_html_e( 'Vigilant', 'vigilante' ); ?>
                    <span class="vigilante-version">v<?php echo esc_html( VIGILANTE_VERSION ); ?></span>
                </h1>
                <div class="vigilante-search-wrapper">
                    <div class="vigilante-search-input-wrap">
                        <span class="vigilante-search-icon dashicons dashicons-search" aria-hidden="true"></span>
                        <input type="search" id="vigilante-settings-search" class="vigilante-settings-search" aria-label="<?php esc_attr_e( 'Search settings', 'vigilante' ); ?>" placeholder="<?php esc_attr_e( 'Search settings…', 'vigilante' ); ?>" autocomplete="off">
                        <span class="vigilante-search-shortcut" aria-hidden="true">/</span>
                    </div>
                    <div id="vigilante-settings-search-results" class="vigilante-search-results" hidden role="listbox"></div>
                </div>
            </div>

            <?php $this->render_tabs(); ?>

            <div class="vigilante-content">
                <div class="vigilante-main">
                    <?php $this->render_tab_content(); ?>
                </div>
                <div class="vigilante-sidebar">
                    <?php $this->render_sidebar(); ?>
                </div>
            </div>
        </div>
        <?php
    }

    /**
     * Render tabs navigation
     */
    private function render_tabs() {
        $options = $this->settings->get_all_options();
        
        // Map tabs to modules
        $tab_to_module = array(
            'firewall'       => 'firewall',
            'headers'        => 'security_headers',
            'login'          => 'login_security',
            'rest-api'       => 'rest_api_security',
            'users'          => 'user_security',
            'wp-hardening'   => 'wp_hardening',
            'file-integrity' => 'file_integrity',
            'activity-log'   => 'activity_log',
        );
        ?>
        <nav class="nav-tab-wrapper vigilante-nav-tabs">
            <?php foreach ( $this->tabs as $tab_id => $tab_name ) : 
                $is_disabled = false;
                $module = isset( $tab_to_module[ $tab_id ] ) ? $tab_to_module[ $tab_id ] : null;
                if ( $module && empty( $options['modules'][ $module ] ) ) {
                    $is_disabled = true;
                }
                ?>
                <a href="<?php echo esc_url( admin_url( 'admin.php?page=vigilante&tab=' . $tab_id ) ); ?>"
                   class="nav-tab <?php echo $this->current_tab === $tab_id ? 'nav-tab-active' : ''; ?> <?php echo $is_disabled ? 'vigilante-tab-disabled' : ''; ?>"
                   <?php if ( $is_disabled ) : ?>title="<?php esc_attr_e( 'Module Disabled', 'vigilante' ); ?>"<?php endif; ?>>
                    <?php echo esc_html( $tab_name ); ?>
                    <?php if ( $is_disabled ) : ?><span class="vigilante-tab-off">OFF</span><?php endif; ?>
                </a>
            <?php endforeach; ?>
        </nav>
        <?php
    }

    /**
     * Render current tab content
     */
    private function render_tab_content() {
        $method = 'render_tab_' . str_replace( '-', '_', $this->current_tab );

        if ( method_exists( $this, $method ) ) {
            $this->$method();
        } else {
            $this->render_tab_coming_soon();
        }
    }

    /**
     * Render coming soon placeholder
     */
    private function render_tab_coming_soon() {
        ?>
        <div class="vigilante-settings-section">
            <h2><?php esc_html_e( 'Coming Soon', 'vigilante' ); ?></h2>
            <p><?php esc_html_e( 'This section is under development.', 'vigilante' ); ?></p>
        </div>
        <?php
    }

    /**
     * Values to display for a section that this site does not control
     *
     * On a subsite the stored options are its own copy, which nothing acts on:
     * wp-config.php and .htaccess are written from the main site. Painting the
     * local copy describes a configuration that is not running, so a subsite
     * admin sees a box ticked here and the constant absent from the file, or the
     * other way round. Read the main site's values instead, which are the ones in
     * force, and fall back to the local ones if they cannot be read.
     *
     * @since 2.9.8
     *
     * @param string $section Settings section.
     * @return array
     */
    private function get_section_for_display( $section ) {
        $local = $this->settings->get_section( $section );

        if ( ! $this->shared_files_locked() ) {
            return $local;
        }

        // shared_files_locked() is only true on multisite, where get_blog_option() exists.
        $main = get_blog_option( get_main_site_id(), Vigilante_Settings::OPTION_NAME, array() );

        if ( ! is_array( $main ) || empty( $main[ $section ] ) || ! is_array( $main[ $section ] ) ) {
            return $local;
        }

        return wp_parse_args( $main[ $section ], $local );
    }

    /**
     * Whether the sections that write wp-config.php and .htaccess are read-only here
     *
     * True on a network when this is not the main site, or the user is not a
     * network administrator. See Vigilante_Settings::can_write_shared_files().
     *
     * @since 2.9.8
     *
     * @return bool
     */
    private function shared_files_locked() {
        return ! Vigilante_Settings::can_write_shared_files();
    }

    /**
     * Whether this is the main site and the user cannot change what it builds the shared files from
     *
     * See Vigilante_Settings::get_main_site_file_settings(). On a subsite those
     * settings only act on that site, so they are never locked there.
     *
     * @since 2.11.6
     *
     * @return bool
     */
    private function main_site_files_locked() {
        return $this->shared_files_locked() && Vigilante_Settings::owns_shared_files();
    }

    /**
     * Sentence added to a bulk change when some settings were left as they were
     *
     * Importing a file, applying a preset and restoring the defaults touch every
     * section at once, so the user is told that the shared file settings did
     * not move.
     *
     * @since 2.11.6
     *
     * @return string Empty when the user can change every setting.
     */
    private function locked_file_settings_message() {
        if ( ! Vigilante_Settings::get_locked_file_settings() ) {
            return '';
        }

        return ' ' . __( 'The settings that end up in wp-config.php or .htaccess were left as they were.', 'vigilante' ) . ' ' . Vigilante_Settings::get_shared_files_notice();
    }

    /**
     * Print the shared-files notice for a section that cannot be edited here
     *
     * @since 2.9.8
     */
    private function render_shared_files_notice() {
        if ( ! $this->shared_files_locked() ) {
            return;
        }
        ?>
        <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;">
            <p style="margin:0;"><?php echo esc_html( Vigilante_Settings::get_shared_files_notice() ); ?></p>
        </div>
        <?php
    }

    /**
     * Acting on another user's account needs permission over that user
     *
     * Since 2.10.3 the handlers behind these tools ask for edit_user over the
     * target, which is the rule WordPress itself applies. On a network the core
     * grants edit_user only to network administrators, so for anybody else these
     * controls do nothing. Better to say so than to paint a button that silently
     * skips every user.
     *
     * @since 2.10.4
     * @return bool
     */
    private function forwarded_chain_readings() {
        // Shown, not decided on: the firewall resolves the address elsewhere.
        $chain = Vigilante_IP_Utils::trusted_forwarded_for();

        if ( '' === $chain ) {
            return array();
        }

        $public = array();

        foreach ( explode( ',', $chain ) as $entry ) {
            $address = Vigilante_IP_Utils::unmap_ipv4( trim( $entry ) );

            if ( filter_var( $address, FILTER_VALIDATE_IP ) && ! Vigilante_IP_Utils::is_own_network( $address ) ) {
                $public[] = $address;
            }
        }

        if ( count( $public ) < 2 ) {
            return array();
        }

        return array(
            'now'    => Vigilante_IP_Utils::client_from_chain( $chain ),
            'before' => $public[0],
        );
    }

    /**
     * Whether the user tools of this screen are out of reach for this user
     *
     * @return bool
     */
    private function user_actions_locked() {
        // On a single site edit_user maps to edit_users, which a custom role with
        // manage_options may lack: since 2.11.8 approving and rejecting a pending
        // registration ask for it, so the buttons have to say so there too.
        return is_multisite() ? ! current_user_can( 'manage_network_users' ) : ! current_user_can( 'edit_users' );
    }

    /**
     * Print the notice for user tools that cannot be used from this site
     *
     * @since 2.10.4
     */
    private function render_user_actions_notice() {
        if ( ! $this->user_actions_locked() ) {
            return;
        }
        ?>
        <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;">
            <?php if ( is_multisite() ) : ?>
            <p style="margin:0;"><?php esc_html_e( 'These tools act on user accounts, which on a network belong to the whole network rather than to one site. WordPress reserves that to network administrators, so they are managed from the network admin.', 'vigilante' ); ?></p>
            <?php else : ?>
            <p style="margin:0;"><?php esc_html_e( 'These tools act on other user accounts, and your role cannot edit users, so they are not available to you.', 'vigilante' ); ?></p>
            <?php endif; ?>
        </div>
        <?php
    }

    /**
     * Approving a change to the shared config files needs the network
     *
     * Since 2.11.3 the handler behind the Approve button asks for
     * manage_network_options, because the two files it approves, wp-config.php
     * and the root .htaccess, belong to the installation, and so does the
     * record of them. The button, though, went on being painted for everybody,
     * so the administrator of a subsite saw the warning, saw the button,
     * pressed it and got "Permission denied" with no explanation. That is
     * exactly what user_actions_locked() above exists to avoid, one release
     * later and one screen over. Flagged by @calzbert.
     *
     * @since 2.11.4
     * @return bool
     */
    private function critical_approval_locked() {
        return is_multisite() && ! current_user_can( 'manage_network_options' );
    }

    /**
     * The line that replaces the Approve button where it cannot be used
     *
     * @since 2.11.4
     * @return string
     */
    private function critical_approval_notice() {
        return __( 'These files belong to the whole network rather than to this site, so a change to them is approved from the network admin.', 'vigilante' );
    }

    /**
     * Check if module is disabled and render warning
     *
     * @param string $module_key Module key.
     * @return bool True if disabled.
     */
    private function render_module_disabled_notice( $module_key ) {
        if ( $this->settings->is_module_enabled( $module_key ) ) {
            return false;
        }
        
        $module_labels = $this->settings->get_module_labels();
        $module_name = isset( $module_labels[ $module_key ] ) ? $module_labels[ $module_key ] : $module_key;
        ?>
        <div class="notice notice-warning vigilante-module-disabled-notice">
            <p>
                <strong><?php esc_html_e( 'Module Disabled', 'vigilante' ); ?></strong> - 
                <?php 
                printf(
                    /* translators: %s: Module name */
                    esc_html__( 'The %s module is currently disabled. Enable it from the Dashboard to use these settings.', 'vigilante' ),
                    esc_html( $module_name )
                );
                ?>
            </p>
            <p>
                <a href="<?php echo esc_url( admin_url( 'admin.php?page=vigilante&tab=dashboard' ) ); ?>" class="button">
                    <?php esc_html_e( 'Go to Dashboard', 'vigilante' ); ?>
                </a>
            </p>
        </div>
        <?php
        return true;
    }

    /**
     * Render the Security Analyzer (Security Check) widget + expandable full report.
     *
     * Lives in the Dashboard tab between the Configuration Score status card and
     * the modules grid. Uses the last persisted scan to hydrate server-side so the
     * first paint shows real data; "Scan now" runs the 2-phase AJAX to refresh.
     *
     * @param array $last_scan      Result of Vigilante_Security_Analyzer::get_last_scan().
     * @param array $history        Score history (oldest first).
     * @param array $categories_def Category metadata (slug => label/max).
     * @param array $analyzer_settings Settings subsection for weekly cron + email.
     */
    private function render_analyzer_widget( $last_scan, $history, $categories_def, $analyzer_settings ) {
        $has_data       = ! empty( $last_scan['ran_at'] );
        $score          = isset( $last_scan['score'] ) ? (int) $last_scan['score'] : 0;
        $grade          = isset( $last_scan['grade'] ) ? (string) $last_scan['grade'] : '';
        $counts         = isset( $last_scan['counts'] ) && is_array( $last_scan['counts'] ) ? $last_scan['counts'] : array();
        $ran_at_human   = $has_data
            ? sprintf(
                /* translators: %s: relative time like "2 hours" */
                __( 'Last scan %s ago', 'vigilante' ),
                human_time_diff( (int) $last_scan['ran_at'], time() )
            )
            : __( 'Never scanned', 'vigilante' );
        $categories     = isset( $last_scan['categories'] ) && is_array( $last_scan['categories'] ) ? $last_scan['categories'] : array();
        $weekly_enabled = ! isset( $analyzer_settings['weekly_scan_enabled'] ) || ! empty( $analyzer_settings['weekly_scan_enabled'] );
        $email_enabled  = ! empty( $analyzer_settings['email_on_regression'] );

        $quality = self::analyzer_quality_tag( $score );
        ?>
        <div class="vigilante-analyzer" id="vigilante-analyzer"
             data-has-data="<?php echo $has_data ? '1' : '0'; ?>">
            <div class="vigilante-analyzer-header">
                <div class="vigilante-analyzer-title">
                    <h2>
                        <span class="dashicons dashicons-shield-alt" aria-hidden="true"></span>
                        <?php esc_html_e( 'Security Check', 'vigilante' ); ?>
                    </h2>
                    <p class="description">
                        <?php esc_html_e( 'On-demand audit of what an attacker would see right now, plus 13 internal checks impossible from the outside.', 'vigilante' ); ?>
                    </p>
                    <p class="vigilante-analyzer-last-scan" data-role="ran-at">
                        <span class="dashicons dashicons-clock" aria-hidden="true"></span>
                        <?php echo esc_html( $ran_at_human ); ?>
                    </p>
                </div>
                <div class="vigilante-analyzer-actions">
                    <button type="button" class="button button-primary" id="vigilante-analyzer-scan">
                        <span class="dashicons dashicons-update" aria-hidden="true"></span>
                        <?php esc_html_e( 'Scan now', 'vigilante' ); ?>
                    </button>
                </div>
            </div>

            <div class="vigilante-analyzer-summary">
                <div class="vigilante-analyzer-score-card">
                    <?php if ( $has_data && $grade ) : ?>
                        <div class="vigilante-score-circle vigilante-grade-<?php echo esc_attr( strtolower( $grade ) ); ?>">
                            <span class="vigilante-grade"><?php echo esc_html( $grade ); ?></span>
                            <span class="vigilante-score-text"><?php echo esc_html( $score ); ?>%</span>
                        </div>
                    <?php else : ?>
                        <div class="vigilante-score-circle vigilante-grade-empty">
                            <span class="vigilante-grade">—</span>
                            <span class="vigilante-score-text"><?php esc_html_e( 'N/A', 'vigilante' ); ?></span>
                        </div>
                    <?php endif; ?>
                    <div class="vigilante-analyzer-score-meta">
                        <p class="vigilante-analyzer-score-label">
                            <?php esc_html_e( 'Security Score', 'vigilante' ); ?>
                        </p>
                        <span class="vigilante-analyzer-quality-tag vigilante-analyzer-quality-<?php echo esc_attr( $quality['slug'] ); ?>"
                              data-role="quality-tag">
                            <?php echo esc_html( $quality['label'] ); ?>
                        </span>
                    </div>
                </div>

                <div class="vigilante-analyzer-counts">
                    <span class="vigilante-analyzer-count vigilante-analyzer-count--pass">
                        <span class="dashicons dashicons-yes-alt" aria-hidden="true"></span>
                        <strong data-role="pass"><?php echo esc_html( isset( $counts['pass'] ) ? $counts['pass'] : 0 ); ?></strong>
                        <span class="vigilante-analyzer-count-label"><?php esc_html_e( 'Passed', 'vigilante' ); ?></span>
                    </span>
                    <span class="vigilante-analyzer-count vigilante-analyzer-count--warn">
                        <span class="dashicons dashicons-warning" aria-hidden="true"></span>
                        <strong data-role="warn"><?php echo esc_html( isset( $counts['warn'] ) ? $counts['warn'] : 0 ); ?></strong>
                        <span class="vigilante-analyzer-count-label"><?php esc_html_e( 'Warnings', 'vigilante' ); ?></span>
                    </span>
                    <span class="vigilante-analyzer-count vigilante-analyzer-count--fail">
                        <span class="dashicons dashicons-dismiss" aria-hidden="true"></span>
                        <strong data-role="fail"><?php echo esc_html( isset( $counts['fail'] ) ? $counts['fail'] : 0 ); ?></strong>
                        <span class="vigilante-analyzer-count-label"><?php esc_html_e( 'Failing', 'vigilante' ); ?></span>
                    </span>
                </div>

                <?php
                // Sparkline of recent scores. Require at least 3 data points so the trend
                // is meaningful (2 points is just a line between dots, no real trend).
                $hist_points = array();
                foreach ( $history as $h ) {
                    $hist_points[] = (int) $h['score'];
                }
                $hist_count = count( $hist_points );
                if ( $hist_count >= 3 ) :
                    $current_score  = (int) end( $hist_points );
                    $previous_score = (int) $hist_points[ $hist_count - 2 ];
                    $delta          = $current_score - $previous_score;
                    $delta_class    = $delta > 0 ? 'vigilante-analyzer-delta--up' : ( $delta < 0 ? 'vigilante-analyzer-delta--down' : 'vigilante-analyzer-delta--flat' );
                    $delta_icon     = $delta > 0 ? 'arrow-up-alt' : ( $delta < 0 ? 'arrow-down-alt' : 'minus' );
                    if ( 0 === $delta ) {
                        $delta_text = __( 'No change', 'vigilante' );
                    } else {
                        $delta_text = sprintf(
                            /* translators: %s: signed delta, e.g. "+3" or "-5" */
                            _n( '%s pt vs. previous scan', '%s pts vs. previous scan', abs( $delta ), 'vigilante' ),
                            ( $delta > 0 ? '+' : '' ) . (int) $delta
                        );
                    }
                    ?>
                    <div class="vigilante-analyzer-sparkline-wrap">
                        <div class="vigilante-analyzer-sparkline-head">
                            <span class="vigilante-analyzer-sparkline-label">
                                <?php
                                echo esc_html( sprintf(
                                    /* translators: %d: number of scans */
                                    _n( 'Score trend (last %d scan)', 'Score trend (last %d scans)', $hist_count, 'vigilante' ),
                                    $hist_count
                                ) );
                                ?>
                            </span>
                            <span class="vigilante-analyzer-delta <?php echo esc_attr( $delta_class ); ?>">
                                <span class="dashicons dashicons-<?php echo esc_attr( $delta_icon ); ?>" aria-hidden="true"></span>
                                <?php echo esc_html( $delta_text ); ?>
                            </span>
                        </div>
                        <div class="vigilante-analyzer-sparkline" data-role="sparkline"
                             data-points="<?php echo esc_attr( wp_json_encode( $hist_points ) ); ?>">
                            <?php echo self::sparkline_svg( $hist_points ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Safe SVG from helper ?>
                        </div>
                    </div>
                <?php elseif ( $has_data ) : ?>
                    <div class="vigilante-analyzer-sparkline-wrap vigilante-analyzer-sparkline-wrap--placeholder">
                        <span class="vigilante-analyzer-sparkline-label">
                            <?php esc_html_e( 'Score trend', 'vigilante' ); ?>
                        </span>
                        <p class="vigilante-analyzer-sparkline-hint">
                            <span class="dashicons dashicons-chart-line" aria-hidden="true"></span>
                            <?php
                            $needed = 3 - $hist_count;
                            echo esc_html( sprintf(
                                /* translators: %d: number of additional scans needed */
                                _n( '%d more scan needed to show a trend.', '%d more scans needed to show a trend.', $needed, 'vigilante' ),
                                $needed
                            ) );
                            ?>
                        </p>
                    </div>
                <?php endif; ?>
            </div>

            <div class="vigilante-analyzer-toggle-row">
                <button type="button" class="button-link vigilante-analyzer-toggle" aria-expanded="false">
                    <?php esc_html_e( 'Show detailed breakdown', 'vigilante' ); ?>
                    <span class="vigilante-analyzer-toggle-chevron" aria-hidden="true"></span>
                </button>
            </div>

            <div class="vigilante-analyzer-details" hidden>
                <div class="vigilante-analyzer-categories" data-role="categories">
                    <?php foreach ( $categories_def as $slug => $meta ) :
                        $cat         = isset( $categories[ $slug ] ) ? $categories[ $slug ] : array();
                        $earned      = isset( $cat['earned'] ) ? (int) $cat['earned'] : 0;
                        // Always use the declared meta as the source of truth for the maximum.
                        // The cached scan may carry an old max if a check was added/removed
                        // between releases (see 2.6.1: closed_plugins raised internal from 22 to 28
                        // but cached scans still reported max=22 until reset).
                        $cat_max     = (int) $meta['max'];
                        $info_only   = ! empty( $meta['info_only'] ) || 0 === (int) $meta['max'];
                        $cat_pct     = $cat_max > 0 ? (int) round( ( $earned / $cat_max ) * 100 ) : 0;
                        $checks      = isset( $cat['checks'] ) ? (array) $cat['checks'] : array();
                        $cat_counts  = isset( $cat['counts'] ) && is_array( $cat['counts'] ) ? $cat['counts'] : array( 'pass' => 0, 'warn' => 0, 'fail' => 0, 'info' => 0 );
                        $cat_quality = self::analyzer_quality_tag( $cat_pct );
                        $info_count  = isset( $cat_counts['info'] ) ? (int) $cat_counts['info'] : 0;
                        ?>
                        <details class="vigilante-analyzer-category<?php echo $info_only ? ' vigilante-analyzer-category--info' : ''; ?>"
                                 data-category="<?php echo esc_attr( $slug ); ?>"
                                 data-info-only="<?php echo $info_only ? '1' : '0'; ?>">
                            <summary class="vigilante-analyzer-category-summary">
                                <span class="vigilante-analyzer-category-chevron" aria-hidden="true"></span>
                                <span class="vigilante-analyzer-category-label"><?php echo esc_html( $meta['label'] ); ?></span>
                                <?php if ( $info_only ) : ?>
                                    <span class="vigilante-analyzer-category-quality vigilante-analyzer-quality-info"
                                          data-role="category-quality"
                                          title="<?php esc_attr_e( 'Informational — does not affect the security score.', 'vigilante' ); ?>">
                                        <span class="dashicons dashicons-info-outline" aria-hidden="true"></span>
                                        <?php esc_html_e( 'Informational', 'vigilante' ); ?>
                                    </span>
                                <?php else :
                                    $passed_count = (int) ( $cat_counts['pass'] ?? 0 );
                                    $scored_total = $passed_count
                                        + (int) ( $cat_counts['warn'] ?? 0 )
                                        + (int) ( $cat_counts['fail'] ?? 0 );
                                    ?>
                                    <span class="vigilante-analyzer-category-quality vigilante-analyzer-quality-<?php echo esc_attr( $cat_quality['slug'] ); ?>"
                                          data-role="category-quality">
                                        <span data-role="category-quality-label"><?php echo esc_html( $cat_quality['label'] ); ?></span>
                                        <span class="vigilante-analyzer-category-quality-sep" aria-hidden="true">·</span>
                                        <span class="vigilante-analyzer-category-tests" data-role="category-tests"
                                              data-passed="<?php echo esc_attr( $passed_count ); ?>"
                                              data-total="<?php echo esc_attr( $scored_total ); ?>">
                                            <?php
                                            echo esc_html( sprintf(
                                                /* translators: 1: tests passed, 2: total tests in this category */
                                                __( '%1$d/%2$d tests', 'vigilante' ),
                                                $passed_count,
                                                $scored_total
                                            ) );
                                            ?>
                                        </span>
                                    </span>
                                <?php endif; ?>
                                <?php if ( $info_only ) : ?>
                                    <span class="vigilante-analyzer-category-states" data-role="category-states">
                                        <?php if ( $info_count > 0 ) : ?>
                                            <span class="vigilante-analyzer-category-state vigilante-analyzer-category-state--info" title="<?php esc_attr_e( 'Informational', 'vigilante' ); ?>">
                                                <span data-role="state-info"><?php echo esc_html( $info_count ); ?></span><span class="dashicons dashicons-info-outline" aria-hidden="true"></span>
                                            </span>
                                        <?php endif; ?>
                                    </span>
                                <?php endif; ?>
                                <?php if ( ! $info_only ) : ?>
                                    <span class="vigilante-analyzer-category-score">
                                        <span data-role="earned"><?php echo esc_html( $earned ); ?></span><span class="vigilante-analyzer-category-score-sep">/</span><?php echo esc_html( $cat_max ); ?>
                                        <span class="vigilante-analyzer-category-score-unit"><?php esc_html_e( 'pts', 'vigilante' ); ?></span>
                                    </span>
                                    <span class="vigilante-analyzer-category-bar" aria-hidden="true">
                                        <span class="vigilante-analyzer-category-bar-fill vigilante-analyzer-category-bar-fill--<?php echo esc_attr( $cat_quality['slug'] ); ?>"
                                              style="width: <?php echo esc_attr( $cat_pct ); ?>%"
                                              data-role="category-bar"></span>
                                    </span>
                                <?php else :
                                    $info_warn = isset( $cat_counts['warn'] ) ? (int) $cat_counts['warn'] : 0;
                                    $info_fail = isset( $cat_counts['fail'] ) ? (int) $cat_counts['fail'] : 0;
                                    $info_issues = $info_warn + $info_fail;
                                    if ( $info_issues > 0 ) : ?>
                                        <span class="vigilante-analyzer-category-status vigilante-analyzer-category-status--attention" data-role="info-status">
                                            <span class="dashicons dashicons-warning" aria-hidden="true"></span>
                                            <?php
                                            echo esc_html( sprintf(
                                                /* translators: %d: number of findings */
                                                _n( '%d finding', '%d findings', $info_issues, 'vigilante' ),
                                                $info_issues
                                            ) );
                                            ?>
                                        </span>
                                    <?php else : ?>
                                        <span class="vigilante-analyzer-category-status vigilante-analyzer-category-status--clear" data-role="info-status">
                                            <span class="dashicons dashicons-yes-alt" aria-hidden="true"></span>
                                            <?php esc_html_e( 'All clear', 'vigilante' ); ?>
                                        </span>
                                    <?php endif; ?>
                                <?php endif; ?>
                            </summary>
                            <ul class="vigilante-analyzer-check-list" data-role="check-list">
                                <?php if ( empty( $checks ) ) : ?>
                                    <li class="vigilante-analyzer-check-empty">
                                        <?php esc_html_e( 'No data yet — run a scan to populate this category.', 'vigilante' ); ?>
                                    </li>
                                <?php else : ?>
                                    <?php foreach ( $checks as $c ) : ?>
                                        <?php echo self::render_analyzer_check_row( $c ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Escaped inside helper ?>
                                    <?php endforeach; ?>
                                <?php endif; ?>
                            </ul>
                        </details>
                    <?php endforeach; ?>
                </div>

                <div class="vigilante-analyzer-weekly">
                    <h3><?php esc_html_e( 'Automatic weekly scan', 'vigilante' ); ?></h3>
                    <p class="description">
                        <?php esc_html_e( 'Vigilante runs this check once a week in the background. Enable email alerts to be notified if the score drops by 10 points or more, or if a new critical check starts failing.', 'vigilante' ); ?>
                    </p>
                    <label class="vigilante-analyzer-toggle-option">
                        <input type="checkbox"
                               name="security_analyzer[weekly_scan_enabled]"
                               value="1"
                               <?php checked( $weekly_enabled ); ?>>
                        <?php esc_html_e( 'Run a weekly automatic scan', 'vigilante' ); ?>
                    </label>
                    <label class="vigilante-analyzer-toggle-option">
                        <input type="checkbox"
                               name="security_analyzer[email_on_regression]"
                               value="1"
                               <?php checked( $email_enabled ); ?>>
                        <?php esc_html_e( 'Email me when the score drops significantly', 'vigilante' ); ?>
                    </label>
                </div>
            </div>
        </div>
        <?php
    }

    /**
     * Map a 0-100 percentage to a quality tag { label, slug } aligned with the
     * Dashboard grade palette (a/b/c/d/e).
     *
     * @param int $pct 0..100.
     * @return array{label:string,slug:string}
     */
    public static function analyzer_quality_tag( $pct ) {
        $pct = max( 0, min( 100, (int) $pct ) );
        // "Excellent" is reserved for a perfect score — a single missing point drops to Good.
        if ( 100 === $pct ) {
            return array( 'label' => __( 'Excellent', 'vigilante' ), 'slug' => 'a' );
        }
        if ( $pct >= 70 ) {
            return array( 'label' => __( 'Good', 'vigilante' ), 'slug' => 'b' );
        }
        if ( $pct >= 50 ) {
            return array( 'label' => __( 'Fair', 'vigilante' ), 'slug' => 'c' );
        }
        if ( $pct >= 30 ) {
            return array( 'label' => __( 'Poor', 'vigilante' ), 'slug' => 'd' );
        }
        return array( 'label' => __( 'Critical', 'vigilante' ), 'slug' => 'e' );
    }

    /**
     * Render a single analyzer check row (used both server-side and via JS template).
     *
     * @param array $check Check result array (from Vigilante_SA_Check_Result::to_array()).
     * @return string HTML (escaped).
     */
    private static function render_analyzer_check_row( $check ) {
        $id       = isset( $check['id'] ) ? $check['id'] : '';
        $state    = isset( $check['state'] ) ? $check['state'] : 'skip';
        $label    = isset( $check['label'] ) ? $check['label'] : '';
        $detail   = isset( $check['detail'] ) ? $check['detail'] : '';
        $score    = isset( $check['score'] ) ? (int) $check['score'] : 0;
        $max      = isset( $check['max'] ) ? (int) $check['max'] : 0;
        $fix_link = isset( $check['fix_link'] ) ? $check['fix_link'] : '';

        $icons = array(
            'pass' => 'yes-alt',
            'warn' => 'warning',
            'fail' => 'dismiss',
            'info' => 'info',
            'skip' => 'minus',
        );
        $icon = isset( $icons[ $state ] ) ? $icons[ $state ] : 'minus';

        $html  = '<li class="vigilante-analyzer-check vigilante-analyzer-check--' . esc_attr( $state ) . '"';
        $html .= ' data-check-id="' . esc_attr( $id ) . '">';
        $html .= '<span class="vigilante-analyzer-check-icon dashicons dashicons-' . esc_attr( $icon ) . '" aria-hidden="true"></span>';
        $html .= '<div class="vigilante-analyzer-check-body">';
        $html .= '<div class="vigilante-analyzer-check-label">';
        $html .= '<span>' . esc_html( $label ) . '</span>';
        if ( $max > 0 && 'info' !== $state && 'skip' !== $state ) {
            $html .= '<span class="vigilante-analyzer-check-score">'
                  . esc_html( $score . '/' . $max )
                  . ' <span class="vigilante-analyzer-check-score-unit">' . esc_html__( 'pts', 'vigilante' ) . '</span>'
                  . '</span>';
        }
        $html .= '</div>';
        if ( $detail ) {
            $html .= '<p class="vigilante-analyzer-check-detail">' . esc_html( $detail ) . '</p>';
        }
        if ( $fix_link && in_array( $state, array( 'fail', 'warn' ), true ) ) {
            $html .= '<a href="' . esc_url( $fix_link ) . '" class="vigilante-analyzer-fix-link">'
                  . esc_html__( 'Go to setting', 'vigilante' )
                  . '<span class="vigilante-analyzer-fix-arrow" aria-hidden="true">&rarr;</span></a>';
        } elseif ( $fix_link && 'info' === $state ) {
            // Info rows (e.g. DNSBL lookups) get an external "Learn more" link instead.
            $is_external = 0 === strpos( $fix_link, 'http' );
            $html .= '<a href="' . esc_url( $fix_link ) . '" class="vigilante-analyzer-fix-link"'
                  . ( $is_external ? ' target="_blank" rel="noopener noreferrer"' : '' ) . '>'
                  . esc_html__( 'Learn more', 'vigilante' )
                  . '<span class="vigilante-analyzer-fix-arrow" aria-hidden="true">&rarr;</span></a>';
        }
        $html .= '</div>';
        $html .= '</li>';
        return $html;
    }

    /**
     * Build a minimal SVG sparkline for the score history.
     *
     * @param int[] $points Score values (0..100), oldest to newest.
     * @return string SVG markup.
     */
    private static function sparkline_svg( $points ) {
        $points = array_map( 'intval', (array) $points );
        $count  = count( $points );
        if ( $count < 2 ) {
            return '';
        }
        $width   = 280;
        $height  = 60;
        $padding = 4;

        $usable_w = $width - ( $padding * 2 );
        $usable_h = $height - ( $padding * 2 );

        $step = $usable_w / max( 1, $count - 1 );
        $max  = 100; // Fixed scale — scores are 0..100.

        $coords = array();
        foreach ( $points as $i => $v ) {
            $x        = $padding + ( $i * $step );
            $y        = $padding + ( $usable_h - ( ( $v / $max ) * $usable_h ) );
            $coords[] = round( $x, 2 ) . ',' . round( $y, 2 );
        }
        $path     = 'M ' . implode( ' L ', $coords );
        $last     = end( $points );
        $last_x   = $padding + ( ( $count - 1 ) * $step );
        $last_y   = $padding + ( $usable_h - ( ( $last / $max ) * $usable_h ) );

        $svg  = '<svg viewBox="0 0 ' . $width . ' ' . $height . '" preserveAspectRatio="none" role="img" aria-label="' . esc_attr__( 'Security Score history', 'vigilante' ) . '" focusable="false">';
        $svg .= '<path d="' . esc_attr( $path ) . '" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>';
        $svg .= '<circle cx="' . esc_attr( round( $last_x, 2 ) ) . '" cy="' . esc_attr( round( $last_y, 2 ) ) . '" r="3" fill="currentColor"/>';
        $svg .= '</svg>';
        return $svg;
    }

    /**
     * Render dashboard tab
     */
    private function render_tab_dashboard() {
        $options = $this->settings->get_all_options();
        $module_labels = $this->settings->get_module_labels();
        $module_descriptions = $this->settings->get_module_descriptions();
        $presets = $this->settings->get_presets();
        $active_preset = get_option( 'vigilante_active_preset', '' );

        // Calculate security score with more factors
        $security_score = $this->calculate_security_score( $options );

        // Security Analyzer (v2.1.0) — hydrate widget with the last persisted scan, if any.
        if ( ! class_exists( 'Vigilante_Security_Analyzer' ) ) {
            require_once VIGILANTE_INCLUDES_DIR . 'class-security-analyzer.php';
        }
        $analyzer_instance       = new Vigilante_Security_Analyzer( $this->settings, $this->activity_log );
        $analyzer_last_scan      = $analyzer_instance->get_last_scan();
        $analyzer_history        = $analyzer_instance->get_score_history();
        $analyzer_categories_def = Vigilante_Security_Analyzer::get_categories();
        $analyzer_settings       = isset( $options['security_analyzer'] ) ? $options['security_analyzer'] : array();
        ?>
        <div class="vigilante-dashboard">
            <div class="vigilante-status-card">
                <h2><?php esc_html_e( 'Configuration Score', 'vigilante' ); ?></h2>
                <p class="vigilante-score-kind description">
                    <?php esc_html_e( 'How well Vigilante is configured right now. Pair it with the Security Check below to see the real-world result.', 'vigilante' ); ?>
                </p>
                <div class="vigilante-security-score">
                    <?php
                    // Grade thresholds: A (90+), B (70-89), C (50-69), D (30-49), E (0-29)
                    if ( $security_score >= 90 ) {
                        $grade = 'A';
                    } elseif ( $security_score >= 70 ) {
                        $grade = 'B';
                    } elseif ( $security_score >= 50 ) {
                        $grade = 'C';
                    } elseif ( $security_score >= 30 ) {
                        $grade = 'D';
                    } else {
                        $grade = 'E';
                    }
                    ?>
                    <div class="vigilante-score-circle vigilante-grade-<?php echo esc_attr( strtolower( $grade ) ); ?>">
                        <span class="vigilante-grade"><?php echo esc_html( $grade ); ?></span>
                        <span class="vigilante-score-text"><?php echo esc_html( $security_score ); ?>%</span>
                    </div>
                    <div class="vigilante-config-status">
                        <?php if ( $active_preset && isset( $presets[ $active_preset ] ) ) : ?>
                            <span class="vigilante-preset-badge vigilante-preset-<?php echo esc_attr( $active_preset ); ?>">
                                <?php echo esc_html( $presets[ $active_preset ]['name'] ); ?>
                            </span>
                        <?php else : ?>
                            <span class="vigilante-preset-badge vigilante-preset-custom">
                                <?php esc_html_e( 'Custom Configuration', 'vigilante' ); ?>
                            </span>
                        <?php endif; ?>
                    </div>
                </div>
                
                <?php 
                $recommendations = $this->get_security_recommendations( $options );
                if ( ! empty( $recommendations ) ) : 
                ?>
                <div class="vigilante-recommendations">
                    <h4><?php esc_html_e( 'Recommendations', 'vigilante' ); ?></h4>
                    <ul class="vigilante-recommendations-grid">
                        <?php foreach ( $recommendations as $rec ) : ?>
                        <li>
                            <span class="dashicons dashicons-<?php echo esc_attr( $rec['icon'] ); ?> vigilante-priority-<?php echo esc_attr( $rec['priority'] ); ?>"></span>
                            <?php echo esc_html( $rec['message'] ); ?>
                            <?php if ( ! empty( $rec['tab'] ) ) : ?>
                                <a href="<?php echo esc_url( admin_url( 'admin.php?page=vigilante&tab=' . $rec['tab'] ) ); ?>" class="vigilante-rec-link" title="<?php esc_attr_e( 'Go to settings', 'vigilante' ); ?>"><span class="dashicons dashicons-arrow-right-alt2"></span></a>
                            <?php endif; ?>
                        </li>
                        <?php endforeach; ?>
                    </ul>
                </div>
                <?php endif; ?>
            </div>

            <?php $this->render_analyzer_widget( $analyzer_last_scan, $analyzer_history, $analyzer_categories_def, $analyzer_settings ); ?>

            <div class="vigilante-modules-grid">
                <h2 id="vigilante-section-dashboard-modules"><?php esc_html_e( 'Security Modules', 'vigilante' ); ?></h2>
                <p class="description"><?php esc_html_e( 'Enable or disable security modules. Each module controls a tab with detailed settings.', 'vigilante' ); ?></p>
                <div class="vigilante-modules-list">
                    <?php foreach ( $options['modules'] as $module => $enabled ) :
                        $label = isset( $module_labels[ $module ] ) ? $module_labels[ $module ] : ucwords( str_replace( '_', ' ', $module ) );
                        $description = isset( $module_descriptions[ $module ] ) ? $module_descriptions[ $module ] : '';
                        $vg_module_locked = $this->main_site_files_locked() && in_array( $module, Vigilante_Settings::get_main_site_file_settings()['modules'], true );
                        ?>
                        <div class="vigilante-module-item <?php echo $enabled ? 'enabled' : 'disabled'; ?>">
                            <div class="vigilante-module-header">
                                <span class="vigilante-module-status"></span>
                                <span class="vigilante-module-name"><?php echo esc_html( $label ); ?></span>
                                <label class="vigilante-toggle">
                                    <?php
                                    /* translators: %s: Security module name, for example Firewall. */
                                    $toggle_label = sprintf( __( 'Enable %s', 'vigilante' ), $label );
                                    ?>
                                    <input type="checkbox"
                                           name="modules[<?php echo esc_attr( $module ); ?>]"
                                           value="1"
                                           <?php checked( $enabled ); ?>
                                           <?php disabled( $vg_module_locked ); ?>
                                           aria-label="<?php echo esc_attr( $toggle_label ); ?>"
                                           data-module="<?php echo esc_attr( $module ); ?>">
                                    <span class="vigilante-toggle-slider"></span>
                                </label>
                            </div>
                            <?php if ( $description ) : ?>
                            <p class="vigilante-module-desc"><?php echo esc_html( $description ); ?></p>
                            <?php endif; ?>
                            <?php if ( $vg_module_locked ) : ?>
                            <p class="vigilante-module-desc"><?php esc_html_e( 'On the main site of a network this module also writes files every site shares, so only a network administrator can switch it.', 'vigilante' ); ?></p>
                            <?php endif; ?>
                        </div>
                    <?php endforeach; ?>
                </div>
            </div>

            <div class="vigilante-presets-card">
                <h2><?php esc_html_e( 'Quick Configuration Presets', 'vigilante' ); ?></h2>
                <p><?php esc_html_e( 'Apply a preset to quickly set up recommended settings for standard or maximum security level.', 'vigilante' ); ?></p>
                <div class="vigilante-presets-grid">
                    <?php foreach ( $presets as $preset_id => $preset ) : 
                        $is_active = ( $active_preset === $preset_id );
                    ?>
                    <div class="vigilante-preset-card <?php echo $is_active ? 'vigilante-preset-active' : ''; ?>">
                        <?php if ( $is_active ) : ?>
                        <span class="vigilante-active-indicator"><?php esc_html_e( 'Active', 'vigilante' ); ?></span>
                        <?php endif; ?>
                        <h3><?php echo esc_html( $preset['name'] ); ?></h3>
                        <p><?php echo esc_html( $preset['description'] ); ?></p>
                        <button type="button" class="button vigilante-preset-btn <?php echo $is_active ? 'button-primary' : ''; ?>" data-preset="<?php echo esc_attr( $preset_id ); ?>">
                            <?php esc_html_e( 'Apply Preset', 'vigilante' ); ?>
                        </button>
                    </div>
                    <?php endforeach; ?>

                    <?php
                    // Under Attack mode card
                    $under_attack        = new Vigilante_Under_Attack( $this->settings, $this->activity_log );
                    $ua_active           = $under_attack->is_active();
                    $ua_remaining        = $under_attack->get_remaining_time();
                    $ua_remaining_hours  = floor( $ua_remaining / 3600 );
                    $ua_remaining_mins   = floor( ( $ua_remaining % 3600 ) / 60 );
                    ?>
                    <div class="vigilante-preset-card vigilante-under-attack-card <?php echo $ua_active ? 'vigilante-under-attack-active' : ''; ?>">
                        <h3 id="vigilante-section-dashboard-under-attack">
                            <span class="dashicons dashicons-shield"></span>
                            <?php esc_html_e( 'Under Attack', 'vigilante' ); ?>
                        </h3>
                        <p><?php esc_html_e( 'Emergency mode. JavaScript challenge for all visitors, aggressive rate limiting, and restricted access. Auto-deactivates after 4 hours.', 'vigilante' ); ?></p>
                        <?php if ( $ua_active ) : ?>
                        <div class="vigilante-ua-countdown" data-expires="<?php echo esc_attr( $under_attack->get_status()['activated_at'] + $under_attack->get_status()['duration'] ); ?>">
                            <span class="dashicons dashicons-clock"></span>
                            <span class="vigilante-ua-time">
                                <?php
                                printf(
                                    /* translators: 1: Hours, 2: Minutes */
                                    esc_html__( '%1$dh %2$dm remaining', 'vigilante' ),
                                    absint( $ua_remaining_hours ),
                                    absint( $ua_remaining_mins )
                                );
                                ?>
                            </span>
                        </div>
                        <button type="button" class="button vigilante-ua-btn vigilante-ua-deactivate">
                            <?php esc_html_e( 'Deactivate', 'vigilante' ); ?>
                        </button>
                        <?php else : ?>
                        <button type="button" class="button vigilante-ua-btn vigilante-ua-activate">
                            <?php esc_html_e( 'Activate for 4 hours', 'vigilante' ); ?>
                        </button>
                        <?php endif; ?>
                    </div>
                </div>
            </div>
        </div>
        <?php
    }

    /**
     * Render tools tab
     */
    private function render_tab_tools() {
        // Get current settings for notification summary
        $email_options     = $this->settings->get_section( 'email' );
        $login_options     = $this->settings->get_section( 'login_security' );
        $user_options      = $this->settings->get_section( 'user_security' );
        $fi_options        = $this->settings->get_section( 'file_integrity' );
        $alerts_options    = $this->settings->get_section( 'audit_alerts' );
        $monitoring        = $user_options['admin_monitoring'] ?? array();
        $registration      = $user_options['registration_approval'] ?? array();
        $current_admin     = get_option( 'admin_email' );
        $send_to_admin     = ! isset( $email_options['send_to_admin_email'] ) || ! empty( $email_options['send_to_admin_email'] );
        $additional_raw    = $email_options['additional_recipients'] ?? array();
        $additional        = is_array( $additional_raw ) ? implode( "\n", $additional_raw ) : trim( $additional_raw );
        ?>

        <!-- Notification Settings -->
        <div id="vigilante-section-tools-notifications" class="vigilante-settings-section vigilante-notification-section">
            <h2><?php esc_html_e( 'Notification settings', 'vigilante' ); ?></h2>
            <p><?php esc_html_e( 'Configure who receives all administrative email notifications from Vigilant. Individual notifications are enabled in their respective tabs.', 'vigilante' ); ?></p>

            <div class="vigilante-notification-layout">

                <!-- Left column: Recipients settings -->
                <div class="vigilante-notification-settings">
                    <form class="vigilante-settings-form" data-section="email">

                        <table class="form-table vigilante-compact-form">
                            <tr>
                                <th scope="row"><?php esc_html_e( 'WordPress Admin Email', 'vigilante' ); ?></th>
                                <td>
                                    <label>
                                        <input type="checkbox" name="email[send_to_admin_email]" value="1" <?php checked( $send_to_admin ); ?>>
                                        <?php
                                        printf(
                                            /* translators: %s: Admin email address */
                                            esc_html__( 'Send to admin email (%s)', 'vigilante' ),
                                            '<code>' . esc_html( $current_admin ) . '</code>'
                                        );
                                        ?>
                                    </label>
                                </td>
                            </tr>
                            <tr>
                                <th scope="row"><label for="vigilante-f-email-additional-recipients"><?php esc_html_e( 'Additional Recipients', 'vigilante' ); ?></label></th>
                                <td>
                                    <textarea id="vigilante-f-email-additional-recipients" name="email[additional_recipients]" rows="3" class="large-text code" placeholder="maintenance@example.com&#10;security@example.com"><?php echo esc_textarea( $additional ); ?></textarea>
                                    <p class="description"><?php esc_html_e( 'One email per line.', 'vigilante' ); ?></p>
                                </td>
                            </tr>
                            <tr>
                                <th scope="row"><?php esc_html_e( 'Plugin Deactivation', 'vigilante' ); ?></th>
                                <td>
                                    <label>
                                        <input type="checkbox" name="email[send_deactivation_email]" value="1" <?php checked( ! empty( $email_options['send_deactivation_email'] ) ); ?>>
                                        <?php esc_html_e( 'Send email when Vigilant is deactivated', 'vigilante' ); ?>
                                    </label>
                                </td>
                            </tr>
                        </table>

                        <p class="submit vigilante-notification-submit">
                            <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                                <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                            </button>
                            <button type="button" class="button vigilante-test-email-btn" data-original-text="<?php esc_attr_e( 'Send test email', 'vigilante' ); ?>">
                                <?php esc_html_e( 'Send test email', 'vigilante' ); ?>
                            </button>
                            <span class="vigilante-test-email-result" style="margin-left:8px;vertical-align:middle;"></span>
                        </p>
                        <p class="description"><?php esc_html_e( 'The test goes to the recipients above and confirms that email delivery works for every Vigilant notification.', 'vigilante' ); ?></p>

                    </form>
                </div>

                <!-- Right column: Active notifications summary -->
                <div class="vigilante-notification-summary">
                    <h4><?php esc_html_e( 'Active notifications', 'vigilante' ); ?></h4>

                    <table class="widefat striped">
                        <thead>
                            <tr>
                                <th><?php esc_html_e( 'Notification', 'vigilante' ); ?></th>
                                <th style="width: 1%; white-space: nowrap; text-align: center;"><?php esc_html_e( 'Status', 'vigilante' ); ?></th>
                                <th style="width: 50px; text-align: center;"></th>
                            </tr>
                        </thead>
                        <tbody>
                            <?php
                            $notifications = array(
                                array(
                                    'label'  => __( 'Login lockout', 'vigilante' ),
                                    'active' => ! empty( $login_options['notify_on_lockout'] ),
                                    'tab'    => 'login',
                                ),
                                array(
                                    'label'  => __( 'Administrator login', 'vigilante' ),
                                    'active' => ! empty( $login_options['notify_on_admin_login'] ),
                                    'tab'    => 'login',
                                ),
                                array(
                                    'label'  => __( 'New administrator created', 'vigilante' ),
                                    'active' => ! empty( $monitoring['alert_new_admin'] ),
                                    'tab'    => 'users',
                                ),
                                array(
                                    'label'  => __( 'Administrator email changed', 'vigilante' ),
                                    'active' => ! empty( $monitoring['alert_admin_email_change'] ),
                                    'tab'    => 'users',
                                ),
                                array(
                                    'label'  => __( 'Permission elevation', 'vigilante' ),
                                    'active' => ! empty( $monitoring['alert_permission_elevation'] ),
                                    'tab'    => 'users',
                                ),
                                array(
                                    'label'  => __( 'Admin password changed', 'vigilante' ),
                                    'active' => ! empty( $monitoring['alert_admin_password_change'] ),
                                    'tab'    => 'users',
                                ),
                                array(
                                    'label'  => __( 'Registration pending approval', 'vigilante' ),
                                    'active' => ! empty( $registration['enabled'] ) && ! empty( $registration['notify_admin'] ),
                                    'tab'    => 'users',
                                ),
                                array(
                                    'label'  => __( 'File integrity scan report', 'vigilante' ),
                                    'active' => ( $fi_options['notify_level'] ?? 'disabled' ) !== 'disabled',
                                    'tab'    => 'file-integrity',
                                ),
                                array(
                                    'label'  => __( 'File integrity instant alert', 'vigilante' ),
                                    'active' => ! empty( $fi_options['instant_alert'] ),
                                    'tab'    => 'file-integrity',
                                ),
                                array(
                                    'label'  => __( 'Audit alert: immediate', 'vigilante' ),
                                    'active' => Vigilante_Audit_Alerts::immediate_is_active( $alerts_options ),
                                    'tab'    => 'activity-log',
                                    'anchor' => 'vigilante-section-audit-alerts',
                                ),
                                array(
                                    'label'  => __( 'Audit alert: threshold', 'vigilante' ),
                                    'active' => Vigilante_Audit_Alerts::threshold_is_active( $alerts_options ),
                                    'tab'    => 'activity-log',
                                    'anchor' => 'vigilante-section-audit-alerts',
                                ),
                                array(
                                    'label'  => __( 'Under Attack mode', 'vigilante' ),
                                    'active' => true,
                                    'tab'    => '',
                                    'note'   => __( 'Always active', 'vigilante' ),
                                ),
                                array(
                                    'label'  => __( 'Plugin deactivation', 'vigilante' ),
                                    'active' => ! empty( $email_options['send_deactivation_email'] ),
                                    'tab'    => 'tools',
                                ),
                            );

                            foreach ( $notifications as $notif ) :
                                $status_class = $notif['active'] ? 'vigilante-status-active' : 'vigilante-status-inactive';
                                $status_label = $notif['active'] ? __( 'Active', 'vigilante' ) : __( 'Inactive', 'vigilante' );
                                if ( ! empty( $notif['note'] ) ) {
                                    $status_label = $notif['note'];
                                }
                            ?>
                            <tr>
                                <td><?php echo esc_html( $notif['label'] ); ?></td>
                                <td style="text-align: center; white-space: nowrap;">
                                    <span class="<?php echo esc_attr( $status_class ); ?>"><?php echo esc_html( $status_label ); ?></span>
                                </td>
                                <td style="text-align: center;">
                                    <?php if ( ! empty( $notif['tab'] ) ) : ?>
                                        <a href="<?php echo esc_url( admin_url( 'admin.php?page=vigilante&tab=' . $notif['tab'] ) . ( ! empty( $notif['anchor'] ) ? '#' . $notif['anchor'] : '' ) ); ?>" class="button button-small">
                                            <span class="dashicons dashicons-admin-generic" style="font-size: 14px; line-height: 1.8;"></span>
                                        </a>
                                    <?php else : ?>
                                        &mdash;
                                    <?php endif; ?>
                                </td>
                            </tr>
                            <?php endforeach; ?>
                        </tbody>
                    </table>
                </div>

            </div>
        </div>

        <h2 id="vigilante-section-tools-main" class="vigilante-tools-heading"><?php esc_html_e( 'Tools', 'vigilante' ); ?></h2>

        <?php
        // Warn that during Under Attack mode the export/import operate against
        // the temporary hardened config and any imported changes will be
        // reverted when the mode ends.
        $ua_status = get_option( Vigilante_Under_Attack::OPTION_NAME, array() );
        if ( ! empty( $ua_status['active'] ) ) :
            ?>
            <div class="vigilante-ua-tools-notice-wrap">
                <div class="notice notice-warning inline vigilante-ua-tools-notice">
                    <p>
                        <strong><?php esc_html_e( 'Under Attack mode is active.', 'vigilante' ); ?></strong>
                        <?php esc_html_e( 'Exports will reflect the temporary hardened configuration, not your saved one. Imports will apply on top of the hardened config and will be reverted when the mode ends. Consider waiting until you deactivate Under Attack before exporting or importing settings.', 'vigilante' ); ?>
                    </p>
                </div>
            </div>
            <?php
        endif;
        ?>

        <div class="vigilante-tools-grid">
            <div class="vigilante-tool-card">
                <h3><?php esc_html_e( 'Export Settings', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Download your current security settings as a JSON file.', 'vigilante' ); ?></p>
                <button type="button" class="button vigilante-export-settings">
                    <?php esc_html_e( 'Export Settings', 'vigilante' ); ?>
                </button>
            </div>

            <div class="vigilante-tool-card">
                <h3><?php esc_html_e( 'Import Settings', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Import settings from a previously exported JSON file.', 'vigilante' ); ?></p>
                <input type="file" id="vigilante-import-file" aria-label="<?php esc_attr_e( 'Configuration file to import', 'vigilante' ); ?>" accept=".json" style="display: none;">
                <button type="button" class="button vigilante-import-settings">
                    <?php esc_html_e( 'Import Settings', 'vigilante' ); ?>
                </button>
            </div>

            <div class="vigilante-tool-card">
                <h3><?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Reset all the Vigilant security settings to default values. Your IP lists, custom login address, two-factor setup, scan exclusions and extra alert recipients are kept.', 'vigilante' ); ?></p>
                <button type="button" class="button vigilante-reset-settings" style="color: #a00;">
                    <?php esc_html_e( 'Reset All Settings', 'vigilante' ); ?>
                </button>
            </div>

            <div class="vigilante-tool-card">
                <h3><?php esc_html_e( 'Download Config Backup', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Download a ZIP backup of your wp-config.php and .htaccess (plus robots.txt if present) before making security changes. The archive is built on the fly and sent to your browser, so nothing is left on the server.', 'vigilante' ); ?></p>
                <?php if ( $this->shared_files_locked() ) : ?>
                    <p class="description"><?php esc_html_e( 'Both files belong to the whole network, and wp-config.php carries the database credentials and the authentication salts of every site. The copy is taken from the main site.', 'vigilante' ); ?></p>
                <?php else : ?>
                <button type="button" class="button vigilante-create-backup">
                    <?php esc_html_e( 'Download Backup', 'vigilante' ); ?>
                </button>
                <?php endif; ?>
            </div>

            <?php if ( ! $this->shared_files_locked() ) : ?>

            <div class="vigilante-tool-card vigilante-tool-card-wide">
                <h3><?php esc_html_e( 'Database Backup', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Download a backup of your database as a ZIP file. Select which tables to include.', 'vigilante' ); ?></p>
                <button type="button" class="button vigilante-db-backup-toggle">
                    <?php esc_html_e( 'Download Database Backup', 'vigilante' ); ?>
                </button>

                <div class="vigilante-db-backup-panel" style="display: none;">
                    <div class="vigilante-db-tables-loading">
                        <span class="spinner is-active"></span>
                        <?php esc_html_e( 'Loading tables...', 'vigilante' ); ?>
                    </div>

                    <div class="vigilante-db-tables-content" style="display: none;">
                        <div class="vigilante-db-tables-controls">
                            <label>
                                <input type="checkbox" id="vigilante-db-select-all" checked>
                                <strong><?php esc_html_e( 'Select / deselect all', 'vigilante' ); ?></strong>
                            </label>
                            <span class="vigilante-db-tables-info"></span>
                        </div>

                        <div class="vigilante-db-tables-group">
                            <h4><?php esc_html_e( 'WordPress core tables', 'vigilante' ); ?></h4>
                            <div class="vigilante-db-tables-list" id="vigilante-db-core-tables"></div>
                        </div>

                        <div class="vigilante-db-tables-group" id="vigilante-db-other-group" style="display: none;">
                            <h4><?php esc_html_e( 'Plugin and custom tables', 'vigilante' ); ?></h4>
                            <div class="vigilante-db-tables-list" id="vigilante-db-other-tables"></div>
                        </div>

                        <div class="vigilante-db-backup-actions">
                            <button type="button" class="button button-primary vigilante-db-backup-download">
                                <?php esc_html_e( 'Download Backup (.zip)', 'vigilante' ); ?>
                            </button>
                        </div>
                    </div>
                </div>
            </div>
            <?php else : ?>
            <div class="vigilante-tool-card vigilante-tool-card-wide">
                <h3><?php esc_html_e( 'Database Backup', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Download a backup of your database as a ZIP file. Select which tables to include.', 'vigilante' ); ?></p>
                <p class="description"><?php esc_html_e( 'The database is shared by the whole network, so a backup taken here would carry every other site and all of the network users. The copy is taken from the main site.', 'vigilante' ); ?></p>
            </div>
            <?php endif; ?>
        </div>
        <?php
    }

    /**
     * Render firewall tab
     */
    private function render_tab_firewall() {
        $is_disabled = $this->render_module_disabled_notice( 'firewall' );
        $options = $this->settings->get_section( 'firewall' );
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="firewall" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <div id="vigilante-section-firewall-main" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Firewall Protection', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'PHP-based request filtering. Analyzes each request before WordPress loads.', 'vigilante' ); ?></p>
                <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;">
                    <p style="margin:0;">
                        <?php esc_html_e( 'Full page caching systems that serve cached pages before PHP executes (Varnish, LiteSpeed Cache, NGINX FastCGI Cache, Cloudflare APO) may bypass PHP-level firewall rules for cached requests. The .htaccess rules will still apply on Apache/LiteSpeed servers.', 'vigilante' ); ?>
                    </p>
                </div>

                <?php $vg_main_locked = $this->main_site_files_locked(); ?>
                <?php if ( $vg_main_locked ) : ?>
                <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;">
                    <p style="margin:0;"><?php esc_html_e( 'On the main site of a network, blocking bad bots and bad query strings, the visitor IP detection and the two whitelists also build the .htaccess rules every site shares, so only a network administrator can change them.', 'vigilante' ); ?></p>
                </div>
                <?php endif; ?>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Block Bad Query Strings', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[block_bad_query_strings]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( ! empty( $options['block_bad_query_strings'] ) ); ?>>
                                <?php esc_html_e( 'Block malicious query string patterns', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'SQL Injection Protection', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[block_sql_injection]" value="1" <?php checked( ! empty( $options['block_sql_injection'] ) ); ?>>
                                <?php esc_html_e( 'Block SQL injection attempts', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'XSS Protection', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[block_xss_attacks]" value="1" <?php checked( ! empty( $options['block_xss_attacks'] ) ); ?>>
                                <?php esc_html_e( 'Block cross-site scripting attacks', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'File Inclusion Protection', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[block_file_inclusion]" value="1" <?php checked( ! empty( $options['block_file_inclusion'] ) ); ?>>
                                <?php esc_html_e( 'Block local/remote file inclusion attempts', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Directory Traversal Protection', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[block_directory_traversal]" value="1" <?php checked( ! empty( $options['block_directory_traversal'] ) ); ?>>
                                <?php esc_html_e( 'Block path traversal attempts', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Block Bad Bots', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[block_bad_bots]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( ! empty( $options['block_bad_bots'] ) ); ?>>
                                <?php esc_html_e( 'Block known malicious bots and scanners', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>

                <h3><?php esc_html_e( 'Rate Limiting', 'vigilante' ); ?></h3>
                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable Rate Limiting', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[rate_limiting][enabled]" value="1" <?php checked( ! empty( $options['rate_limiting']['enabled'] ) ); ?>>
                                <?php esc_html_e( 'Limit requests per IP address', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-rate-limiting-requests-per-minute"><?php esc_html_e( 'Requests per Minute', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-firewall-rate-limiting-requests-per-minute" type="number" name="firewall[rate_limiting][requests_per_minute]" value="<?php echo esc_attr( $options['rate_limiting']['requests_per_minute'] ?? 120 ); ?>" min="10" max="500" class="small-text">
                            <p class="description">
                                <?php esc_html_e( 'Counts only PHP requests to WordPress (pages, admin-ajax, REST, login) from a single IP, not static assets like images, CSS or JS. 120/min suits most sites; sustained traffic above that from one IP is usually a bot. To allow a legitimate service, whitelist its IP instead of raising the limit.', 'vigilante' ); ?>
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-rate-limiting-block-duration"><?php esc_html_e( 'Block Duration (seconds)', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-firewall-rate-limiting-block-duration" type="number" name="firewall[rate_limiting][block_duration]" value="<?php echo esc_attr( $options['rate_limiting']['block_duration'] ?? 300 ); ?>" min="60" max="3600" class="small-text">
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Progressive Blocking', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[rate_limiting][progressive]" value="1" <?php checked( ! empty( $options['rate_limiting']['progressive'] ) ); ?>>
                                <?php esc_html_e( 'Double block duration on each repeat offense', 'vigilante' ); ?>
                            </label>
                            <p class="description">
                                <?php
                                $base = absint( $options['rate_limiting']['block_duration'] ?? 300 );
                                printf(
                                    /* translators: 1: First block duration, 2: Second, 3: Third */
                                    esc_html__( 'Example: %1$s → %2$s → %3$s and so on, up to the maximum.', 'vigilante' ),
                                    esc_html( human_time_diff( 0, $base ) ),
                                    esc_html( human_time_diff( 0, $base * 2 ) ),
                                    esc_html( human_time_diff( 0, $base * 4 ) )
                                );
                                ?>
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-rate-limiting-max-block-duration"><?php esc_html_e( 'Maximum Block Duration', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-firewall-rate-limiting-max-block-duration" name="firewall[rate_limiting][max_block_duration]">
                                <?php
                                $max_options = array(
                                    3600   => __( '1 hour', 'vigilante' ),
                                    21600  => __( '6 hours', 'vigilante' ),
                                    43200  => __( '12 hours', 'vigilante' ),
                                    86400  => __( '24 hours', 'vigilante' ),
                                    604800 => __( '7 days', 'vigilante' ),
                                );
                                $current_max = absint( $options['rate_limiting']['max_block_duration'] ?? 86400 );
                                foreach ( $max_options as $val => $label ) :
                                    ?>
                                    <option value="<?php echo esc_attr( $val ); ?>" <?php selected( $current_max, $val ); ?>>
                                        <?php echo esc_html( $label ); ?>
                                    </option>
                                <?php endforeach; ?>
                            </select>
                            <p class="description"><?php esc_html_e( 'Upper limit for progressive blocking.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>

                <?php
                // Currently blocked IPs from rate limiting
                $active_blocks = Vigilante_Firewall::get_active_blocks();
                if ( ! empty( $active_blocks ) ) :
                ?>
                <div class="vigilante-settings-section vigilante-lockout-section" style="margin-top:20px;">
                    <h3><?php esc_html_e( 'Currently Blocked IPs', 'vigilante' ); ?></h3>
                    <table class="wp-list-table widefat fixed striped" style="max-width:800px;">
                        <thead>
                            <tr>
                                <th><?php esc_html_e( 'IP Address', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Blocked', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Expires in', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Strikes', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Action', 'vigilante' ); ?></th>
                            </tr>
                        </thead>
                        <tbody>
                            <?php foreach ( $active_blocks as $blocked_ip => $block_data ) : ?>
                                <tr>
                                    <td><code><?php echo esc_html( $blocked_ip ); ?></code></td>
                                    <td><?php echo esc_html( human_time_diff( $block_data['blocked_at'] ) . ' ' . __( 'ago', 'vigilante' ) ); ?></td>
                                    <td><?php echo esc_html( human_time_diff( time(), $block_data['expires'] ) ); ?></td>
                                    <td><?php echo esc_html( $block_data['strikes'] ?? 1 ); ?></td>
                                    <td>
                                        <button type="button" class="button button-small vigilante-unblock-firewall-ip"
                                            data-ip="<?php echo esc_attr( $blocked_ip ); ?>">
                                            <?php esc_html_e( 'Unblock', 'vigilante' ); ?>
                                        </button>
                                    </td>
                                </tr>
                            <?php endforeach; ?>
                        </tbody>
                    </table>
                </div>
                <?php endif; ?>

                <?php
                // Since 2.11.8 X-Forwarded-For is read from its end, where the proxy
                // writes. The administrator's own request shows whether that end is
                // a CDN or a balancer for everybody here. Cross review of 2.11.8.
                $xff_readings = $this->forwarded_chain_readings();
                if ( $xff_readings ) :
                    ?>
                <div id="vigilante-xff-chain-notice" class="notice notice-warning inline" style="margin:10px 0 16px;padding:8px 12px;">
                    <p style="margin:0;">
                        <?php
                        printf(
                            /* translators: 1: last address in the header, the one Vigilant reads, 2: first address in the header, which a visitor can write */
                            esc_html__( 'Your own request reaches the site with more than one public address in X-Forwarded-For. Vigilant reads the last one, %1$s, which is the one your proxy added, and not the first one, %2$s, which a visitor can write. If %1$s belongs to a CDN or a load balancer rather than to you, every visitor shares it for rate limiting, login lockouts and the IP lists: choose the header of that CDN in Visitor IP detection, such as CF-Connecting-IP for Cloudflare.', 'vigilante' ),
                            esc_html( $xff_readings['now'] ),
                            esc_html( $xff_readings['before'] )
                        );
                        ?>
                    </p>
                </div>
                <?php endif; ?>

                <h3><?php esc_html_e( 'IP Lists', 'vigilante' ); ?></h3>
                <p class="description">
                    <?php
                    printf(
                        /* translators: %s: Current visitor IP address */
                        esc_html__( 'Your current IP address: %s', 'vigilante' ),
                        '<code>' . esc_html( $this->database->get_client_ip() ) . '</code>'
                    );
                    ?>
                </p>
                <table class="form-table">
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-trusted-proxy-header"><?php esc_html_e( 'Visitor IP detection', 'vigilante' ); ?></label></th>
                        <td>
                            <?php $proxy_header = $options['trusted_proxy_header'] ?? ''; ?>
                            <select id="vigilante-f-firewall-trusted-proxy-header" name="firewall[trusted_proxy_header]" <?php disabled( $vg_main_locked ); ?>>
                                <option value="" <?php selected( $proxy_header, '' ); ?>><?php esc_html_e( 'Direct connection, only REMOTE_ADDR (recommended)', 'vigilante' ); ?></option>
                                <option value="cf-connecting-ip" <?php selected( $proxy_header, 'cf-connecting-ip' ); ?>><?php esc_html_e( 'Behind Cloudflare (CF-Connecting-IP)', 'vigilante' ); ?></option>
                                <option value="x-forwarded-for" <?php selected( $proxy_header, 'x-forwarded-for' ); ?>><?php esc_html_e( 'Behind a reverse proxy or load balancer (X-Forwarded-For)', 'vigilante' ); ?></option>
                                <option value="x-real-ip" <?php selected( $proxy_header, 'x-real-ip' ); ?>><?php esc_html_e( 'Behind an nginx proxy (X-Real-IP)', 'vigilante' ); ?></option>
                            </select>
                            <p class="description">
                                <?php esc_html_e( 'Where to read the visitor IP from. Leave on "Direct connection" unless your site really sits behind that proxy or CDN. Trusting a forwarded header on a site that is not behind it lets visitors spoof their IP and bypass the IP lists and rate limiting.', 'vigilante' ); ?>
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-trusted-proxies"><?php esc_html_e( 'Trusted proxy IPs', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-firewall-trusted-proxies" name="firewall[trusted_proxies]" rows="3" class="large-text code" placeholder="10.0.0.0/8&#10;192.168.1.1" <?php disabled( $vg_main_locked ); ?>><?php echo esc_textarea( implode( "\n", $options['trusted_proxies'] ?? array() ) ); ?></textarea>
                            <p class="description">
                                <?php esc_html_e( 'Only used with a forwarded header selected above. One IP or CIDR range per line: the addresses your proxy or load balancer connects from. The forwarded header is accepted only from these. Left empty, Vigilant accepts it from your own private network, and for Cloudflare from Cloudflare\'s own ranges automatically.', 'vigilante' ); ?>
                                <?php if ( in_array( $proxy_header, array( 'x-forwarded-for', 'x-real-ip' ), true ) && empty( $options['trusted_proxies'] ) ) : ?>
                                    <br><strong><?php esc_html_e( 'The header above is trusted but no proxy IPs are set. If your proxy or load balancer connects from a public address, add it here, or the header is ignored for safety and every visitor is seen as that proxy.', 'vigilante' ); ?></strong>
                                <?php endif; ?>
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-ip-whitelist"><?php esc_html_e( 'IP Whitelist', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-firewall-ip-whitelist" name="firewall[ip_whitelist]" <?php disabled( $vg_main_locked ); ?> rows="4" class="large-text code" placeholder="192.168.1.50&#10;192.168.1.0/24&#10;192.168.1.*"><?php echo esc_textarea( implode( "\n", $options['ip_whitelist'] ?? array() ) ); ?></textarea>
                            <p class="description">
                                <?php esc_html_e( 'One IP per line. These IPs bypass the firewall checks, and they also reach wp-admin when the login URL is hidden, so remote managers such as MainWP or ManageWP are not turned away with a 404. The hidden login form itself stays hidden for every IP, this one included.', 'vigilante' ); ?>
                                <br>
                                <?php
                                printf(
                                    /* translators: 1: opening <code>, 2: closing </code>. Placeholders wrap the IP, CIDR and wildcard examples. */
                                    esc_html__( 'Accepts exact IPs (%1$s192.168.1.50%2$s), CIDR ranges (%1$s192.168.1.0/24%2$s, IPv4 and IPv6), and wildcards with %1$s*%2$s (e.g. %1$s192.168.1.*%2$s).', 'vigilante' ),
                                    '<code>',
                                    '</code>'
                                ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML tags are hardcoded.
                                ?>
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-ip-blacklist"><?php esc_html_e( 'IP Blacklist', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-firewall-ip-blacklist" name="firewall[ip_blacklist]" rows="4" class="large-text code" placeholder="203.0.113.42&#10;203.0.113.0/24&#10;203.0.113.*"><?php echo esc_textarea( implode( "\n", $options['ip_blacklist'] ?? array() ) ); ?></textarea>
                            <p class="description">
                                <?php esc_html_e( 'One IP per line. These IPs will be blocked immediately.', 'vigilante' ); ?>
                                <br>
                                <?php
                                printf(
                                    /* translators: 1: opening <code>, 2: closing </code>. Placeholders wrap the IP, CIDR and wildcard examples. */
                                    esc_html__( 'Accepts exact IPs (%1$s203.0.113.42%2$s), CIDR ranges (%1$s203.0.113.0/24%2$s, IPv4 and IPv6), and wildcards with %1$s*%2$s (e.g. %1$s203.0.113.*%2$s).', 'vigilante' ),
                                    '<code>',
                                    '</code>'
                                ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML tags are hardcoded.
                                ?>
                            </p>
                        </td>
                    </tr>
                </table>

                <h3><?php esc_html_e( 'User-Agent Lists', 'vigilante' ); ?></h3>
                <p><?php esc_html_e( 'Partial matching: enter a keyword and any User-Agent containing it will be matched.', 'vigilante' ); ?></p>
                <table class="form-table">
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-ua-whitelist"><?php esc_html_e( 'User-Agent Whitelist', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-firewall-ua-whitelist" name="firewall[ua_whitelist]" <?php disabled( $vg_main_locked ); ?> rows="4" class="large-text code"><?php echo esc_textarea( implode( "\n", $options['ua_whitelist'] ?? array() ) ); ?></textarea>
                            <p class="description"><?php esc_html_e( 'One User-Agent per line. These will bypass all firewall checks. Example: ManageWP, MainWP, UptimeRobot.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-firewall-ua-blacklist"><?php esc_html_e( 'User-Agent Blacklist', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-firewall-ua-blacklist" name="firewall[ua_blacklist]" rows="4" class="large-text code"><?php echo esc_textarea( implode( "\n", $options['ua_blacklist'] ?? array() ) ); ?></textarea>
                            <p class="description"><?php esc_html_e( 'One User-Agent per line. These will be blocked immediately.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <?php
            $vg_shared_locked = $this->shared_files_locked();
            // Paint what is actually in force, not this site's unused copy.
            $vg_local_options = $options;
            $options = $this->get_section_for_display( 'firewall' );
            ?>
            <?php $this->render_shared_files_notice(); ?>
            <div id="vigilante-section-firewall-server" class="vigilante-settings-section <?php echo $vg_shared_locked ? 'vigilante-form-disabled' : ''; ?>" <?php echo $vg_shared_locked ? 'inert' : ''; ?>>
                <h2>
                    <?php esc_html_e( 'Server Protection', 'vigilante' ); ?>
                    <span class="vigilante-method-badge htaccess"><?php esc_html_e( 'HTACCESS', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Server-level rules for Apache/LiteSpeed. These rules are processed before PHP.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr id="field-disable-directory-browsing">
                        <th scope="row"><?php esc_html_e( 'Directory Browsing', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[disable_directory_browsing]" value="1" <?php checked( ! empty( $options['disable_directory_browsing'] ) ); ?>>
                                <?php esc_html_e( 'Disable directory listing (Options -Indexes)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Protect wp-config.php', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[protect_wp_config]" value="1" <?php checked( ! empty( $options['protect_wp_config'] ) ); ?>>
                                <?php esc_html_e( 'Block direct HTTP access to wp-config.php', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr id="field-protect-wp-cron">
                        <th scope="row"><?php esc_html_e( 'Protect wp-cron.php', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[protect_wp_cron]" value="1" <?php checked( ! empty( $options['protect_wp_cron'] ) ); ?>>
                                <?php esc_html_e( 'Block direct HTTP access to wp-cron.php (prevents cron-spam DoS abuse)', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php
                                printf(
                                    /* translators: 1: opening <strong>, 2: closing </strong> */
                                    esc_html__( '%1$sWarning:%2$s Only enable if your host runs a real server-side cron job calling wp-cron.php (most managed WordPress hosts do; check with your provider). Otherwise scheduled tasks — publishing, updates, emails, backups — stop running. Pair with %3$sDISABLE_WP_CRON%4$s in WP Hardening for full coverage.', 'vigilante' ),
                                    '<strong>',
                                    '</strong>',
                                    '<code>',
                                    '</code>'
                                ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML tags are hardcoded.
                            ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Protect wp-includes', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[protect_wp_includes]" value="1" <?php checked( ! empty( $options['protect_wp_includes'] ) ); ?>>
                                <?php esc_html_e( 'Block direct access to PHP files in wp-includes', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'PHP in Uploads', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[protect_uploads_php]" value="1" <?php checked( ! empty( $options['protect_uploads_php'] ) ); ?>>
                                <?php esc_html_e( 'Block PHP execution in wp-content/uploads', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Sensitive Files', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[protect_sensitive_files]" value="1" <?php checked( ! empty( $options['protect_sensitive_files'] ) ); ?>>
                                <?php esc_html_e( 'Block access to .sql, .bak, .log, .ini, readme.html, license.txt, licencia.txt', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Limit HTTP Methods', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="firewall[limit_http_methods]" value="1" <?php checked( ! empty( $options['limit_http_methods'] ) ); ?>>
                                <?php esc_html_e( 'Allow only GET, POST, HEAD (blocks PUT, DELETE, TRACE, etc.)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>
            </div>
            <?php $options = $vg_local_options; ?>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>
        <?php
    }

    /**
     * Render login security tab
     */
    private function render_tab_login() {
        $is_disabled = $this->render_module_disabled_notice( 'login_security' );
        $options = $this->settings->get_section( 'login_security' );
        $lockouts = $this->database->get_active_lockouts();
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="login_security" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <div id="vigilante-section-login-main" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Login Protection', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                    <span class="vigilante-method-badge database"><?php esc_html_e( 'Database', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Brute force protection and WordPress login hardening.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr id="field-max-attempts">
                        <th scope="row"><label for="vigilante-f-login-security-max-attempts"><?php esc_html_e( 'Max Login Attempts', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-login-security-max-attempts" type="number" name="login_security[max_attempts]" value="<?php echo esc_attr( $options['max_attempts'] ?? 5 ); ?>" min="1" max="20" class="small-text">
                            <p class="description"><?php esc_html_e( 'Number of failed attempts before lockout.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-login-security-lockout-duration"><?php esc_html_e( 'Lockout Duration', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-login-security-lockout-duration" type="number" name="login_security[lockout_duration]" value="<?php echo esc_attr( ( $options['lockout_duration'] ?? 1800 ) / 60 ); ?>" min="1" max="1440" class="small-text">
                            <?php esc_html_e( 'minutes', 'vigilante' ); ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Progressive Lockout', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="login_security[lockout_increment]" value="1" <?php checked( ! empty( $options['lockout_increment'] ) ); ?>>
                                <?php esc_html_e( 'Double lockout duration for repeat offenders', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Hide Login Errors', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="login_security[hide_login_errors]" value="1" <?php checked( ! empty( $options['hide_login_errors'] ) ); ?>>
                                <?php esc_html_e( 'Show generic error message instead of specific errors', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable Application Passwords', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="login_security[disable_application_passwords]" value="1" <?php checked( ! empty( $options['disable_application_passwords'] ) ); ?>>
                                <?php esc_html_e( 'Disable WordPress application passwords feature', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>

                <h3><?php esc_html_e( 'Custom Login URL', 'vigilante' ); ?></h3>
                <table class="form-table">
                    <tr id="field-custom-login-url">
                        <th scope="row"><?php esc_html_e( 'Login URL Slug', 'vigilante' ); ?></th>
                        <td>
                            <code><?php echo esc_url( home_url( '/' ) ); ?></code>
                            <input type="text" name="login_security[custom_login_url]" id="vigilante_custom_login_url" value="<?php echo esc_attr( $options['custom_login_url'] ?? '' ); ?>" class="regular-text" placeholder="<?php esc_attr_e( 'my-secret-login', 'vigilante' ); ?>">
                            <p class="description">
                                <?php esc_html_e( '&#9432; Leave empty to use default wp-login.php. Use only lowercase letters, numbers and hyphens.', 'vigilante' ); ?>
                            </p>
                            <div class="vigilante-login-url-preview" <?php echo empty( $options['custom_login_url'] ) ? 'style="display:none;"' : ''; ?>>
                                <p class="description">
                                    <strong><?php esc_html_e( 'Your login URL:', 'vigilante' ); ?></strong> 
                                    <code class="vigilante-login-url-display"><?php echo esc_url( home_url( sanitize_title( $options['custom_login_url'] ?? '' ) . '/' ) ); ?></code>
                                </p>
                                <p class="description">
                                    <?php esc_html_e( 'Direct access to wp-login.php and wp-admin will return a 404 error for non-logged users.', 'vigilante' ); ?>
                                </p>
                                <p class="description">
                                    <?php esc_html_e( 'An IP in the firewall whitelist is still allowed into wp-admin, so remote managers keep working, but it does not get the login form: the hidden URL is the only way in for everyone.', 'vigilante' ); ?>
                                </p>
                            </div>
                        </td>
                    </tr>
                </table>

                <div class="vigilante-login-url-notify-wrapper <?php echo empty( $options['custom_login_url'] ) ? 'vigilante-login-url-notify-disabled' : ''; ?>">
                    <table class="form-table">
                        <tr>
                            <th scope="row"><?php esc_html_e( 'Notify users', 'vigilante' ); ?></th>
                            <td>
                                <label>
                                    <input type="checkbox" name="login_security[notify_on_login_url_change]" id="vigilante_notify_login_url_change" value="1" <?php checked( $options['notify_on_login_url_change'] ?? true ); ?>>
                                    <?php esc_html_e( 'Notify affected users when the login URL changes', 'vigilante' ); ?>
                                </label>
                                <div class="vigilante-login-url-send-notification" style="margin-top:12px;">
                                    <button type="button" id="vigilante_notify_login_url" class="button">
                                        <?php esc_html_e( 'Send notification now', 'vigilante' ); ?>
                                    </button>
                                    <span class="vigilante-login-url-notify-status"></span>
                                    <p class="description"><?php esc_html_e( 'Sends the new URL to administrators, editors, authors, and contributors.', 'vigilante' ); ?></p>
                                </div>
                            </td>
                        </tr>
                    </table>
                </div>

                <?php $this->render_2fa_settings( $options ); ?>

                <h3><?php esc_html_e( 'Notifications', 'vigilante' ); ?></h3>
                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Notify on Lockout', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="login_security[notify_on_lockout]" value="1" <?php checked( ! empty( $options['notify_on_lockout'] ) ); ?>>
                                <?php esc_html_e( 'Send email when an IP is locked out', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Notify on Admin Login', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="login_security[notify_on_admin_login]" value="1" <?php checked( ! empty( $options['notify_on_admin_login'] ) ); ?>>
                                <?php esc_html_e( 'Send email when an administrator logs in', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>

                <p class="description">
                    <?php
                    printf(
                        /* translators: %s: Link to notification settings */
                        esc_html__( '&#9432; Notifications are sent to the recipients configured in %s.', 'vigilante' ),
                        '<a href="' . esc_url( admin_url( 'admin.php?page=vigilante&tab=tools' ) ) . '">' . esc_html__( 'Settings & Tools', 'vigilante' ) . '</a>'
                    );
                    ?>
                </p>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>

        <?php $this->render_lockout_info_section( $options, $lockouts ); ?>
        <?php
    }

    /**
     * Render lockout information and blocked IPs section
     *
     * @param array $options  Login security options.
     * @param array $lockouts Currently locked out IPs.
     */
    private function render_lockout_info_section( $options, $lockouts ) {
        $max_attempts      = absint( $options['max_attempts'] ?? 5 );
        $lockout_duration  = absint( $options['lockout_duration'] ?? 1800 );
        $lockout_increment = ! empty( $options['lockout_increment'] );
        $max_lockout       = absint( $options['max_lockout_duration'] ?? 86400 );
        $two_factor        = $options['two_factor'] ?? array();
        $two_factor_enabled = ! empty( $two_factor['enabled'] );
        ?>
        <div class="vigilante-settings-section vigilante-lockout-section">
            <h2 id="vigilante-section-login-status"><?php esc_html_e( 'Login Protection Status', 'vigilante' ); ?></h2>
            
            <table class="form-table">
                <tr>
                    <th scope="row"><?php esc_html_e( 'Current settings', 'vigilante' ); ?></th>
                    <td>
                        <?php 
                        printf(
                            /* translators: 1: Maximum login attempts, 2: Lockout duration in minutes */
                            esc_html__( 'After %1$d failed login attempts, the IP address is blocked for %2$d minutes.', 'vigilante' ),
                            absint( $max_attempts ),
                            absint( ceil( $lockout_duration / 60 ) )
                        );
                        
                        if ( $lockout_increment ) {
                            echo '<br>';
                            printf(
                                /* translators: %d: Maximum lockout duration in hours */
                                esc_html__( 'Progressive lockout enabled (max: %d hours).', 'vigilante' ),
                                absint( ceil( $max_lockout / 3600 ) )
                            );
                        }
                        
                        if ( $two_factor_enabled ) {
                            echo '<br>';
                            esc_html_e( 'Failed 2FA codes also count toward the lockout limit.', 'vigilante' );
                        }
                        ?>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e( 'Blocked IPs', 'vigilante' ); ?></th>
                    <td>
                        <?php if ( ! empty( $lockouts ) ) : ?>
                        <div class="vigilante-paginated-section">
                        <div class="vigilante-fi-pagination-wrap"></div>
                        <table class="wp-list-table widefat fixed striped vigilante-fi-paginated">
                            <thead>
                                <tr>
                                    <th><?php esc_html_e( 'IP Address', 'vigilante' ); ?></th>
                                    <th><?php esc_html_e( 'Attempts', 'vigilante' ); ?></th>
                                    <th><?php esc_html_e( 'Blocked Until', 'vigilante' ); ?></th>
                                    <th><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ( $lockouts as $lockout ) : 
                                    $lockout_time = strtotime( $lockout->locked_until );
                                    $remaining_seconds = $lockout_time - time();
                                    $remaining_text = $this->format_remaining_time( $remaining_seconds );
                                ?>
                                <tr>
                                    <td><code><?php echo esc_html( $lockout->ip_address ); ?></code></td>
                                    <td><?php echo esc_html( $lockout->attempts ); ?></td>
                                    <td>
                                        <?php echo esc_html( wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $lockout_time ) ); ?>
                                        <br>
                                        <small class="description">
                                            <?php 
                                            printf(
                                                /* translators: %s: Remaining time */
                                                esc_html__( '%s remaining', 'vigilante' ),
                                                esc_html( $remaining_text )
                                            ); 
                                            ?>
                                        </small>
                                    </td>
                                    <td>
                                        <button type="button" class="button button-small vigilante-clear-lockout" data-ip="<?php echo esc_attr( $lockout->ip_address ); ?>">
                                            <?php esc_html_e( 'Unblock', 'vigilante' ); ?>
                                        </button>
                                    </td>
                                </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                        </div>
                        <p class="description" style="margin-top: 10px;">
                            <button type="button" class="button vigilante-clear-all-lockouts">
                                <?php esc_html_e( 'Unblock All IPs', 'vigilante' ); ?>
                            </button>
                            <span style="margin-left: 10px;">
                                <?php 
                                printf(
                                    /* translators: %d: Number of blocked IPs */
                                    esc_html( _n( '%d IP currently blocked', '%d IPs currently blocked', count( $lockouts ), 'vigilante' ) ),
                                    count( $lockouts )
                                ); 
                                ?>
                            </span>
                        </p>
                        <?php else : ?>
                        <span class="dashicons dashicons-yes-alt" style="color: #00a32a; font-size: 20px; width: 20px; height: 20px; vertical-align: middle;"></span>
                        <span style="vertical-align: middle; margin-left: 5px;"><?php esc_html_e( 'No IPs are currently blocked. All clear!', 'vigilante' ); ?></span>
                        <?php endif; ?>
                    </td>
                </tr>
            </table>
        </div>
        <?php
    }

    /**
     * Format remaining lockout time in human readable format
     *
     * @param int $seconds Remaining seconds.
     * @return string Formatted time string.
     */
    private function format_remaining_time( $seconds ) {
        if ( $seconds <= 0 ) {
            return __( 'expired', 'vigilante' );
        }

        if ( $seconds < 60 ) {
            return sprintf(
                /* translators: %d: Number of seconds */
                _n( '%d second', '%d seconds', $seconds, 'vigilante' ),
                $seconds
            );
        }

        if ( $seconds < 3600 ) {
            $minutes = ceil( $seconds / 60 );
            return sprintf(
                /* translators: %d: Number of minutes */
                _n( '%d minute', '%d minutes', $minutes, 'vigilante' ),
                $minutes
            );
        }

        $hours = floor( $seconds / 3600 );
        $remaining_minutes = ceil( ( $seconds % 3600 ) / 60 );
        
        if ( $remaining_minutes > 0 ) {
            return sprintf(
                /* translators: 1: Number of hours, 2: Number of minutes */
                __( '%1$d hours %2$d minutes', 'vigilante' ),
                $hours,
                $remaining_minutes
            );
        }

        return sprintf(
            /* translators: %d: Number of hours */
            _n( '%d hour', '%d hours', $hours, 'vigilante' ),
            $hours
        );
    }

    /**
     * Render 2FA settings section
     *
     * @param array $options Login security options.
     */
    private function render_2fa_settings( $options ) {
        $two_factor = $options['two_factor'] ?? array();
        $all_roles  = wp_roles()->roles;
        $enforced   = $two_factor['enforced_roles'] ?? array( 'administrator', 'editor' );
        $excluded   = $two_factor['excluded_users'] ?? array();
        $method     = $two_factor['method'] ?? 'email';
        $grace_days = $two_factor['grace_period_days'] ?? 3;
        ?>
        <h3 id="vigilante-section-login-2fa">
            <?php esc_html_e( 'Two-Factor Authentication (2FA)', 'vigilante' ); ?>
            <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
            <span class="vigilante-method-badge database"><?php esc_html_e( 'Database', 'vigilante' ); ?></span>
        </h3>
        <p class="description"><?php esc_html_e( 'Require a second verification step after password. Choose between email codes or an authenticator app (TOTP).', 'vigilante' ); ?></p>
        
        <table class="form-table">
            <tr>
                <th scope="row"><?php esc_html_e( 'Enable 2FA', 'vigilante' ); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="login_security[two_factor][enabled]" id="vigilante_2fa_enabled" value="1" <?php checked( ! empty( $two_factor['enabled'] ) ); ?>>
                        <?php esc_html_e( 'Enable two-factor authentication', 'vigilante' ); ?>
                    </label>
                </td>
            </tr>
        </table>

        <div class="vigilante-2fa-settings-wrapper <?php echo empty( $two_factor['enabled'] ) ? 'vigilante-2fa-settings-disabled' : ''; ?>">
            <table class="form-table">
                <tr>
                    <th scope="row"><?php esc_html_e( 'Verification method', 'vigilante' ); ?></th>
                    <td>
                        <fieldset class="vigilante-2fa-method-selector">
                            <label class="vigilante-2fa-method-option <?php echo 'email' === $method ? 'selected' : ''; ?>">
                                <input type="radio" name="login_security[two_factor][method]" value="email" <?php checked( $method, 'email' ); ?>>
                                <span class="dashicons dashicons-email"></span>
                                <span class="method-info">
                                    <strong><?php esc_html_e( 'Email code', 'vigilante' ); ?></strong>
                                    <span><?php esc_html_e( 'Users receive a 6-digit code via email after entering their password.', 'vigilante' ); ?></span>
                                </span>
                            </label>
                            <label class="vigilante-2fa-method-option <?php echo 'totp' === $method ? 'selected' : ''; ?>">
                                <input type="radio" name="login_security[two_factor][method]" value="totp" <?php checked( $method, 'totp' ); ?>>
                                <span class="dashicons dashicons-smartphone"></span>
                                <span class="method-info">
                                    <strong><?php esc_html_e( 'Authenticator app (TOTP)', 'vigilante' ); ?></strong>
                                    <span><?php esc_html_e( 'Users verify with a time-based code from Google Authenticator, Authy, etc.', 'vigilante' ); ?></span>
                                </span>
                            </label>
                        </fieldset>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e( 'Enforce for roles', 'vigilante' ); ?></th>
                    <td>
                        <div class="vigilante-2fa-roles">
                            <?php foreach ( $all_roles as $role_slug => $role_data ) : 
                                $user_count = count( get_users( array( 'role' => $role_slug, 'fields' => 'ID' ) ) );
                            ?>
                            <label>
                                <input type="checkbox" 
                                       name="login_security[two_factor][enforced_roles][]" 
                                       value="<?php echo esc_attr( $role_slug ); ?>"
                                       <?php checked( in_array( $role_slug, $enforced, true ) ); ?>>
                                <span class="role-name"><?php echo esc_html( translate_user_role( $role_data['name'] ) ); ?></span>
                                <span class="role-count">(<?php echo esc_html( $user_count ); ?>)</span>
                            </label>
                            <?php endforeach; ?>
                        </div>
                        <p class="description"><?php esc_html_e( 'Users with these roles will be required to verify with the selected method.', 'vigilante' ); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e( 'Exclude specific users', 'vigilante' ); ?></th>
                    <td>
                        <div class="vigilante-2fa-user-search-container">
                            <div class="vigilante-2fa-user-search">
                                <span class="search-icon"></span>
                                <input type="text" 
                                       id="vigilante_2fa_user_search" 
                                       placeholder="<?php esc_attr_e( 'Search users by name or email...', 'vigilante' ); ?>"
                                       autocomplete="off">
                                <div class="vigilante-2fa-search-results"></div>
                            </div>
                            <div class="vigilante-2fa-excluded-users">
                                <?php 
                                foreach ( $excluded as $user_id ) :
                                    $user = get_user_by( 'ID', $user_id );
                                    if ( ! $user ) continue;
                                ?>
                                <div class="vigilante-2fa-excluded-user" data-user-id="<?php echo esc_attr( $user_id ); ?>">
                                    <span class="user-display"><?php echo esc_html( $user->display_name . ' (' . $user->user_email . ')' ); ?></span>
                                    <button type="button" class="remove-user" aria-label="<?php esc_attr_e( 'Remove', 'vigilante' ); ?>">&times;</button>
                                    <input type="hidden" name="login_security[two_factor][excluded_users][]" value="<?php echo esc_attr( $user_id ); ?>">
                                </div>
                                <?php endforeach; ?>
                            </div>
                        </div>
                        <p class="description"><?php esc_html_e( 'These users will not be required to use 2FA regardless of their role.', 'vigilante' ); ?></p>
                    </td>
                </tr>

                <!-- Remember device option -->
                <tr>
                    <th scope="row"><?php esc_html_e( 'Remember device', 'vigilante' ); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="login_security[two_factor][allow_remember_device]" value="1" <?php checked( ! empty( $two_factor['allow_remember_device'] ) ); ?>>
                            <?php esc_html_e( 'Allow users to skip 2FA verification on trusted devices', 'vigilante' ); ?>
                        </label>
                        <p class="description">
                            <?php
                            printf(
                                /* translators: %d: Number of days */
                                esc_html__( 'When enabled, users can check "Remember this device" on the verification screen to skip 2FA for %d days.', 'vigilante' ),
                                absint( $two_factor['remember_device_days'] ?? 30 )
                            );
                            ?>
                        </p>
                    </td>
                </tr>

                <!-- TOTP-specific: Grace period -->
                <tr class="vigilante-2fa-totp-only" <?php echo 'totp' !== $method ? 'style="display:none;"' : ''; ?>>
                    <th scope="row"><label for="vigilante-f-login-security-two-factor-grace-period-days"><?php esc_html_e( 'Grace period', 'vigilante' ); ?></label></th>
                    <td>
                        <input id="vigilante-f-login-security-two-factor-grace-period-days" type="number" 
                               name="login_security[two_factor][grace_period_days]" 
                               value="<?php echo esc_attr( $grace_days ); ?>" 
                               min="0" max="30" class="small-text">
                        <?php esc_html_e( 'days', 'vigilante' ); ?>
                        <p class="description"><?php esc_html_e( 'Days users have to set up their authenticator app. During this period they can log in without TOTP. Set to 0 for immediate enforcement.', 'vigilante' ); ?></p>
                    </td>
                </tr>

                <!-- Email-specific: Sender name -->
                <tr class="vigilante-2fa-email-only" <?php echo 'email' !== $method ? 'style="display:none;"' : ''; ?>>
                    <th scope="row"><label for="vigilante-f-login-security-two-factor-email-from-name"><?php esc_html_e( 'Email sender name', 'vigilante' ); ?></label></th>
                    <td>
                        <input id="vigilante-f-login-security-two-factor-email-from-name" type="text" 
                               name="login_security[two_factor][email_from_name]" 
                               value="<?php echo esc_attr( $two_factor['email_from_name'] ?? '' ); ?>" 
                               class="regular-text vigilante-2fa-email-from"
                               placeholder="<?php echo esc_attr( get_bloginfo( 'name' ) ); ?>">
                        <p class="description"><?php esc_html_e( 'Name shown in verification emails. Leave empty to use site name.', 'vigilante' ); ?></p>
                    </td>
                </tr>

                <!-- TOTP-specific: Reset users -->
                <tr class="vigilante-2fa-totp-only" <?php echo 'totp' !== $method ? 'style="display:none;"' : ''; ?>>
                    <th scope="row"><?php esc_html_e( 'Reset user TOTP', 'vigilante' ); ?></th>
                    <td>
                        <div class="vigilante-totp-reset-container">
                            <div class="vigilante-2fa-user-search">
                                <span class="search-icon"></span>
                                <input type="text" 
                                       id="vigilante_totp_reset_search"
                                       placeholder="<?php esc_attr_e( 'Search users with TOTP configured...', 'vigilante' ); ?>"
                                       autocomplete="off">
                                <div class="vigilante-totp-reset-results"></div>
                            </div>
                            <div class="vigilante-totp-reset-selected"></div>
                            <button type="button" id="vigilante_totp_reset_btn" class="button" style="display:none;">
                                <?php esc_html_e( 'Reset selected', 'vigilante' ); ?>
                            </button>
                            <span class="vigilante-totp-reset-status"></span>
                        </div>
                        <p class="description"><?php esc_html_e( 'Reset TOTP for users who lost access to their authenticator app. They will need to set up again.', 'vigilante' ); ?></p>
                    </td>
                </tr>
            </table>

            <h3><?php esc_html_e( 'User notification', 'vigilante' ); ?></h3>
            <table class="form-table">
                <tr>
                    <th scope="row"><?php esc_html_e( 'Notify on enable', 'vigilante' ); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="login_security[two_factor][notify_on_enable]" value="1" <?php checked( $two_factor['notify_on_enable'] ?? true ); ?>>
                            <?php esc_html_e( 'Send notification email to affected users when 2FA is enabled', 'vigilante' ); ?>
                        </label>
                        
                        <div class="vigilante-2fa-notification-options">
                            <label>
                                <input type="radio" name="vigilante_2fa_notify_mode" value="all" checked>
                                <?php esc_html_e( 'Send to all affected users', 'vigilante' ); ?>
                            </label>
                            <label>
                                <input type="radio" name="vigilante_2fa_notify_mode" value="new">
                                <?php esc_html_e( 'Send only to users not previously notified', 'vigilante' ); ?>
                            </label>
                        </div>

                        <div class="vigilante-2fa-send-notification">
                            <button type="button" id="vigilante_2fa_send_notification" class="button">
                                <?php esc_html_e( 'Send notification now', 'vigilante' ); ?>
                            </button>
                            <span class="vigilante-2fa-notification-status"></span>
                        </div>
                    </td>
                </tr>
            </table>
        </div>
        <?php
    }

    /**
     * Render security headers tab
     */
    /**
     * Offer back the header settings the 2.9.8 migration wiped.
     *
     * Rendered outside the settings form on purpose, so its buttons can never
     * submit it, and only when there is something to actually change. Shows the
     * difference before anything is written: nothing is applied that the owner
     * has not seen first.
     *
     * @since 2.10.0
     */
    private function render_headers_recovery_offer() {
        /*
         * On a network the .htaccess belongs to every site and only the main one
         * writes it, so this is not a decision a subsite gets to make. Its own
         * security_headers options are inert anyway: what the network serves
         * comes from the file the main site owns. Without this gate a subsite
         * administrator was shown a Restore button that could only ever answer
         * with a permission error, which is worse than showing nothing.
         */
        if ( ! Vigilante_Settings::can_write_shared_files() ) {
            return;
        }

        if ( ! Vigilante_Htaccess_Recovery::is_available() ) {
            /*
             * Already restored. Offer to take it back for as long as the previous
             * section is still stored: a restore that cannot be undone is a second
             * irreversible change on top of the one being repaired.
             */
            if ( Vigilante_Htaccess_Recovery::has_undo() ) {
                ?>
                <div class="notice notice-info inline" id="vigilante-headers-recovery-undo">
                    <p>
                        <?php esc_html_e( 'The Security Headers settings were restored from the copy Vigilant had kept of your .htaccess.', 'vigilante' ); ?>
                        <button type="button" class="button button-small" id="vigilante-recovery-undo">
                            <?php esc_html_e( 'Undo the restore', 'vigilante' ); ?>
                        </button>
                    </p>
                </div>
                <?php
            }

            return;
        }

        $rows = Vigilante_Htaccess_Recovery::get_diff( $this->settings );

        if ( empty( $rows ) ) {
            return;
        }

        $snapshot = Vigilante_Htaccess_Recovery::get_snapshot();
        $taken    = isset( $snapshot['time'] ) ? (int) $snapshot['time'] : 0;
        $block    = Vigilante_Htaccess_Recovery::get_raw_block();
        ?>
        <div class="vigilante-settings-section" id="vigilante-headers-recovery">
            <h2><?php esc_html_e( 'Recover your previous header settings', 'vigilante' ); ?></h2>
            <p>
                <?php esc_html_e( 'An earlier update reset this tab to factory values: the migration replaced the whole section instead of merging into it. Your server kept sending the right headers, because the .htaccess had not been rewritten yet, so Vigilant saved a copy of that file before touching it. These are the settings it found in that copy.', 'vigilante' ); ?>
            </p>
            <?php if ( $taken ) : ?>
                <p class="description">
                    <?php
                    printf(
                        /* translators: %s: date and time the .htaccess copy was taken. */
                        esc_html__( 'Copy taken on %s.', 'vigilante' ),
                        esc_html( wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $taken ) )
                    );
                    ?>
                </p>
            <?php endif; ?>

            <table class="widefat striped">
                <thead>
                    <tr>
                        <th scope="col"><?php esc_html_e( 'Setting', 'vigilante' ); ?></th>
                        <th scope="col"><?php esc_html_e( 'Now', 'vigilante' ); ?></th>
                        <th scope="col"><?php esc_html_e( 'Would be restored to', 'vigilante' ); ?></th>
                    </tr>
                </thead>
                <tbody>
                <?php foreach ( $rows as $row ) : ?>
                    <tr>
                        <th scope="row"><?php echo esc_html( $row['label'] ); ?></th>
                        <td><?php echo esc_html( $row['current'] ); ?></td>
                        <td>
                            <?php echo esc_html( $row['recovered'] ); ?>
                            <?php if ( ! empty( $row['detail'] ) ) : ?>
                                <br><span class="description"><?php echo esc_html( $row['detail'] ); ?></span>
                            <?php endif; ?>
                        </td>
                    </tr>
                <?php endforeach; ?>
                </tbody>
            </table>

            <p class="description">
                <?php esc_html_e( 'Only these settings are written. The .htaccess is then rebuilt from them, the same way saving this tab rebuilds it. The stored copy of the file is never written back, so nothing your host, your cache plugin or your CDN added to it is touched.', 'vigilante' ); ?>
            </p>

            <?php if ( '' !== $block ) : ?>
                <details>
                    <summary><?php esc_html_e( 'Show the saved .htaccess block', 'vigilante' ); ?></summary>
                    <textarea readonly rows="12" class="large-text code" onclick="this.select();"><?php echo esc_textarea( $block ); ?></textarea>
                </details>
            <?php endif; ?>

            <p class="submit vigilante-submit-buttons">
                <button type="button" class="button button-primary" id="vigilante-recovery-restore">
                    <?php esc_html_e( 'Restore these settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button" id="vigilante-recovery-dismiss">
                    <?php esc_html_e( 'No thanks, keep what I have', 'vigilante' ); ?>
                </button>
            </p>
            <div id="vigilante-recovery-result"></div>
        </div>
        <?php
    }

    private function render_tab_headers() {
        $is_disabled = $this->render_module_disabled_notice( 'security_headers' );
        // Every setting on this tab ends up in .htaccess, so on a subsite the
        // whole tab is somebody else's, values included.
        $vg_shared_locked = $this->shared_files_locked();
        $options = $this->get_section_for_display( 'security_headers' );
        ?>
        <?php $this->render_headers_recovery_offer(); ?>

        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="security_headers" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <?php $this->render_shared_files_notice(); ?>
            <div id="vigilante-section-headers-main" class="vigilante-settings-section <?php echo $vg_shared_locked ? 'vigilante-form-disabled' : ''; ?>" <?php echo $vg_shared_locked ? 'inert' : ''; ?>>
                <h2>
                    <?php esc_html_e( 'Security Headers', 'vigilante' ); ?>
                    <span class="vigilante-method-badge htaccess"><?php esc_html_e( 'HTACCESS', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'HTTP headers sent with every response via .htaccess (mod_headers).', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><label for="vigilante-f-security-headers-x-frame-options"><?php esc_html_e( 'X-Frame-Options', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-security-headers-x-frame-options" name="security_headers[x_frame_options]">
                                <option value="" <?php selected( empty( $options['x_frame_options'] ) ); ?>><?php esc_html_e( 'Disabled', 'vigilante' ); ?></option>
                                <option value="SAMEORIGIN" <?php selected( $options['x_frame_options'] ?? '', 'SAMEORIGIN' ); ?>>SAMEORIGIN</option>
                                <option value="DENY" <?php selected( $options['x_frame_options'] ?? '', 'DENY' ); ?>>DENY</option>
                            </select>
                            <p class="description"><?php esc_html_e( '&#9432; Prevents clickjacking attacks. Also sets CSP frame-ancestors automatically.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'X-Content-Type-Options', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[x_content_type_options]" value="1" <?php checked( ! empty( $options['x_content_type_options'] ) ); ?>>
                                <?php esc_html_e( 'Add nosniff header to prevent MIME type sniffing', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-security-headers-referrer-policy"><?php esc_html_e( 'Referrer-Policy', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-security-headers-referrer-policy" name="security_headers[referrer_policy]">
                                <option value="" <?php selected( empty( $options['referrer_policy'] ) ); ?>><?php esc_html_e( 'Disabled', 'vigilante' ); ?></option>
                                <option value="no-referrer" <?php selected( $options['referrer_policy'] ?? '', 'no-referrer' ); ?>>no-referrer</option>
                                <option value="strict-origin-when-cross-origin" <?php selected( $options['referrer_policy'] ?? '', 'strict-origin-when-cross-origin' ); ?>>strict-origin-when-cross-origin</option>
                                <option value="same-origin" <?php selected( $options['referrer_policy'] ?? '', 'same-origin' ); ?>>same-origin</option>
                            </select>
                        </td>
                    </tr>
                </table>

                <h3 id="vigilante-section-headers-csp"><?php esc_html_e( 'Content Security Policy', 'vigilante' ); ?></h3>
                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable CSP', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[csp][enabled]" value="1" <?php checked( ! empty( $options['csp']['enabled'] ) ); ?>>
                                <?php esc_html_e( 'Enable Content Security Policy', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Report Only Mode', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[csp][report_only]" value="1" <?php checked( ! empty( $options['csp']['report_only'] ) ); ?>>
                                <?php esc_html_e( 'Report violations without blocking (for testing)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>

                <h3 id="vigilante-section-headers-force-https"><?php esc_html_e( 'HTTPS', 'vigilante' ); ?></h3>
                <p class="description"><?php esc_html_e( 'HTTPS is strongly recommended, but Vigilant will not impose it. Enable only what your site already supports.', 'vigilante' ); ?></p>
                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Redirect HTTP to HTTPS', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[redirect_http_to_https]" value="1" <?php checked( ! empty( $options['redirect_http_to_https'] ) ); ?>>
                                <?php esc_html_e( 'Send visitors arriving over HTTP to the HTTPS address', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Only applies when the site address is already an https:// one. On a site still published over HTTP it does nothing, so it cannot leave the site unreachable.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Fix Mixed Content', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[fix_mixed_content]" value="1" <?php checked( ! empty( $options['fix_mixed_content'] ) ); ?>>
                                <?php esc_html_e( 'Rewrite this site http:// resources to https://', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Off by default. Only touches addresses of this same site, and only when the site is already served over HTTPS, so it cannot break an external resource. Useful right after moving a site to HTTPS, when old content still points at http:// addresses.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr id="field-upgrade-insecure-requests">
                        <th scope="row"><?php esc_html_e( 'Upgrade Insecure Requests', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[upgrade_insecure_requests]" value="1" <?php checked( ! empty( $options['upgrade_insecure_requests'] ) ); ?>>
                                <?php esc_html_e( 'Ask browsers to upgrade every http:// request to https://', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( '&#9888; Off by default. This one also covers resources hosted elsewhere: anything served from a domain with no HTTPS stops loading instead of loading insecurely. Turn it on once you know every external resource the site uses is available over HTTPS.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Rewrite Site Address on Activation', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[force_https]" value="1" <?php checked( ! empty( $options['force_https'] ) ); ?>>
                                <?php esc_html_e( 'Change the WordPress and site addresses to https:// when the plugin is activated', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( '&#9888; Off by default. This writes to the WordPress Address and Site Address settings, and turning the plugin off later does not undo it. It only runs on activation, and only when the site answers over HTTPS.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>

                <h3 id="vigilante-section-headers-hsts"><?php esc_html_e( 'HSTS (HTTP Strict Transport Security)', 'vigilante' ); ?></h3>
                <?php $vig_home_https = ( 0 === strpos( (string) get_option( 'home' ), 'https://' ) ); ?>
                <p class="description"><?php esc_html_e( 'Tells browsers to reach this site over HTTPS and never over HTTP, for as long as the max age below.', 'vigilante' ); ?></p>
                <?php if ( ! $vig_home_https ) : ?>
                    <p class="description" style="color:#b32d2e"><strong><?php esc_html_e( 'Unavailable: the site address still starts with http://. Enabling HSTS on a site not published over HTTPS would make it unreachable in any browser that honours it.', 'vigilante' ); ?></strong></p>
                <?php endif; ?>
                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable HSTS', 'vigilante' ); ?></th>
                        <td>
                            <?php if ( ! $vig_home_https ) : ?>
                                <?php /* A disabled checkbox is not submitted, and a boolean missing from the post is treated as unticked, so saving the tab would silently switch HSTS off. Carry the stored value instead. */ ?>
                                <input type="hidden" name="security_headers[hsts][enabled]" value="<?php echo ! empty( $options['hsts']['enabled'] ) ? '1' : '0'; ?>">
                            <?php endif; ?>
                            <label>
                                <input type="checkbox" name="security_headers[hsts][enabled]" value="1" <?php checked( ! empty( $options['hsts']['enabled'] ) ); ?> <?php disabled( ! $vig_home_https ); ?>>
                                <?php esc_html_e( 'Send the Strict-Transport-Security header', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( '&#9888; Hard to undo: browsers remember it for the whole max age even if you turn it off later, so a site that loses its certificate stays unreachable until it expires. Start with a short max age.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-security-headers-hsts-max-age"><?php esc_html_e( 'Max Age', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-security-headers-hsts-max-age" name="security_headers[hsts][max_age]">
                                <option value="86400" <?php selected( $options['hsts']['max_age'] ?? 31536000, 86400 ); ?>><?php esc_html_e( '1 day (testing)', 'vigilante' ); ?></option>
                                <option value="2592000" <?php selected( $options['hsts']['max_age'] ?? 31536000, 2592000 ); ?>><?php esc_html_e( '30 days', 'vigilante' ); ?></option>
                                <option value="31536000" <?php selected( $options['hsts']['max_age'] ?? 31536000, 31536000 ); ?>><?php esc_html_e( '1 year (recommended)', 'vigilante' ); ?></option>
                                <option value="63072000" <?php selected( $options['hsts']['max_age'] ?? 31536000, 63072000 ); ?>><?php esc_html_e( '2 years', 'vigilante' ); ?></option>
                            </select>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Include Subdomains', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[hsts][include_subdomains]" value="1" <?php checked( ! empty( $options['hsts']['include_subdomains'] ) ); ?>>
                                <?php esc_html_e( 'Apply HSTS to all subdomains', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>

                <h3 id="vigilante-section-headers-fingerprint"><?php esc_html_e( 'Server Identity', 'vigilante' ); ?></h3>
                <p class="description"><?php esc_html_e( 'Hide identifying information that servers expose in responses.', 'vigilante' ); ?></p>
                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Server Signature', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[hide_server_signature]" value="1" <?php checked( ! empty( $options['hide_server_signature'] ) ); ?>>
                                <?php esc_html_e( 'Hide server signature (ServerSignature Off)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove Fingerprinting Headers', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="security_headers[remove_fingerprinting_headers]" value="1" <?php checked( ! empty( $options['remove_fingerprinting_headers'] ) ); ?>>
                                <?php esc_html_e( 'Remove X-Powered-By and Server headers', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>
            </div>

            <?php $vg_cop = ( isset( $options['cross_origin_policies'] ) && is_array( $options['cross_origin_policies'] ) ) ? $options['cross_origin_policies'] : array(); ?>
            <div id="vigilante-section-headers-cross-origin" class="vigilante-settings-section <?php echo $vg_shared_locked ? 'vigilante-form-disabled' : ''; ?>" <?php echo $vg_shared_locked ? 'inert' : ''; ?>>
                <h2>
                    <?php esc_html_e( 'Cross-Origin Policies', 'vigilante' ); ?>
                    <span class="vigilante-method-badge htaccess"><?php esc_html_e( 'HTACCESS', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Control how other origins may open, embed or fetch your site. Vigilant already sends these headers with the values below.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><label for="vigilante-f-security-headers-coop"><?php esc_html_e( 'Cross-Origin-Opener-Policy (COOP)', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-security-headers-coop" name="security_headers[cross_origin_policies][opener_policy]">
                                <option value="" <?php selected( empty( $vg_cop['opener_policy'] ) ); ?>><?php esc_html_e( 'Disabled (header not sent)', 'vigilante' ); ?></option>
                                <option value="unsafe-none" <?php selected( $vg_cop['opener_policy'] ?? '', 'unsafe-none' ); ?>>unsafe-none</option>
                                <option value="same-origin-allow-popups" <?php selected( $vg_cop['opener_policy'] ?? '', 'same-origin-allow-popups' ); ?>><?php esc_html_e( 'same-origin-allow-popups (recommended)', 'vigilante' ); ?></option>
                                <option value="same-origin" <?php selected( $vg_cop['opener_policy'] ?? '', 'same-origin' ); ?>>same-origin</option>
                            </select>
                            <p class="description"><?php esc_html_e( '&#9432; Cuts the link between your site and a window from another origin that opened it. Side effect: external tools that open your site in a new tab and talk to it through window.opener, such as Google Tag Assistant, will report that they cannot connect. Pick unsafe-none or Disabled if you need those tools.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-security-headers-coep"><?php esc_html_e( 'Cross-Origin-Embedder-Policy (COEP)', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-security-headers-coep" name="security_headers[cross_origin_policies][embedder_policy]">
                                <option value="unsafe-none" <?php selected( ( $vg_cop['embedder_policy'] ?? 'unsafe-none' ), 'unsafe-none' ); ?>><?php esc_html_e( 'unsafe-none (header not sent)', 'vigilante' ); ?></option>
                                <option value="credentialless" <?php selected( $vg_cop['embedder_policy'] ?? '', 'credentialless' ); ?>>credentialless</option>
                                <option value="require-corp" <?php selected( $vg_cop['embedder_policy'] ?? '', 'require-corp' ); ?>>require-corp</option>
                            </select>
                            <p class="description"><?php esc_html_e( '&#9432; Requires every cross-origin resource to opt in. require-corp can block third-party images, fonts, videos and embeds that do not send their own CORP or CORS headers.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-security-headers-corp"><?php esc_html_e( 'Cross-Origin-Resource-Policy (CORP)', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-security-headers-corp" name="security_headers[cross_origin_policies][resource_policy]">
                                <option value="" <?php selected( empty( $vg_cop['resource_policy'] ) ); ?>><?php esc_html_e( 'Disabled (header not sent)', 'vigilante' ); ?></option>
                                <option value="same-site" <?php selected( $vg_cop['resource_policy'] ?? '', 'same-site' ); ?>>same-site</option>
                                <option value="same-origin" <?php selected( $vg_cop['resource_policy'] ?? '', 'same-origin' ); ?>>same-origin</option>
                                <option value="cross-origin" <?php selected( $vg_cop['resource_policy'] ?? '', 'cross-origin' ); ?>><?php esc_html_e( 'cross-origin (recommended)', 'vigilante' ); ?></option>
                            </select>
                            <p class="description"><?php esc_html_e( '&#9432; Declares who may load resources from this site. same-origin stops hotlinking, but it also breaks CDNs, feed readers and any external service that fetches your images or files.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <?php if ( ! $vg_shared_locked ) : ?>
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
                <?php endif; ?>
                <?php /* Testing what the server actually sends is read-only and useful from any site of a network. */ ?>
                <button type="button" class="button vigilante-test-headers">
                    <?php esc_html_e( 'Test Headers', 'vigilante' ); ?>
                </button>
            </p>
        </form>

        <div id="vigilante-headers-result"></div>
        <?php
    }

    /**
     * Render REST API tab
     */
    private function render_tab_rest_api() {
        $is_disabled = $this->render_module_disabled_notice( 'rest_api_security' );
        $options = $this->settings->get_section( 'rest_api_security' );
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="rest_api_security" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <div id="vigilante-section-rest-api-main" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'REST API Security', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Control access to WordPress REST API endpoints.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><label for="vigilante-f-rest-api-security-mode"><?php esc_html_e( 'Access Mode', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-rest-api-security-mode" name="rest_api_security[mode]">
                                <option value="open" <?php selected( $options['mode'] ?? 'selective', 'open' ); ?>><?php esc_html_e( 'Open - Allow all requests', 'vigilante' ); ?></option>
                                <option value="selective" <?php selected( $options['mode'] ?? 'selective', 'selective' ); ?>><?php esc_html_e( 'Selective - Protect sensitive endpoints', 'vigilante' ); ?></option>
                                <option value="authenticated_only" <?php selected( $options['mode'] ?? 'selective', 'authenticated_only' ); ?>><?php esc_html_e( 'Authenticated - Require login for all', 'vigilante' ); ?></option>
                            </select>
                            <p class="description"><?php esc_html_e( 'Selective mode is recommended.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr id="field-block-user-enumeration">
                        <th scope="row"><?php esc_html_e( 'Block User Enumeration', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="rest_api_security[block_user_enumeration]" value="1" <?php checked( ! empty( $options['block_user_enumeration'] ) ); ?>>
                                <?php esc_html_e( 'Protect /wp/v2/users endpoint for unauthenticated users', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable JSONP', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="rest_api_security[disable_jsonp]" value="1" <?php checked( ! empty( $options['disable_jsonp'] ) ); ?>>
                                <?php esc_html_e( 'Disable JSONP support in REST API', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>
        <?php
    }

    /**
     * Render User Security tab
     */
    private function render_tab_users() {
        $is_disabled = $this->render_module_disabled_notice( 'user_security' );
        $options = $this->settings->get_section( 'user_security' );
        $monitoring = $options['admin_monitoring'] ?? array();
        $registration = $options['registration_approval'] ?? array();
        $session_limits = $options['session_limits'] ?? array();
        $password_exp = $options['password_expiration'] ?? array();
        $email_verify = $options['email_verification'] ?? array();
        ?>

        <!-- ============================================================
             SETTINGS SECTION - Single form for all configuration
             ============================================================ -->
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="user_security" <?php echo $is_disabled ? 'inert' : ''; ?>>
            
            <!-- Username & Password Protection -->
            <div id="vigilante-section-users-password" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Username & password protection', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Enforce secure username and password policies.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Block Insecure Usernames', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[block_insecure_usernames]" value="1" <?php checked( ! empty( $options['block_insecure_usernames'] ) ); ?>>
                                <?php esc_html_e( 'Prevent creation of users with common usernames (admin, administrator, etc.)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <?php
                    $pw_policy = wp_parse_args(
                        ( isset( $options['password_policy'] ) && is_array( $options['password_policy'] ) ) ? $options['password_policy'] : array(),
                        array(
                            'require_uppercase' => false,
                            'require_lowercase' => false,
                            'require_number'    => false,
                            'require_special'   => false,
                            'block_common'      => true,
                            'block_username'    => true,
                            'affected_roles'    => array(),
                        )
                    );
                    $pw_policy_roles = (array) $pw_policy['affected_roles'];
                    ?>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enforce Strong Passwords', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[force_strong_passwords]" value="1" <?php checked( ! empty( $options['force_strong_passwords'] ) ); ?>>
                                <?php esc_html_e( 'Check passwords against the requirements below when a user sets or changes one', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-min-password-length"><?php esc_html_e( 'Minimum Password Length', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-min-password-length" type="number" name="user_security[min_password_length]" value="<?php echo esc_attr( $options['min_password_length'] ?? 12 ); ?>" min="6" max="32" class="small-text">
                            <?php esc_html_e( 'characters', 'vigilante' ); ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Password Requirements', 'vigilante' ); ?></th>
                        <td>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][require_uppercase]" value="1" <?php checked( ! empty( $pw_policy['require_uppercase'] ) ); ?>>
                                <?php esc_html_e( 'Require an uppercase letter (A-Z)', 'vigilante' ); ?>
                            </label>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][require_lowercase]" value="1" <?php checked( ! empty( $pw_policy['require_lowercase'] ) ); ?>>
                                <?php esc_html_e( 'Require a lowercase letter (a-z)', 'vigilante' ); ?>
                            </label>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][require_number]" value="1" <?php checked( ! empty( $pw_policy['require_number'] ) ); ?>>
                                <?php esc_html_e( 'Require a number (0-9)', 'vigilante' ); ?>
                            </label>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][require_special]" value="1" <?php checked( ! empty( $pw_policy['require_special'] ) ); ?>>
                                <?php esc_html_e( 'Require a special character (!, @, #, ...)', 'vigilante' ); ?>
                            </label>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][block_common]" value="1" <?php checked( ! empty( $pw_policy['block_common'] ) ); ?>>
                                <?php esc_html_e( 'Reject well-known common passwords', 'vigilante' ); ?>
                            </label>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][block_username]" value="1" <?php checked( ! empty( $pw_policy['block_username'] ) ); ?>>
                                <?php esc_html_e( 'Do not allow the username inside the password', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'These rules apply only while "Enforce Strong Passwords" is on. Turn off individual rules to allow, for example, long passphrases without numbers or symbols.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Apply Password Rules To', 'vigilante' ); ?></th>
                        <td>
                            <?php foreach ( wp_roles()->get_names() as $role_slug => $role_name ) : ?>
                            <label style="display:block;margin-bottom:5px;">
                                <input type="checkbox" name="user_security[password_policy][affected_roles][]" value="<?php echo esc_attr( $role_slug ); ?>" <?php checked( empty( $pw_policy_roles ) || in_array( $role_slug, $pw_policy_roles, true ) ); ?>>
                                <?php echo esc_html( translate_user_role( $role_name ) ); ?>
                            </label>
                            <?php endforeach; ?>
                            <p class="description"><?php esc_html_e( 'All roles are covered by default. Uncheck a role to exclude it from the password policy.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr id="field-block-author-scanning">
                        <th scope="row"><?php esc_html_e( 'Block Author Scanning', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[block_author_scanning]" value="1" <?php checked( ! empty( $options['block_author_scanning'] ) ); ?>>
                                <?php esc_html_e( 'Prevent username discovery via ?author=N URLs', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Display Name Protection', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[prevent_display_name_login_match]" value="1" <?php checked( ! empty( $options['prevent_display_name_login_match'] ) ); ?>>
                                <?php esc_html_e( 'Prevent users from saving a display name that matches their login username', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'The display name is publicly visible and should not reveal the login username.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- Admin Monitoring -->
            <div id="vigilante-section-users-admin-monitoring" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Admin monitoring', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Receive email alerts when administrator accounts are modified. All events are always logged to the Security Audit.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'New Administrator Alert', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[admin_monitoring][alert_new_admin]" value="1" <?php checked( ! empty( $monitoring['alert_new_admin'] ) ); ?>>
                                <?php esc_html_e( 'Send email alert when a new administrator account is created', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Admin Email Change Alert', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[admin_monitoring][alert_admin_email_change]" value="1" <?php checked( ! empty( $monitoring['alert_admin_email_change'] ) ); ?>>
                                <?php esc_html_e( 'Send email alert when an administrator email address is changed', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Permission Elevation Alert', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[admin_monitoring][alert_permission_elevation]" value="1" <?php checked( ! empty( $monitoring['alert_permission_elevation'] ) ); ?>>
                                <?php esc_html_e( 'Send email alert when a user is elevated to administrator role', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Admin Password Change Alert', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[admin_monitoring][alert_admin_password_change]" value="1" <?php checked( ! empty( $monitoring['alert_admin_password_change'] ) ); ?>>
                                <?php esc_html_e( 'Send email alert when an administrator password is changed', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>

                <p class="description">
                    <?php
                    printf(
                        /* translators: %s: Link to notification settings */
                        esc_html__( '&#9432; Notifications are sent to the recipients configured in %s.', 'vigilante' ),
                        '<a href="' . esc_url( admin_url( 'admin.php?page=vigilante&tab=tools' ) ) . '">' . esc_html__( 'Settings & Tools', 'vigilante' ) . '</a>'
                    );
                    ?>
                </p>
            </div>

            <!-- Registration Approval -->
            <div id="vigilante-section-users-registration" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Registration approval', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Require manual approval for new user registrations.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable Registration Approval', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[registration_approval][enabled]" value="1" <?php checked( ! empty( $registration['enabled'] ) ); ?>>
                                <?php esc_html_e( 'New users must be approved by an administrator before they can log in', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Notify Admin', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[registration_approval][notify_admin]" value="1" <?php checked( ! empty( $registration['notify_admin'] ) ); ?>>
                                <?php esc_html_e( 'Send email notification when a new user registers', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Disable on high-traffic sites to avoid email overload.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-registration-approval-auto-reject-days"><?php esc_html_e( 'Auto-reject After', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-registration-approval-auto-reject-days" type="number" name="user_security[registration_approval][auto_reject_days]" value="<?php echo esc_attr( $registration['auto_reject_days'] ?? 0 ); ?>" min="0" max="365" class="small-text">
                            <?php esc_html_e( 'days (0 = never)', 'vigilante' ); ?>
                            <p class="description"><?php esc_html_e( 'Automatically reject pending registrations after this many days.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- Session Limits -->
            <div id="vigilante-section-users-sessions" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Session limits', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Limit the number of simultaneous sessions per user.', 'vigilante' ); ?></p>

                <?php if ( Vigilante_User_Security::session_limit_is_network_wide() ) : ?>
                    <div class="notice notice-warning inline">
                        <p>
                            <?php esc_html_e( 'This limit does not apply on a network. WordPress keeps the sessions of an account for the whole network, not per site, so a limit set here would count and close the sessions that person opened on other sites, including an administrator session elsewhere. A network-wide session policy is planned; until then these settings are saved but not enforced.', 'vigilante' ); ?>
                        </p>
                    </div>
                <?php endif; ?>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable Session Limits', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[session_limits][enabled]" value="1" <?php checked( ! empty( $session_limits['enabled'] ) ); ?>>
                                <?php esc_html_e( 'Limit the number of active sessions per user', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-session-limits-max-sessions"><?php esc_html_e( 'Maximum Sessions', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-session-limits-max-sessions" type="number" name="user_security[session_limits][max_sessions]" value="<?php echo esc_attr( $session_limits['max_sessions'] ?? 3 ); ?>" min="1" max="10" class="small-text">
                            <?php esc_html_e( 'sessions per user', 'vigilante' ); ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-session-limits-behavior"><?php esc_html_e( 'When Limit Exceeded', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-user-security-session-limits-behavior" name="user_security[session_limits][behavior]">
                                <option value="block_new" <?php selected( ( $session_limits['behavior'] ?? 'close_oldest' ), 'block_new' ); ?>><?php esc_html_e( 'Block new login', 'vigilante' ); ?></option>
                                <option value="close_oldest" <?php selected( ( $session_limits['behavior'] ?? 'close_oldest' ), 'close_oldest' ); ?>><?php esc_html_e( 'Close oldest session', 'vigilante' ); ?></option>
                            </select>
                            <p class="description"><?php esc_html_e( '"Close oldest" is recommended for security - ensures attackers cannot lock out legitimate users.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Exclude Administrators', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[session_limits][exclude_admins]" value="1" <?php checked( ! empty( $session_limits['exclude_admins'] ) ); ?>>
                                <?php esc_html_e( 'Do not apply session limits to administrators', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- Password Expiration -->
            <div id="vigilante-section-users-password-exp" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Password expiration', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Force users to change their password periodically.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable Password Expiration', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[password_expiration][enabled]" value="1" <?php checked( ! empty( $password_exp['enabled'] ) ); ?>>
                                <?php esc_html_e( 'Force password change after a set number of days', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-password-expiration-expire-days"><?php esc_html_e( 'Expire After', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-password-expiration-expire-days" type="number" name="user_security[password_expiration][expire_days]" value="<?php echo esc_attr( $password_exp['expire_days'] ?? 90 ); ?>" min="7" max="365" class="small-text">
                            <?php esc_html_e( 'days', 'vigilante' ); ?>
                            <p class="description"><?php esc_html_e( 'PCI-DSS recommends 90 days.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-password-expiration-warning-days"><?php esc_html_e( 'Warning Period', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-password-expiration-warning-days" type="number" name="user_security[password_expiration][warning_days]" value="<?php echo esc_attr( $password_exp['warning_days'] ?? 14 ); ?>" min="1" max="30" class="small-text">
                            <?php esc_html_e( 'days before expiration', 'vigilante' ); ?>
                            <p class="description"><?php esc_html_e( 'Show warning notice this many days before password expires.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-password-expiration-password-history"><?php esc_html_e( 'Password History', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-password-expiration-password-history" type="number" name="user_security[password_expiration][password_history]" value="<?php echo esc_attr( $password_exp['password_history'] ?? 3 ); ?>" min="0" max="24" class="small-text">
                            <?php esc_html_e( 'passwords to remember', 'vigilante' ); ?>
                            <p class="description"><?php esc_html_e( 'Prevent reusing recent passwords. Set to 0 to disable.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Email Reminder', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[password_expiration][send_reminder]" value="1" <?php checked( ! empty( $password_exp['send_reminder'] ) ); ?>>
                                <?php esc_html_e( 'Send email reminder when password is about to expire', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'The reminder is sent once when the warning period starts, using the same number of days configured above.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Affected Roles', 'vigilante' ); ?></th>
                        <td>
                            <?php
                            $affected_roles = $password_exp['affected_roles'] ?? array( 'administrator', 'editor' );
                            $all_roles = wp_roles()->get_names();
                            foreach ( $all_roles as $role_slug => $role_name ) :
                            ?>
                            <label style="display: block; margin-bottom: 5px;">
                                <input type="checkbox" name="user_security[password_expiration][affected_roles][]" value="<?php echo esc_attr( $role_slug ); ?>" <?php checked( in_array( $role_slug, $affected_roles, true ) ); ?>>
                                <?php echo esc_html( translate_user_role( $role_name ) ); ?>
                            </label>
                            <?php endforeach; ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Exclude specific users', 'vigilante' ); ?></th>
                        <td>
                            <?php $pwexp_excluded = $password_exp['excluded_users'] ?? array(); ?>
                            <div class="vigilante-2fa-user-search-container">
                                <div class="vigilante-2fa-user-search">
                                    <span class="search-icon"></span>
                                    <input type="text"
                                           id="vigilante_pwexp_user_search"
                                           placeholder="<?php esc_attr_e( 'Search users by name or email...', 'vigilante' ); ?>"
                                           autocomplete="off">
                                    <div class="vigilante-pwexp-search-results"></div>
                                </div>
                                <div class="vigilante-pwexp-excluded-users">
                                    <?php
                                    foreach ( $pwexp_excluded as $pwexp_excluded_id ) :
                                        $excluded_user = get_user_by( 'ID', $pwexp_excluded_id );
                                        if ( ! $excluded_user ) {
                                            continue;
                                        }
                                    ?>
                                    <div class="vigilante-pwexp-excluded-user" data-user-id="<?php echo esc_attr( $pwexp_excluded_id ); ?>">
                                        <span class="user-display"><?php echo esc_html( $excluded_user->display_name . ' (' . $excluded_user->user_email . ')' ); ?></span>
                                        <button type="button" class="remove-user" aria-label="<?php esc_attr_e( 'Remove', 'vigilante' ); ?>">&times;</button>
                                        <input type="hidden" name="user_security[password_expiration][excluded_users][]" value="<?php echo esc_attr( $pwexp_excluded_id ); ?>">
                                    </div>
                                    <?php endforeach; ?>
                                </div>
                            </div>
                            <p class="description"><?php esc_html_e( 'Listed users will be excluded from password expiration regardless of their role.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- Email Verification -->
            <div id="vigilante-section-users-email-verify" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Email verification', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Require new users to verify their email address before logging in.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Enable Email Verification', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[email_verification][enabled]" value="1" <?php checked( ! empty( $email_verify['enabled'] ) ); ?>>
                                <?php esc_html_e( 'New users must verify their email before logging in', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-email-verification-token-expiry-hours"><?php esc_html_e( 'Link Expiration', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-email-verification-token-expiry-hours" type="number" name="user_security[email_verification][token_expiry_hours]" value="<?php echo esc_attr( $email_verify['token_expiry_hours'] ?? 24 ); ?>" min="1" max="168" class="small-text">
                            <?php esc_html_e( 'hours', 'vigilante' ); ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Allow Resend', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="user_security[email_verification][allow_resend]" value="1" <?php checked( ! empty( $email_verify['allow_resend'] ) ); ?>>
                                <?php esc_html_e( 'Allow users to request a new verification email', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-user-security-email-verification-auto-delete-days"><?php esc_html_e( 'Auto-delete Unverified', 'vigilante' ); ?></label></th>
                        <td>
                            <input id="vigilante-f-user-security-email-verification-auto-delete-days" type="number" name="user_security[email_verification][auto_delete_days]" value="<?php echo esc_attr( $email_verify['auto_delete_days'] ?? 7 ); ?>" min="0" max="365" class="small-text">
                            <?php esc_html_e( 'days (0 = never)', 'vigilante' ); ?>
                            <p class="description"><?php esc_html_e( 'Automatically delete users who never verify their email.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>

        <!-- ============================================================
             TOOLS SECTION - Actions and utilities (no save button)
             ============================================================ -->
        <div class="vigilante-tools-section">
            <h2 class="vigilante-tools-header">
                <?php esc_html_e( 'User security tools', 'vigilante' ); ?>
            </h2>

            <?php $this->render_user_actions_notice(); ?>
            <?php if ( ! $this->user_actions_locked() ) : ?>

            <!-- Force Password Reset -->
            <div class="vigilante-tool-box">
                <h3><?php esc_html_e( 'Force password reset', 'vigilante' ); ?></h3>
                <p class="description"><?php esc_html_e( 'Force users to reset their password. Useful after a security incident. Users will receive an email with a reset link.', 'vigilante' ); ?></p>

                <!-- Reset Specific Users -->
                <div class="vigilante-password-reset-box">
                    <h4><?php esc_html_e( 'Reset specific users', 'vigilante' ); ?></h4>
                    
                    <div class="vigilante-user-search-wrapper">
                        <input type="text" id="vigilante-password-reset-search" class="regular-text" placeholder="<?php esc_attr_e( 'Search by username, email, or display name...', 'vigilante' ); ?>">
                        <div id="vigilante-password-reset-results" class="vigilante-user-search-results" style="display: none;"></div>
                    </div>

                    <div id="vigilante-password-reset-selected" class="vigilante-selected-users" style="display: none;">
                        <strong><?php esc_html_e( 'Selected Users:', 'vigilante' ); ?></strong>
                        <ul class="vigilante-selected-users-list"></ul>
                    </div>

                    <p class="description" style="margin-top: 15px;">
                        <span class="dashicons dashicons-email-alt" style="color: #2271b1;"></span>
                        <?php esc_html_e( 'Selected users will receive an email with a password reset link.', 'vigilante' ); ?>
                    </p>

                    <p class="submit">
                        <button type="button" id="vigilante-reset-selected-users" class="button button-primary" disabled>
                            <?php esc_html_e( 'Force Reset for Selected Users', 'vigilante' ); ?>
                        </button>
                    </p>
                </div>

                <!-- Reset by Role -->
                <div class="vigilante-password-reset-box" style="margin-top: 20px; padding-top: 20px; border-top: 1px solid #ddd;">
                    <h4><?php esc_html_e( 'Reset by role', 'vigilante' ); ?></h4>
                    <p class="description"><?php esc_html_e( 'Select one or more roles to force a password reset for all users with those roles. Ideal for security incidents where you need to reset access quickly.', 'vigilante' ); ?></p>

                    <?php
                    $wp_roles      = wp_roles();
                    $user_counts   = count_users();
                    $avail_roles   = $user_counts['avail_roles'] ?? array();
                    $current_user  = wp_get_current_user();
                    $current_roles = $current_user->roles;
                    ?>

                    <fieldset class="vigilante-role-checkboxes" style="margin-top: 10px;">
                        <?php foreach ( $wp_roles->roles as $role_slug => $role_data ) :
                            $count = $avail_roles[ $role_slug ] ?? 0;
                            if ( 0 === $count ) {
                                continue;
                            }
                            $role_name = translate_user_role( $role_data['name'] );
                        ?>
                            <label style="display: block; margin-bottom: 6px;">
                                <input type="checkbox"
                                    class="vigilante-reset-role-checkbox"
                                    value="<?php echo esc_attr( $role_slug ); ?>"
                                    data-count="<?php echo absint( $count ); ?>">
                                <?php
                                printf(
                                    /* translators: 1: Role name, 2: Number of users */
                                    '%1$s <span class="description">(%2$d)</span>',
                                    esc_html( $role_name ),
                                    absint( $count )
                                );
                                ?>
                                <?php if ( in_array( $role_slug, $current_roles, true ) ) : ?>
                                    <em class="description"><?php esc_html_e( '(includes you)', 'vigilante' ); ?></em>
                                <?php endif; ?>
                            </label>
                        <?php endforeach; ?>
                    </fieldset>

                    <div id="vigilante-reset-role-summary" style="display: none; margin-top: 10px;">
                        <p>
                            <span class="dashicons dashicons-groups" style="color: #2271b1;"></span>
                            <strong id="vigilante-reset-role-count">0</strong>
                            <?php esc_html_e( 'user(s) will be affected.', 'vigilante' ); ?>
                        </p>
                    </div>

                    <div class="vigilante-password-reset-options" id="vigilante-reset-role-self-option" style="display: none; margin-top: 10px;">
                        <label>
                            <input type="checkbox" id="vigilante-reset-role-include-self" value="1">
                            <?php esc_html_e( 'Include myself (your current session will end)', 'vigilante' ); ?>
                        </label>
                    </div>

                    <p class="submit">
                        <button type="button" id="vigilante-reset-by-role" class="button button-primary" disabled>
                            <?php esc_html_e( 'Force Reset for Selected Roles', 'vigilante' ); ?>
                        </button>
                    </p>
                </div>

                <!-- Reset All Users -->
                <div class="vigilante-password-reset-box" style="margin-top: 20px; padding-top: 20px; border-top: 1px solid #ddd;">
                    <h4><?php esc_html_e( 'Reset all users', 'vigilante' ); ?></h4>

                    <?php
                    $total_users = count_users();
                    $total_count = $total_users['total_users'];
                    ?>
                    <p>
                        <?php
                        printf(
                            /* translators: %d: Number of users */
                            esc_html__( 'This will affect %d user(s).', 'vigilante' ),
                            absint( $total_count )
                        );
                        ?>
                    </p>

                    <p class="description" style="color: #d63638;">
                        <span class="dashicons dashicons-warning"></span>
                        <?php esc_html_e( 'Warning: All users will receive a password reset email. On sites with many users, this could overwhelm your mail server.', 'vigilante' ); ?>
                    </p>

                    <div class="vigilante-password-reset-options" style="margin-top: 10px;">
                        <label>
                            <input type="checkbox" id="vigilante-reset-all-include-self" value="1">
                            <?php esc_html_e( 'Include myself (your current session will end)', 'vigilante' ); ?>
                        </label>
                    </div>

                    <p class="submit">
                        <button type="button" id="vigilante-reset-all-users" class="button" style="color: #d63638; border-color: #d63638;">
                            <?php esc_html_e( 'Force Reset for ALL Users', 'vigilante' ); ?>
                        </button>
                    </p>
                </div>
            </div>

            <!-- Pending Registrations -->
            <?php
            // Enforcement-only: this instance exists to read the queue, and the
            // flag keeps it from registering the module's own hooks a second
            // time. It is not inert, and saying it was would be a false comment:
            // init_enforcement_hooks() does add its three filters again, on top
            // of the ones already registered. They are idempotent (the same
            // methods of an equivalent instance, deciding on the same user meta),
            // so running them twice in an admin request changes nothing, which is
            // why this is accepted rather than worked around.
            $user_security = new Vigilante_User_Security( $this->settings, $this->activity_log, true );
            $pending_users = $user_security->get_pending_users();
            ?>
            <div id="vigilante-section-users-pending" class="vigilante-tool-box vigilante-pending-users-section">
                <h3>
                    <?php esc_html_e( 'Pending registrations', 'vigilante' ); ?>
                    <?php if ( count( $pending_users ) > 0 ) : ?>
                        <span class="vigilante-badge vigilante-badge-warning"><?php echo esc_html( count( $pending_users ) ); ?></span>
                    <?php endif; ?>
                </h3>

                <?php
                /*
                 * The queue is shown whenever there is somebody in it, even with
                 * the feature off. Since 2.11.10 an account already waiting stays
                 * blocked when the feature is switched off, which is the point:
                 * turning a setting off must not quietly let in people an
                 * administrator decided not to approve. But hiding the table then
                 * left them locked out with no button anywhere to approve or
                 * reject them. Found by the cross review of 2.11.10.
                 */
                ?>
                <?php if ( empty( $registration['enabled'] ) && empty( $pending_users ) ) : ?>
                    <p class="description">
                        <span class="dashicons dashicons-info" style="color: #72aee6;"></span>
                        <?php esc_html_e( 'Registration approval is disabled. Enable it in the settings above to require manual approval for new users.', 'vigilante' ); ?>
                    </p>
                <?php elseif ( empty( $pending_users ) ) : ?>
                    <div class="vigilante-no-lockouts">
                        <span class="dashicons dashicons-yes-alt"></span>
                        <p><?php esc_html_e( 'No pending registrations.', 'vigilante' ); ?></p>
                    </div>
                <?php else : ?>
                    <?php $this->render_user_actions_notice(); ?>
                    <table class="wp-list-table widefat fixed striped vigilante-pending-users-table">
                        <thead>
                            <tr>
                                <th><?php esc_html_e( 'User', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Email', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Registered', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                            </tr>
                        </thead>
                        <tbody>
                            <?php foreach ( $pending_users as $pending_user ) : 
                                $pending_since = get_user_meta( $pending_user->ID, Vigilante_User_Security::site_user_meta_key( 'vigilante_pending_since' ), true );
                            ?>
                            <tr data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>">
                                <td>
                                    <?php echo get_avatar( $pending_user->ID, 32 ); ?>
                                    <strong><?php echo esc_html( $pending_user->user_login ); ?></strong>
                                </td>
                                <td><?php echo esc_html( $pending_user->user_email ); ?></td>
                                <td>
                                    <?php 
                                    if ( $pending_since ) {
                                        /* translators: %s: Time ago */
                                        printf( esc_html__( '%s ago', 'vigilante' ), esc_html( human_time_diff( $pending_since ) ) );
                                    } else {
                                        echo esc_html( $pending_user->user_registered );
                                    }
                                    ?>
                                </td>
                                <td>
                                    <button type="button" class="button button-small vigilante-approve-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" <?php disabled( $this->user_actions_locked() ); ?>>
                                        <?php esc_html_e( 'Approve', 'vigilante' ); ?>
                                    </button>
                                    <button type="button" class="button button-small vigilante-reject-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" style="color: #d63638;" <?php disabled( $this->user_actions_locked() ); ?>>
                                        <?php esc_html_e( 'Reject', 'vigilante' ); ?>
                                    </button>
                                </td>
                            </tr>
                            <?php endforeach; ?>
                        </tbody>
                    </table>
                <?php endif; ?>
            </div>

            <!-- Active Sessions Management -->
            <div class="vigilante-tool-box vigilante-session-management-section">
                <h3><?php esc_html_e( 'Active sessions', 'vigilante' ); ?></h3>
                <p class="description"><?php esc_html_e( 'View and manage active login sessions. You can revoke sessions to force users to log in again.', 'vigilante' ); ?></p>

                <!-- Current user sessions -->
                <h4><?php esc_html_e( 'Your sessions', 'vigilante' ); ?></h4>
                <?php
                $current_user_id = get_current_user_id();
                $my_sessions = $user_security->get_user_sessions( $current_user_id );
                $has_corrupted = $user_security->has_corrupted_sessions( $current_user_id );
                $raw_count = $user_security->get_raw_session_count( $current_user_id );
                ?>
                
                <?php if ( $has_corrupted && $raw_count > 0 ) : ?>
                    <div class="notice notice-warning inline" style="margin: 10px 0;">
                        <p>
                            <span class="dashicons dashicons-warning" style="color: #dba617;"></span>
                            <?php esc_html_e( 'Some session data is corrupted and cannot be displayed. Use "Revoke All Other Sessions" to clean up, then log out and log in again to fix this.', 'vigilante' ); ?>
                        </p>
                    </div>
                <?php endif; ?>
                
                <?php if ( empty( $my_sessions ) ) : ?>
                    <p class="description"><?php esc_html_e( 'No active sessions found.', 'vigilante' ); ?></p>
                    <?php if ( $has_corrupted ) : ?>
                    <p style="margin-top: 10px;">
                        <button type="button" class="button vigilante-revoke-other-sessions" data-user-id="<?php echo esc_attr( $current_user_id ); ?>">
                            <?php esc_html_e( 'Clean Up Corrupted Sessions', 'vigilante' ); ?>
                        </button>
                    </p>
                    <?php endif; ?>
                <?php else : ?>
                    <div class="vigilante-paginated-section">
                    <div class="vigilante-fi-pagination-wrap"></div>
                    <table class="wp-list-table widefat fixed striped vigilante-sessions-table vigilante-fi-paginated">
                        <thead>
                            <tr>
                                <th><?php esc_html_e( 'Browser', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'IP Address', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Login Time', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                            </tr>
                        </thead>
                        <tbody>
                            <?php foreach ( $my_sessions as $session ) : ?>
                            <tr data-token="<?php echo esc_attr( $session['token_hash'] ); ?>">
                                <td><?php echo esc_html( $session['browser'] ); ?></td>
                                <td><code><?php echo esc_html( $session['ip'] ); ?></code></td>
                                <td>
                                    <?php 
                                    if ( $session['login'] ) {
                                        /* translators: %s: Time ago */
                                        printf( esc_html__( '%s ago', 'vigilante' ), esc_html( human_time_diff( $session['login'] ) ) );
                                    } else {
                                        esc_html_e( 'Unknown', 'vigilante' );
                                    }
                                    ?>
                                </td>
                                <td>
                                    <?php if ( ! $session['is_current'] ) : ?>
                                        <button type="button" class="button button-small vigilante-revoke-session" data-user-id="<?php echo esc_attr( $current_user_id ); ?>" data-token="<?php echo esc_attr( $session['token_hash'] ); ?>">
                                            <?php esc_html_e( 'Revoke', 'vigilante' ); ?>
                                        </button>
                                    <?php else : ?>
                                        <span class="description"><?php esc_html_e( 'Current session', 'vigilante' ); ?></span>
                                    <?php endif; ?>
                                </td>
                            </tr>
                            <?php endforeach; ?>
                        </tbody>
                    </table>
                    </div>
                    
                    <?php if ( count( $my_sessions ) > 1 || $has_corrupted ) : ?>
                    <p style="margin-top: 10px;">
                        <button type="button" class="button vigilante-revoke-other-sessions" data-user-id="<?php echo esc_attr( $current_user_id ); ?>">
                            <?php esc_html_e( 'Revoke All Other Sessions', 'vigilante' ); ?>
                        </button>
                    </p>
                    <?php endif; ?>
                <?php endif; ?>

                <!-- Search user sessions (admin only) -->
                <h4 style="margin-top: 30px;"><?php esc_html_e( 'Manage user sessions', 'vigilante' ); ?></h4>
                <p class="description"><?php esc_html_e( 'Search for a user to view and manage their sessions.', 'vigilante' ); ?></p>
                
                <div class="vigilante-user-search-wrapper" style="margin-top: 10px;">
                    <input type="text" id="vigilante-session-user-search" class="regular-text" placeholder="<?php esc_attr_e( 'Search by username or email...', 'vigilante' ); ?>">
                    <div id="vigilante-session-search-results" class="vigilante-user-search-results" style="display: none;"></div>
                </div>
                
                <div id="vigilante-user-sessions-container" style="display: none; margin-top: 20px;">
                    <h4 id="vigilante-sessions-user-name"></h4>
                    <table class="wp-list-table widefat fixed striped vigilante-sessions-table">
                        <thead>
                            <tr>
                                <th><?php esc_html_e( 'Browser', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'IP Address', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Login Time', 'vigilante' ); ?></th>
                                <th><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                            </tr>
                        </thead>
                        <tbody id="vigilante-user-sessions-list">
                        </tbody>
                    </table>
                    <p style="margin-top: 10px;">
                        <button type="button" class="button vigilante-revoke-all-user-sessions" style="color: #d63638;">
                            <?php esc_html_e( 'Revoke All Sessions', 'vigilante' ); ?>
                        </button>
                    </p>
                </div>
            </div>

            <?php endif; ?>
        </div>
        <?php
    }

    /**
     * Render WordPress Hardening tab
     */
    private function render_tab_wp_hardening() {
        $is_disabled = $this->render_module_disabled_notice( 'wp_hardening' );
        $options = $this->settings->get_section( 'wp_hardening' );
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="wp_hardening" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <!-- Database Hardening (outside form save flow - uses its own AJAX action) -->
            <?php $vg_shared_locked = $this->shared_files_locked(); ?>
            <?php $this->render_shared_files_notice(); ?>
            <div id="vigilante-section-hardening-database" class="vigilante-settings-section <?php echo $vg_shared_locked ? 'vigilante-form-disabled' : ''; ?>" <?php echo $vg_shared_locked ? 'inert' : ''; ?>>
                <h2>
                    <?php esc_html_e( 'Database Hardening', 'vigilante' ); ?>
                    <span class="vigilante-method-badge database"><?php esc_html_e( 'Database', 'vigilante' ); ?></span>
                    <span class="vigilante-method-badge config"><?php esc_html_e( 'WP-CONFIG', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Change the database table prefix to prevent SQL injection attacks that target default WordPress tables.', 'vigilante' ); ?></p>

                <?php
                $db_prefix = new Vigilante_Database_Prefix();
                $current_prefix = $db_prefix->get_current_prefix();
                $is_default = $db_prefix->is_default_prefix();
                ?>

                <?php if ( is_multisite() && ! $vg_shared_locked ) : ?>
                    <div class="notice notice-warning inline" style="margin:10px 0 16px;padding:8px 12px;">
                        <p style="margin:0;"><?php esc_html_e( 'Network-wide operation: it renames the tables of every site in the network and rewrites the wp-config.php they all share. Back up the whole database first, not just the main site.', 'vigilante' ); ?></p>
                    </div>
                <?php endif; ?>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Current prefix', 'vigilante' ); ?></th>
                        <td>
                            <code class="vigilante-db-current-prefix"><?php echo esc_html( $current_prefix ); ?></code>
                            <?php if ( $is_default ) : ?>
                                <span class="vigilante-inline-warning">
                                    <span class="dashicons dashicons-warning"></span>
                                    <?php esc_html_e( 'Default prefix detected. Changing it adds a layer of protection against automated SQL injection attacks.', 'vigilante' ); ?>
                                </span>
                            <?php else : ?>
                                <span class="vigilante-inline-ok">
                                    <span class="dashicons dashicons-yes-alt"></span>
                                    <?php esc_html_e( 'Custom prefix in use.', 'vigilante' ); ?>
                                </span>
                            <?php endif; ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'New prefix', 'vigilante' ); ?></th>
                        <td>
                            <div class="vigilante-db-prefix-row">
                                <code class="vigilante-db-new-prefix" id="vigilante-new-prefix"><?php echo esc_html( $db_prefix->generate_prefix() ); ?></code>
                                <button type="button" class="button button-small vigilante-db-regenerate-prefix" title="<?php esc_attr_e( 'Generate new prefix', 'vigilante' ); ?>">
                                    <span class="dashicons dashicons-update"></span>
                                </button>
                            </div>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"></th>
                        <td>
                            <div class="vigilante-db-prefix-confirm">
                                <label>
                                    <input type="checkbox" id="vigilante-prefix-backup-confirm">
                                    <?php esc_html_e( 'I understand this operation is irreversible and I have a current database backup', 'vigilante' ); ?>
                                </label>
                                <p class="description">
                                    <?php
                                    printf(
                                        /* translators: %s: Link to tools tab */
                                        esc_html__( 'Need a backup? %s first.', 'vigilante' ),
                                        '<a href="' . esc_url( admin_url( 'admin.php?page=vigilante&tab=tools' ) ) . '">' . esc_html__( 'Download a database backup', 'vigilante' ) . '</a>'
                                    );
                                    ?>
                                </p>
                            </div>
                            <button type="button" class="button button-primary vigilante-db-change-prefix" disabled data-original-text="<?php esc_attr_e( 'Change Database Prefix', 'vigilante' ); ?>">
                                <?php esc_html_e( 'Change Database Prefix', 'vigilante' ); ?>
                            </button>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- wp-config Security -->
            <?php
            $vg_shared_locked = $this->shared_files_locked();
            // Paint what is actually in force, not this site's unused copy.
            $vg_local_options = $options;
            $options = $this->get_section_for_display( 'wp_hardening' );
            ?>
            <?php $this->render_shared_files_notice(); ?>
            <div id="vigilante-section-hardening-wpconfig" class="vigilante-settings-section <?php echo $vg_shared_locked ? 'vigilante-form-disabled' : ''; ?>" <?php echo $vg_shared_locked ? 'inert' : ''; ?>>
                <h2>
                    <?php esc_html_e( 'wp-config.php Security', 'vigilante' ); ?>
                    <span class="vigilante-method-badge config"><?php esc_html_e( 'WP-CONFIG', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Security constants added directly to wp-config.php file.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable File Editor', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disallow_file_edit]" value="1" <?php checked( ! empty( $options['disallow_file_edit'] ) ); ?>>
                                <?php esc_html_e( 'Disable plugin and theme editor in admin (DISALLOW_FILE_EDIT)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable File Modifications', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disallow_file_mods]" value="1" <?php checked( ! empty( $options['disallow_file_mods'] ) ); ?>>
                                <?php esc_html_e( 'Disable all file modifications including updates (DISALLOW_FILE_MODS)', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( '&#9888; Warning: This prevents automatic updates.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr id="field-force-ssl-admin">
                        <th scope="row"><?php esc_html_e( 'Force SSL Admin', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[force_ssl_admin]" value="1" <?php checked( ! empty( $options['force_ssl_admin'] ) ); ?>>
                                <?php esc_html_e( 'Force HTTPS for admin area (FORCE_SSL_ADMIN)', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( '&#9888; Warning: Only enable if your site fully supports HTTPS.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr id="field-wp-debug">
                        <th scope="row"><?php esc_html_e( 'Hide PHP errors from visitors', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[wp_debug]" value="1" <?php checked( ! empty( $options['wp_debug'] ) ); ?>>
                                <?php esc_html_e( 'Prevents PHP errors and warnings from being displayed publicly. Also avoids exposing a debug.log file in wp-content/ that could leak paths and code. Uncheck only on development or staging sites.', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr id="field-disable-wp-cron">
                        <th scope="row"><?php esc_html_e( 'Disable WP Cron', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disable_wp_cron]" value="1" <?php checked( ! empty( $options['disable_wp_cron'] ) ); ?>>
                                <?php esc_html_e( 'Disable WordPress\'s page-view cron trigger (DISABLE_WP_CRON)', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php
                                printf(
                                    /* translators: 1: opening <strong>, 2: closing </strong>, 3: opening <code>, 4: closing </code> */
                                    esc_html__( '%1$sWarning:%2$s Only enable if your host runs a real server-side cron job calling wp-cron.php. Otherwise scheduled tasks stop running. This constant only stops the page-view auto-spawn — to also block external HTTP abuse, enable %3$sProtect wp-cron.php%4$s in Firewall &rarr; File Protection.', 'vigilante' ),
                                    '<strong>',
                                    '</strong>',
                                    '<code>',
                                    '</code>'
                                ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML tags are hardcoded.
                            ?></p>
                        </td>
                    </tr>
                </table>
            </div>
            <?php $options = $vg_local_options; ?>

            <!-- Comment Security -->
            <div id="vigilante-section-hardening-xmlrpc" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'XML-RPC', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'The legacy remote interface. It is what the WordPress mobile app, Jetpack and remote managers talk to, and also the way pingback amplification and password guessing reach a site.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr id="field-disable-xmlrpc">
                        <th scope="row"><label for="vigilante-f-wp-hardening-xmlrpc-mode"><?php esc_html_e( 'XML-RPC access', 'vigilante' ); ?></label></th>
                        <td>
                            <?php $vig_xmlrpc_mode = Vigilante_Comment_Security::resolve_xmlrpc_mode( $this->settings ); ?>
                            <select id="vigilante-f-wp-hardening-xmlrpc-mode" name="wp_hardening[xmlrpc_mode]">
                                <option value="none" <?php selected( $vig_xmlrpc_mode, 'none' ); ?>>
                                    <?php esc_html_e( 'Leave XML-RPC enabled', 'vigilante' ); ?>
                                </option>
                                <option value="pingback" <?php selected( $vig_xmlrpc_mode, 'pingback' ); ?>>
                                    <?php esc_html_e( 'Block the pingback methods only', 'vigilante' ); ?>
                                </option>
                                <option value="full" <?php selected( $vig_xmlrpc_mode, 'full' ); ?>>
                                    <?php esc_html_e( 'Disable XML-RPC completely (recommended)', 'vigilante' ); ?>
                                </option>
                            </select>
                            <p class="description"><?php esc_html_e( 'Disable it completely unless something still needs it, such as the WordPress mobile app, Jetpack or a remote manager; in that case block only the pingback methods, which closes the amplification vector and leaves the rest working. Pingbacks are also covered by the Comment Security setting just below, which additionally closes them for comments.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <div id="vigilante-section-hardening-comments" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Comment Security', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                    <span class="vigilante-method-badge settings"><?php esc_html_e( 'Settings', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Comment protection using WordPress settings and PHP hooks.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable Pingbacks', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disable_pingbacks]" value="1" <?php checked( ! empty( $options['disable_pingbacks'] ) ); ?>>
                                <?php esc_html_e( 'Disable pingbacks (commonly exploited for DDoS)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable Trackbacks', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disable_trackbacks]" value="1" <?php checked( ! empty( $options['disable_trackbacks'] ) ); ?>>
                                <?php esc_html_e( 'Disable trackbacks (rarely used legitimately)', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Require Moderation', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[require_comment_moderation]" value="1" <?php checked( ! empty( $options['require_comment_moderation'] ) ); ?>>
                                <?php esc_html_e( 'All comments must be manually approved', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Close Old Comments', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[close_old_comments]" value="1" <?php checked( ! empty( $options['close_old_comments'] ) ); ?>>
                                <?php esc_html_e( 'Automatically close comments on old posts after', 'vigilante' ); ?>
                            </label>
                            <input type="number" id="vigilante-f-wp-hardening-close-comments-after-days" name="wp_hardening[close_comments_after_days]" value="<?php echo esc_attr( $options['close_comments_after_days'] ?? 30 ); ?>" min="1" max="365" class="small-text">
                            <label for="vigilante-f-wp-hardening-close-comments-after-days"><?php esc_html_e( 'days', 'vigilante' ); ?></label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Honeypot Protection', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[honeypot_comments]" value="1" <?php checked( ! empty( $options['honeypot_comments'] ) ); ?>>
                                <?php esc_html_e( 'Add hidden honeypot field to catch bots', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- Head Cleaner -->
            <div id="vigilante-section-hardening-headers" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Header Cleanup', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Remove meta tags from HTML head.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove Generator', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_wp_generator]" value="1" <?php checked( ! empty( $options['remove_wp_generator'] ) ); ?>>
                                <?php esc_html_e( 'Remove WordPress version from HTML head', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr id="field-remove-wp-version-assets">
                        <th scope="row"><?php esc_html_e( 'Remove version from assets', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_wp_version_assets]" value="1" <?php checked( ! empty( $options['remove_wp_version_assets'] ) ); ?>>
                                <?php esc_html_e( 'Remove WordPress version from script/style URLs (?ver=)', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Hides the exact WordPress version that would otherwise leak in every enqueued asset URL. Versions added by plugins or themes are kept untouched.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove RSD Link', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_rsd_link]" value="1" <?php checked( ! empty( $options['remove_rsd_link'] ) ); ?>>
                                <?php esc_html_e( 'Remove Really Simple Discovery link', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove WLW Manifest', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_wlw_manifest]" value="1" <?php checked( ! empty( $options['remove_wlw_manifest'] ) ); ?>>
                                <?php esc_html_e( 'Remove Windows Live Writer manifest link', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove Shortlink', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_shortlink]" value="1" <?php checked( ! empty( $options['remove_shortlink'] ) ); ?>>
                                <?php esc_html_e( 'Remove shortlink tag from header', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove REST API Link', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_rest_api_link]" value="1" <?php checked( ! empty( $options['remove_rest_api_link'] ) ); ?>>
                                <?php esc_html_e( 'Remove REST API discovery link from header', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( '&#9888; Notice: Some plugins may need this link.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <!-- Feed Manager -->
            <div id="vigilante-section-hardening-rss" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'RSS Feed Settings', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Control RSS/Atom feeds.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable Feeds', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disable_feeds]" value="1" <?php checked( ! empty( $options['disable_feeds'] ) ); ?>>
                                <?php esc_html_e( 'Completely disable RSS/Atom feeds', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Disable If No Content', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[disable_if_no_content]" value="1" <?php checked( ! empty( $options['disable_if_no_content'] ) ); ?>>
                                <?php esc_html_e( 'Only disable feeds if site has no published posts', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Remove Feed Version', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="wp_hardening[remove_feed_version]" value="1" <?php checked( ! empty( $options['remove_feed_version'] ) ); ?>>
                                <?php esc_html_e( 'Remove WordPress version from feed generator tag', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>
        <?php
    }

    /**
     * Render activity log tab
     */
    private function render_tab_activity_log() {
        $is_disabled = $this->render_module_disabled_notice( 'activity_log' );
        $options = $this->settings->get_section( 'activity_log' );
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="activity_log" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <div id="vigilante-section-audit-settings" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Security Audit Settings', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                    <span class="vigilante-method-badge database"><?php esc_html_e( 'Database', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Security event logging and auditing.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Retention', 'vigilante' ); ?></th>
                        <td>
                            <input type="number" id="vigilante-f-activity-log-retention-days" name="activity_log[retention_days]" value="<?php echo esc_attr( $options['retention_days'] ?? 30 ); ?>" min="7" max="365" class="small-text">
                            <label for="vigilante-f-activity-log-retention-days"><?php esc_html_e( 'days', 'vigilante' ); ?></label>
                            &nbsp;&nbsp;
                            <input type="number" id="vigilante-f-activity-log-max-entries" name="activity_log[max_entries]" value="<?php echo esc_attr( $options['max_entries'] ?? 10000 ); ?>" min="100" max="100000" step="100" class="small-text">
                            <label for="vigilante-f-activity-log-max-entries"><?php esc_html_e( 'max entries', 'vigilante' ); ?></label>
                            <p class="description"><?php esc_html_e( 'Whichever limit is reached first takes effect. Changes apply immediately on save; daily maintenance also enforces these limits automatically.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Events to Log', 'vigilante' ); ?></th>
                        <td>
                            <fieldset style="display:grid; grid-template-columns:repeat(auto-fit, minmax(240px, 1fr)); gap:6px 24px; max-width:600px;">
                                <label><input type="checkbox" name="activity_log[log_logins]" value="1" <?php checked( ! empty( $options['log_logins'] ) ); ?>> <?php esc_html_e( 'Successful logins', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_failed_logins]" value="1" <?php checked( ! empty( $options['log_failed_logins'] ) ); ?>> <?php esc_html_e( 'Failed login attempts', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_user_changes]" value="1" <?php checked( ! empty( $options['log_user_changes'] ) ); ?>> <?php esc_html_e( 'User changes', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_post_changes]" value="1" <?php checked( ! empty( $options['log_post_changes'] ) ); ?>> <?php esc_html_e( 'Content changes', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_plugin_changes]" value="1" <?php checked( ! empty( $options['log_plugin_changes'] ) ); ?>> <?php esc_html_e( 'Plugin changes', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_theme_changes]" value="1" <?php checked( ! empty( $options['log_theme_changes'] ) ); ?>> <?php esc_html_e( 'Theme changes', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_comments]" value="1" <?php checked( ! empty( $options['log_comments'] ) ); ?>> <?php esc_html_e( 'Comment changes', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_media]" value="1" <?php checked( ! empty( $options['log_media'] ) ); ?>> <?php esc_html_e( 'Media uploads/deletions', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_file_changes]" value="1" <?php checked( ! empty( $options['log_file_changes'] ) ); ?>> <?php esc_html_e( 'File integrity events', 'vigilante' ); ?></label>
                                <label><input type="checkbox" name="activity_log[log_option_changes]" value="1" <?php checked( ! empty( $options['log_option_changes'] ) ); ?>> <?php esc_html_e( 'WordPress option changes', 'vigilante' ); ?></label>
                            </fieldset>
                            <div class="notice notice-info inline" style="margin:10px 0 0;padding:8px 12px;">
                                <p style="margin:0;">
                                    <?php esc_html_e( 'Firewall blocks, security events, and Vigilant settings changes are always logged regardless of the above selections.', 'vigilante' ); ?>
                                </p>
                            </div>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-activity-log-tracked-options"><?php esc_html_e( 'Option Tracking', 'vigilante' ); ?></label></th>
                        <td>
                            <p class="description" style="margin-top:0;"><?php esc_html_e( 'When "WordPress option changes" is enabled, Vigilant tracks ~30 core WordPress settings (site URL, admin email, registration, active plugins, theme, comments, privacy, etc.). Use the field below to track additional options from other plugins.', 'vigilante' ); ?></p>
                            <br>
                            <label><?php esc_html_e( 'Additional options to track:', 'vigilante' ); ?></label><br>
                            <textarea id="vigilante-f-activity-log-tracked-options" name="activity_log[tracked_options]" rows="3" cols="50" class="regular-text code" placeholder="woocommerce_&#10;seopress_&#10;wpforms_"><?php echo esc_textarea( implode( "\n", $options['tracked_options'] ?? array() ) ); ?></textarea>
                            <p class="description"><?php esc_html_e( 'One option name per line. Use a trailing underscore to match all options with that prefix (e.g. "woocommerce_" tracks all WooCommerce settings).', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Exclusions', 'vigilante' ); ?></th>
                        <td>
                            <div style="display:grid; grid-template-columns:repeat(auto-fit, minmax(220px, 1fr)); gap:16px; max-width:600px;">
                                <div>
                                    <label for="vigilante-f-activity-log-excluded-users"><?php esc_html_e( 'Excluded user IDs:', 'vigilante' ); ?></label><br>
                                    <textarea id="vigilante-f-activity-log-excluded-users" name="activity_log[excluded_users]" rows="3" cols="25"><?php echo esc_textarea( implode( "\n", $options['excluded_users'] ?? array() ) ); ?></textarea>
                                    <p class="description"><?php esc_html_e( 'One user ID per line. Actions by these users will not be logged.', 'vigilante' ); ?></p>
                                </div>
                                <div>
                                    <label for="vigilante-f-activity-log-excluded-ips"><?php esc_html_e( 'Excluded IPs:', 'vigilante' ); ?></label><br>
                                    <textarea id="vigilante-f-activity-log-excluded-ips" name="activity_log[excluded_ips]" rows="3" cols="25"><?php echo esc_textarea( implode( "\n", $options['excluded_ips'] ?? array() ) ); ?></textarea>
                                    <p class="description"><?php esc_html_e( 'One IP per line. Requests from these IPs will not be logged.', 'vigilante' ); ?></p>
                                </div>
                            </div>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>

        <?php
        // Audit Alerts — alerting layer on top of Security Audit. Its own
        // settings section and form, rendered right after the logging settings
        // so the tab reads as "log this, exclude that, and alert me about this".
        $alerts         = $this->settings->get_section( 'audit_alerts' );
        $immediate      = isset( $alerts['immediate'] ) ? $alerts['immediate'] : array();
        $threshold      = isset( $alerts['threshold'] ) ? $alerts['threshold'] : array();
        $alert_severity = isset( $immediate['min_severity'] ) ? $immediate['min_severity'] : 'critical';
        $alert_window   = isset( $threshold['window'] ) ? $threshold['window'] : '1h';
        $threshold_cats = isset( $threshold['categories'] ) ? (array) $threshold['categories'] : array();
        $cat_labels     = Vigilante_Audit_Alerts::category_labels();
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="audit_alerts" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <div id="vigilante-section-audit-alerts" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'Audit Alerts', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Get an email when the events above point to something worth your attention. Both alert types are off by default.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr id="field-audit-alerts-immediate">
                        <th scope="row"><?php esc_html_e( 'Immediate alerts', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="audit_alerts[immediate][enabled]" value="1" <?php checked( ! empty( $immediate['enabled'] ) ); ?>>
                                <?php esc_html_e( 'Email me as soon as a serious event is logged', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Sends one email per event type, then waits for the cooldown below before repeating, so a burst of the same event is a single notice.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-audit-alerts-immediate-min-severity"><?php esc_html_e( 'Alert on severity', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-audit-alerts-immediate-min-severity" name="audit_alerts[immediate][min_severity]">
                                <option value="critical" <?php selected( $alert_severity, 'critical' ); ?>><?php esc_html_e( 'Critical only (recommended)', 'vigilante' ); ?></option>
                                <option value="warning" <?php selected( $alert_severity, 'warning' ); ?>><?php esc_html_e( 'Warning and Critical', 'vigilante' ); ?></option>
                            </select>
                            <p class="description"><?php esc_html_e( 'A new administrator, a closed plugin or a privilege escalation are all logged as Critical, so "Critical only" already covers them.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr id="field-audit-alerts-threshold">
                        <th scope="row"><?php esc_html_e( 'Threshold alerts', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="audit_alerts[threshold][enabled]" value="1" <?php checked( ! empty( $threshold['enabled'] ) ); ?>>
                                <?php esc_html_e( 'Email me when a category spikes within a time window', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Catches an attack in progress, e.g. hundreds of firewall blocks or login failures in an hour.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-audit-alerts-threshold-window"><?php esc_html_e( 'Time window', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-audit-alerts-threshold-window" name="audit_alerts[threshold][window]">
                                <option value="30m" <?php selected( $alert_window, '30m' ); ?>><?php esc_html_e( '30 minutes', 'vigilante' ); ?></option>
                                <option value="1h" <?php selected( $alert_window, '1h' ); ?>><?php esc_html_e( '1 hour', 'vigilante' ); ?></option>
                                <option value="6h" <?php selected( $alert_window, '6h' ); ?>><?php esc_html_e( '6 hours', 'vigilante' ); ?></option>
                                <option value="24h" <?php selected( $alert_window, '24h' ); ?>><?php esc_html_e( '24 hours', 'vigilante' ); ?></option>
                            </select>
                            <p class="description"><?php esc_html_e( 'How far back Vigilant looks when counting events. For example, "1 hour" means "more than the number below within the last hour".', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Thresholds per category', 'vigilante' ); ?></th>
                        <td>
                            <fieldset style="display:grid; grid-template-columns:repeat(auto-fit, minmax(200px, 1fr)); gap:8px 24px; max-width:760px;">
                                <?php
                                foreach ( $cat_labels as $cat_slug => $cat_label ) :
                                    $cat_value = isset( $threshold_cats[ $cat_slug ] ) ? (int) $threshold_cats[ $cat_slug ] : 0;
                                    ?>
                                    <label style="display:flex;align-items:center;gap:8px;justify-content:space-between;">
                                        <span><?php echo esc_html( $cat_label ); ?></span>
                                        <input type="number" name="audit_alerts[threshold][categories][<?php echo esc_attr( $cat_slug ); ?>]" value="<?php echo esc_attr( $cat_value ); ?>" min="0" max="100000" step="1" class="small-text">
                                    </label>
                                <?php endforeach; ?>
                            </fieldset>
                            <p class="description"><?php esc_html_e( 'Number of warning/critical events in the window that triggers an alert. 0 disables that category. Routine info-level activity (normal logins, edits) is not counted.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( "Don't repeat alerts", 'vigilante' ); ?></th>
                        <td>
                            <input type="number" id="vigilante-f-audit-alerts-cooldown-minutes" name="audit_alerts[cooldown_minutes]" value="<?php echo esc_attr( isset( $alerts['cooldown_minutes'] ) ? (int) $alerts['cooldown_minutes'] : 60 ); ?>" min="0" max="1440" class="small-text">
                            <label for="vigilante-f-audit-alerts-cooldown-minutes"><?php esc_html_e( 'minutes', 'vigilante' ); ?></label>
                            <p class="description"><?php esc_html_e( 'After an alert, Vigilant waits this long before sending another about the same thing: the same event type for immediate alerts, or the same category for threshold alerts. This prevents a flood during a sustained attack. Applies to both alert types above.', 'vigilante' ); ?></p>
                        </td>
                    </tr>

                    <tr>
                        <th scope="row"><?php esc_html_e( 'Recipients', 'vigilante' ); ?></th>
                        <td>
                            <p class="description" style="margin-top:0;">
                                <?php
                                printf(
                                    /* translators: %s: Link to notification settings */
                                    esc_html__( 'Alerts go to the recipients configured in %s.', 'vigilante' ),
                                    '<a href="' . esc_url( admin_url( 'admin.php?page=vigilante&tab=tools' ) ) . '">' . esc_html__( 'Settings & Tools', 'vigilante' ) . '</a>'
                                );
                                ?>
                            </p>
                            <p style="margin:8px 0 0;">
                                <button type="button" class="button vigilante-test-email-btn" data-original-text="<?php esc_attr_e( 'Send test email', 'vigilante' ); ?>">
                                    <?php esc_html_e( 'Send test email', 'vigilante' ); ?>
                                </button>
                                <span class="vigilante-test-email-result" style="margin-left:8px;"></span>
                            </p>
                            <p class="description"><?php esc_html_e( 'Heads up: some events (a new admin, a closed plugin) already send their own email from other modules. Enabling alerts for them here too may produce two notices until notifications are unified.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
            </p>
        </form>

        <div id="vigilante-section-audit-recent" class="vigilante-settings-section">
            <h2><?php esc_html_e( 'Recent Activity', 'vigilante' ); ?></h2>

            <?php
            $logs = $this->activity_log->get_logs( array( 'per_page' => 20 ) );
            $total_logs = $this->activity_log->get_logs_count();

            // Label maps for translated display
            $type_labels = array(
                'login'    => __( 'Login', 'vigilante' ),
                'user'     => __( 'User', 'vigilante' ),
                'content'  => __( 'Content', 'vigilante' ),
                'plugin'   => __( 'Plugin', 'vigilante' ),
                'theme'    => __( 'Theme', 'vigilante' ),
                'settings' => __( 'Settings', 'vigilante' ),
                'comment'  => __( 'Comment', 'vigilante' ),
                'media'    => __( 'Media', 'vigilante' ),
                'firewall' => __( 'Firewall', 'vigilante' ),
                'file'     => __( 'File', 'vigilante' ),
                'security' => __( 'Security', 'vigilante' ),
                'system'   => __( 'System', 'vigilante' ),
            );
            $severity_labels = array(
                'info'     => __( 'Info', 'vigilante' ),
                'warning'  => __( 'Warning', 'vigilante' ),
                'critical' => __( 'Critical', 'vigilante' ),
            );

            $firewall_options = $this->settings->get_section( 'firewall' );
            $ip_whitelist = $firewall_options['ip_whitelist'] ?? array();
            $ip_blacklist = $firewall_options['ip_blacklist'] ?? array();
            $ua_whitelist = $firewall_options['ua_whitelist'] ?? array();
            $ua_blacklist = $firewall_options['ua_blacklist'] ?? array();
            ?>

            <div class="vigilante-log-filters">
                <input type="text" id="vigilante-log-search" aria-label="<?php esc_attr_e( 'Search the activity log', 'vigilante' ); ?>" size="1" placeholder="<?php esc_attr_e( 'Search logs (min. 3 characters)...', 'vigilante' ); ?>" class="vigilante-log-search-input">
                <select id="vigilante-log-type-filter" aria-label="<?php esc_attr_e( 'Filter the log by event type', 'vigilante' ); ?>">
                    <option value=""><?php esc_html_e( 'All Types', 'vigilante' ); ?></option>
                    <option value="login"><?php esc_html_e( 'Login', 'vigilante' ); ?></option>
                    <option value="user"><?php esc_html_e( 'User', 'vigilante' ); ?></option>
                    <option value="content"><?php esc_html_e( 'Content', 'vigilante' ); ?></option>
                    <option value="plugin"><?php esc_html_e( 'Plugin', 'vigilante' ); ?></option>
                    <option value="theme"><?php esc_html_e( 'Theme', 'vigilante' ); ?></option>
                    <option value="settings"><?php esc_html_e( 'Settings', 'vigilante' ); ?></option>
                    <option value="comment"><?php esc_html_e( 'Comment', 'vigilante' ); ?></option>
                    <option value="media"><?php esc_html_e( 'Media', 'vigilante' ); ?></option>
                    <option value="firewall"><?php esc_html_e( 'Firewall', 'vigilante' ); ?></option>
                    <option value="file"><?php esc_html_e( 'File', 'vigilante' ); ?></option>
                    <option value="security"><?php esc_html_e( 'Security', 'vigilante' ); ?></option>
                    <option value="system"><?php esc_html_e( 'System', 'vigilante' ); ?></option>
                </select>
                <select id="vigilante-log-severity-filter" aria-label="<?php esc_attr_e( 'Filter the log by severity', 'vigilante' ); ?>">
                    <option value=""><?php esc_html_e( 'All Severities', 'vigilante' ); ?></option>
                    <option value="info"><?php esc_html_e( 'Info', 'vigilante' ); ?></option>
                    <option value="warning"><?php esc_html_e( 'Warning', 'vigilante' ); ?></option>
                    <option value="critical"><?php esc_html_e( 'Critical', 'vigilante' ); ?></option>
                </select>
                <select id="vigilante-log-method-filter" aria-label="<?php esc_attr_e( 'Filter the log by HTTP method', 'vigilante' ); ?>">
                    <option value=""><?php esc_html_e( 'All Methods', 'vigilante' ); ?></option>
                    <option value="GET">GET</option>
                    <option value="POST">POST</option>
                    <option value="PUT">PUT</option>
                    <option value="DELETE">DELETE</option>
                    <option value="PATCH">PATCH</option>
                    <option value="OPTIONS">OPTIONS</option>
                    <option value="HEAD">HEAD</option>
                </select>
                <button type="button" id="vigilante-log-refresh" class="button"><?php esc_html_e( 'Refresh', 'vigilante' ); ?></button>
                <span class="vigilante-pagination" id="vigilante-log-pagination" data-total="<?php echo esc_attr( $total_logs ); ?>" data-per-page="20" data-page="1">
                    <?php if ( $total_logs > 20 ) : ?>
                    <button type="button" class="vigilante-page-first" title="<?php esc_attr_e( 'First page', 'vigilante' ); ?>" disabled>&laquo;</button>
                    <button type="button" class="vigilante-page-prev" title="<?php esc_attr_e( 'Previous page', 'vigilante' ); ?>" disabled>&lsaquo;</button>
                    <?php endif; ?>
                    <span class="vigilante-page-info">
                        <?php
                        $showing = min( 20, $total_logs );
                        printf(
                            /* translators: 1: first item, 2: last item, 3: total items */
                            esc_html__( '%1$d–%2$d of %3$d', 'vigilante' ),
                            $total_logs > 0 ? 1 : 0,
                            absint( $showing ),
                            absint( $total_logs )
                        );
                        ?>
                    </span>
                    <?php if ( $total_logs > 20 ) : ?>
                    <button type="button" class="vigilante-page-next" title="<?php esc_attr_e( 'Next page', 'vigilante' ); ?>">&rsaquo;</button>
                    <button type="button" class="vigilante-page-last" title="<?php esc_attr_e( 'Last page', 'vigilante' ); ?>">&raquo;</button>
                    <?php endif; ?>
                </span>
            </div>

            <div class="vigilante-log-table-wrap">
            <table id="vigilante-activity-log-table" class="wp-list-table widefat striped">
                <thead>
                    <tr>
                        <th class="column-date"><?php esc_html_e( 'Date', 'vigilante' ); ?></th>
                        <th class="column-type"><?php esc_html_e( 'Type', 'vigilante' ); ?></th>
                        <th class="column-method"><?php esc_html_e( 'Method', 'vigilante' ); ?></th>
                        <th class="column-severity"><?php esc_html_e( 'Severity', 'vigilante' ); ?></th>
                        <th class="column-message"><?php esc_html_e( 'Message', 'vigilante' ); ?></th>
                        <th class="column-user"><?php esc_html_e( 'User', 'vigilante' ); ?></th>
                        <th class="column-ip"><?php esc_html_e( 'IP', 'vigilante' ); ?></th>
                        <th class="column-details"><?php esc_html_e( 'Details', 'vigilante' ); ?></th>
                    </tr>
                </thead>
                <tbody>
                    <?php
                    if ( empty( $logs ) ) :
                        ?>
                        <tr><td colspan="8"><?php esc_html_e( 'No log entries found.', 'vigilante' ); ?></td></tr>
                    <?php else : ?>
                        <?php foreach ( $logs as $log ) :
                            $request_method = isset( $log->request_method ) ? $log->request_method : '';
                            // Prepare details as a simple object
                            $ip_val = (string) ( $log->ip_address ?? '' );
                            $ua_val = (string) ( $log->user_agent ?? '' );
                            $details = array(
                                'id'                 => (int) $log->id,
                                'type'               => (string) ( $log->event_type ?? '' ),
                                'action'             => (string) ( $log->event_action ?? '' ),
                                'message'            => (string) ( $log->event_message ?? '' ),
                                'user'               => (string) ( $log->user_login ?? '' ),
                                'ip'                 => $ip_val,
                                'user_agent'         => $ua_val,
                                'request_method'     => (string) $request_method,
                                'request_uri'        => Vigilante_Activity_Log::extract_request_uri( $log->extra_data ?? '' ),
                                'date'               => (string) ( $log->created_at ?? '' ),
                                'severity'           => (string) ( $log->severity ?? 'info' ),
                                'is_ip_whitelisted'  => ( '' !== $ip_val && in_array( $ip_val, $ip_whitelist, true ) ),
                                'is_ip_blacklisted'  => ( '' !== $ip_val && in_array( $ip_val, $ip_blacklist, true ) ),
                                'is_ua_whitelisted'  => ( '' !== $ua_val && in_array( $ua_val, $ua_whitelist, true ) ),
                                'is_ua_blacklisted'  => ( '' !== $ua_val && in_array( $ua_val, $ua_blacklist, true ) ),
                            );
                            $display_type = isset( $type_labels[ $log->event_type ] ) ? $type_labels[ $log->event_type ] : $log->event_type;
                            $display_severity = isset( $severity_labels[ $log->severity ] ) ? $severity_labels[ $log->severity ] : $log->severity;
                            ?>
                        <tr class="vigilante-severity-<?php echo esc_attr( $log->severity ); ?>">
                            <td><?php echo esc_html( $log->created_at ); ?></td>
                            <td><?php echo esc_html( $display_type ); ?></td>
                            <td><?php if ( ! empty( $request_method ) ) : ?><span class="vigilante-method-label vigilante-method-<?php echo esc_attr( strtolower( $request_method ) ); ?>"><?php echo esc_html( $request_method ); ?></span><?php else : ?>-<?php endif; ?></td>
                            <td><span class="vigilante-badge vigilante-badge-<?php echo esc_attr( $log->severity ); ?>"><?php echo esc_html( $display_severity ); ?></span></td>
                            <td><?php echo esc_html( $log->event_message ); ?></td>
                            <td><?php echo esc_html( $log->user_login ?? '-' ); ?></td>
                            <td><code><?php echo esc_html( $log->ip_address ); ?></code></td>
                            <td>
                                <button type="button" class="button button-small vigilante-view-log-details" 
                                    data-details='<?php echo esc_attr( wp_json_encode( $details, JSON_HEX_APOS | JSON_HEX_QUOT ) ); ?>'>
                                    <?php esc_html_e( 'View', 'vigilante' ); ?>
                                </button>
                            </td>
                        </tr>
                        <?php endforeach; ?>
                    <?php endif; ?>
                </tbody>
            </table>
            </div>

            <!-- Log Details Modal -->
            <div id="vigilante-log-details-modal" class="vigilante-modal" style="display: none;">
                <div class="vigilante-modal-content">
                    <span class="vigilante-modal-close">&times;</span>
                    <h3><?php esc_html_e( 'Log Entry Details', 'vigilante' ); ?></h3>
                    <div id="vigilante-log-details-content"></div>
                </div>
            </div>

            <p>
                <button type="button" class="button vigilante-export-logs"><?php esc_html_e( 'Export Audit Log', 'vigilante' ); ?></button>
                <button type="button" class="button vigilante-clear-logs" style="color: #a00;"><?php esc_html_e( 'Clear All Logs', 'vigilante' ); ?></button>
            </p>
        </div>
        <?php
    }

    /**
     * Render File Integrity tab
     */
    private function render_tab_file_integrity() {
        $is_disabled = $this->render_module_disabled_notice( 'file_integrity' );
        $options = $this->settings->get_section( 'file_integrity' );
        // On the main site of a network the critical-file scan is the network's
        // canary for a change to wp-config.php or the root .htaccess, so a
        // main-site admin without network rights cannot turn it off. Since
        // 2.11.8; see Vigilante_Settings::get_main_site_file_settings().
        $vg_main_locked = $this->main_site_files_locked();
        $last_scan = get_option( 'vigilante_last_integrity_scan' );
        $last_results = get_option( 'vigilante_last_integrity_results' );
        $ignored_files = get_option( 'vigilante_ignored_files', array() );

        // Backward compat: convert old notify_on_changes to notify_level
        $notify_level = $options['notify_level'] ?? '';
        if ( empty( $notify_level ) ) {
            $notify_level = ! empty( $options['notify_on_changes'] ) ? 'all' : 'disabled';
        }

        // Closed + Removed plugins data. Surfaced inside Last Scan Results so the
        // user sees file findings and plugin closures together (same tier of risk,
        // same UI), and as the trigger to keep Last Scan Results open even when no
        // file scan has run yet (the daily cron may have populated this section).
        //
        // Gating by last_check_time > 0 is how "Clear Previous Results" visually
        // resets this block: the option vigilante_plugin_status_last_check is
        // deleted on Clear, but the state map and the ignored list survive so the
        // next scan reconstructs without degrading a 'removed' slug. While
        // last_check is 0, we treat the plugin_status data as if it didn't exist.
        if ( ! class_exists( 'Vigilante_Plugin_Status' ) ) {
            require_once VIGILANTE_INCLUDES_DIR . 'class-plugin-status.php';
        }
        $closed_checker    = new Vigilante_Plugin_Status( $this->settings, $this->activity_log );
        $closed_last_check = $closed_checker->get_last_check_time();
        if ( $closed_last_check > 0 ) {
            $closed_plugins         = $closed_checker->get_closed_plugins();
            $ignored_closed_plugins = $closed_checker->get_ignored_closed_plugins();
        } else {
            $closed_plugins         = array();
            $ignored_closed_plugins = array();
        }
        $has_closed      = ! empty( $closed_plugins );
        $datetime_format = get_option( 'date_format' ) . ' ' . get_option( 'time_format' );
        ?>
        <form class="vigilante-settings-form <?php echo $is_disabled ? 'vigilante-form-disabled' : ''; ?>" data-section="file_integrity" <?php echo $is_disabled ? 'inert' : ''; ?>>
            <div id="vigilante-section-fi-monitoring" class="vigilante-settings-section">
                <h2>
                    <?php esc_html_e( 'File Integrity Monitoring', 'vigilante' ); ?>
                    <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span>
                </h2>
                <p><?php esc_html_e( 'Detects file modifications using WordPress.org checksums.', 'vigilante' ); ?></p>

                <table class="form-table">
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Automatic Scans', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="file_integrity[auto_scan]" value="1" <?php checked( ! empty( $options['auto_scan'] ) ); ?>>
                                <?php esc_html_e( 'Enable scheduled file integrity scans', 'vigilante' ); ?>
                            </label>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-file-integrity-scan-frequency"><?php esc_html_e( 'Scan Frequency', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-file-integrity-scan-frequency" name="file_integrity[scan_frequency]">
                                <option value="daily" <?php selected( $options['scan_frequency'] ?? 'daily', 'daily' ); ?>><?php esc_html_e( 'Daily', 'vigilante' ); ?></option>
                                <option value="weekly" <?php selected( $options['scan_frequency'] ?? 'daily', 'weekly' ); ?>><?php esc_html_e( 'Weekly', 'vigilante' ); ?></option>
                            </select>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-file-integrity-notify-level"><?php esc_html_e( 'Email Notifications', 'vigilante' ); ?></label></th>
                        <td>
                            <select id="vigilante-f-file-integrity-notify-level" name="file_integrity[notify_level]">
                                <option value="all" <?php selected( $notify_level, 'all' ); ?>><?php esc_html_e( 'All issues (modified + suspicious)', 'vigilante' ); ?></option>
                                <option value="suspicious_only" <?php selected( $notify_level, 'suspicious_only' ); ?>><?php esc_html_e( 'Suspicious files only', 'vigilante' ); ?></option>
                                <option value="disabled" <?php selected( $notify_level, 'disabled' ); ?>><?php esc_html_e( 'Disabled', 'vigilante' ); ?></option>
                            </select>
                            <p class="description"><?php esc_html_e( '"Suspicious files only" reduces noise by skipping modified file notifications. Recommended for most sites.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Instant Alert', 'vigilante' ); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="file_integrity[instant_alert]" value="1" <?php checked( ! empty( $options['instant_alert'] ) ); ?>>
                                <?php esc_html_e( 'Send immediate alert when modified, suspicious or additional files are detected, or when a closed plugin is found', 'vigilante' ); ?>
                            </label>
                            <p class="description"><?php esc_html_e( 'Fires even if the Email Notifications setting above is set to Disabled.', 'vigilante' ); ?></p>
                            <p class="description">
                                <?php
                                printf(
                                    /* translators: %s: Link to notification settings */
                                    esc_html__( '&#9432; Notifications are sent to the recipients configured in %s.', 'vigilante' ),
                                    '<a href="' . esc_url( admin_url( 'admin.php?page=vigilante&tab=tools' ) ) . '">' . esc_html__( 'Settings & Tools', 'vigilante' ) . '</a>'
                                );
                                ?>
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Test email', 'vigilante' ); ?></th>
                        <td>
                            <button type="button" class="button vigilante-test-email-btn" data-original-text="<?php esc_attr_e( 'Send test email', 'vigilante' ); ?>">
                                <?php esc_html_e( 'Send test email', 'vigilante' ); ?>
                            </button>
                            <span class="vigilante-test-email-result" style="margin-left:8px;"></span>
                            <p class="description"><?php esc_html_e( 'Sends a test message to the configured recipients to confirm email delivery works.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'Scan Scope', 'vigilante' ); ?></th>
                        <td>
                            <fieldset>
                                <label>
                                    <input type="checkbox" name="file_integrity[scan_core]" value="1" <?php checked( $options['scan_core'] ?? true ); ?>>
                                    <?php esc_html_e( 'Core files (compare against WordPress.org checksums)', 'vigilante' ); ?>
                                </label>
                                <br>
                                <label>
                                    <input type="checkbox" name="file_integrity[scan_plugins]" value="1" <?php checked( $options['scan_plugins'] ?? true ); ?>>
                                    <?php esc_html_e( 'Plugins (WordPress.org repository plugins)', 'vigilante' ); ?>
                                </label>
                                <br>
                                <label>
                                    <input type="checkbox" name="file_integrity[scan_themes]" value="1" <?php checked( $options['scan_themes'] ?? true ); ?>>
                                    <?php esc_html_e( 'Themes (WordPress.org repository themes)', 'vigilante' ); ?>
                                </label>
                                <br>
                                <label>
                                    <input type="checkbox" name="file_integrity[scan_uploads]" value="1" <?php checked( $options['scan_uploads'] ?? true ); ?>>
                                    <?php esc_html_e( 'Uploads directory (detect PHP files, double extensions, .htaccess)', 'vigilante' ); ?>
                                </label>
                                <br>
                                <label>
                                    <input type="checkbox" name="file_integrity[scan_critical_config]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( $options['scan_critical_config'] ?? true ); ?>>
                                    <?php esc_html_e( 'Critical config files (wp-config.php, .htaccess baseline monitoring)', 'vigilante' ); ?>
                                    <?php if ( $vg_main_locked ) : ?>
                                        <span class="description" style="display:block;margin-left:24px;"><?php echo esc_html( Vigilante_Settings::get_shared_files_notice() ); ?></span>
                                    <?php endif; ?>
                                </label>
                                <br>
                                <label>
                                    <input type="checkbox" name="file_integrity[check_closed_plugins]" value="1" <?php checked( $options['check_closed_plugins'] ?? true ); ?>>
                                    <?php esc_html_e( 'Closed plugins (daily check against the WordPress.org repository)', 'vigilante' ); ?>
                                </label>
                            </fieldset>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-file-integrity-excluded-paths"><?php esc_html_e( 'Excluded Paths', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-file-integrity-excluded-paths" name="file_integrity[excluded_paths]" rows="4" class="large-text code" placeholder="wp-content/cache&#10;wp-content/languages"><?php echo esc_textarea( implode( "\n", $options['excluded_paths'] ?? array() ) ); ?></textarea>
                            <p class="description"><?php esc_html_e( 'One path per line, relative to the WordPress root. A path such as wp-content/cache excludes exactly that folder and everything under it. A name on its own, such as cache, excludes any folder called exactly that, wherever it is.', 'vigilante' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="vigilante-f-file-integrity-excluded-extensions"><?php esc_html_e( 'Excluded Extensions', 'vigilante' ); ?></label></th>
                        <td>
                            <textarea id="vigilante-f-file-integrity-excluded-extensions" name="file_integrity[excluded_extensions]" rows="3" class="large-text code" placeholder=".log&#10;.po&#10;.mo&#10;.pot"><?php echo esc_textarea( implode( "\n", $options['excluded_extensions'] ?? array() ) ); ?></textarea>
                            <p class="description">
                                <?php esc_html_e( 'One extension per line (e.g. .log, .po, .mo). Files with these extensions will be skipped. Useful to avoid false positives from translation or log files.', 'vigilante' ); ?>
                                <br>
                                <?php
                                printf(
                                    /* translators: 1: opening <code>, 2: closing </code>. Placeholders wrap the scoped-extension example. */
                                    esc_html__( 'An extension on its own applies to the whole site. To limit it to one folder, write it as %1$swp-content/languages/*.json%2$s, which leaves the same extension watched everywhere else.', 'vigilante' ),
                                    '<code>',
                                    '</code>'
                                ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML tags are hardcoded.
                                ?>
                            </p>
                        </td>
                    </tr>
                </table>
            </div>

            <p class="submit vigilante-submit-buttons">
                <button type="submit" class="button button-primary vigilante-save-btn" data-original-text="<?php esc_attr_e( 'Save Settings', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Save Settings', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-reset-section-btn" data-original-text="<?php esc_attr_e( 'Reset to Defaults', 'vigilante' ); ?>">
                    <?php esc_html_e( 'Reset to Defaults', 'vigilante' ); ?>
                </button>
                <span class="vigilante-buttons-separator"></span>
                <button type="button" class="button button-primary vigilante-run-scan">
                    <?php esc_html_e( 'Run Scan Now', 'vigilante' ); ?>
                </button>
                <button type="button" class="button vigilante-clear-scan-btn vigilante-clear-scan">
                    <?php esc_html_e( 'Clear Previous Results', 'vigilante' ); ?>
                </button>
            </p>
        </form>

        <div id="vigilante-scan-results" class="vigilante-settings-section" style="display:none;"></div>

        <?php if ( $last_scan || $has_closed || $closed_last_check > 0 ) : ?>
        <div id="vigilante-section-fi-last-scan" class="vigilante-settings-section">
            <h2><?php esc_html_e( 'Last Scan Results', 'vigilante' ); ?></h2>
            <?php if ( $last_scan ) : ?>
            <p>
                <?php
                // Build the "X files scanned" hint inline with the date so it doesn't
                // need its own stat box (keeps the row compact when closed plugins are
                // present).
                $scanned_total = 0;
                if ( $last_results ) {
                    $scanned_total = (int) ( $last_results['ok'] ?? 0 )
                        + count( $last_results['modified'] ?? array() )
                        + count( $last_results['suspicious'] ?? array() )
                        + count( $last_results['extra'] ?? array() )
                        + count( $ignored_files );
                }
                if ( $scanned_total > 0 ) {
                    printf(
                        /* translators: 1: date and time of last scan, 2: formatted file count */
                        esc_html__( 'Last scan: %1$s (%2$s files scanned)', 'vigilante' ),
                        esc_html( wp_date( $datetime_format, $last_scan ) ),
                        esc_html( number_format_i18n( $scanned_total ) )
                    );
                } else {
                    printf(
                        /* translators: %s: date and time of last scan */
                        esc_html__( 'Last scan: %s', 'vigilante' ),
                        esc_html( wp_date( $datetime_format, $last_scan ) )
                    );
                }
                if ( $closed_last_check > 0 && $closed_last_check !== (int) $last_scan ) {
                    echo ' &middot; ';
                    printf(
                        /* translators: %s: date and time of last closed plugins check */
                        esc_html__( 'Closed plugins last checked: %s', 'vigilante' ),
                        esc_html( wp_date( $datetime_format, $closed_last_check ) )
                    );
                }
                ?>
            </p>
            <?php elseif ( $closed_last_check > 0 ) : ?>
            <p>
                <?php
                printf(
                    /* translators: %s: date and time of last closed plugins check */
                    esc_html__( 'Closed plugins last checked: %s &middot; the daily cron is running, no full integrity scan yet.', 'vigilante' ),
                    esc_html( wp_date( $datetime_format, $closed_last_check ) )
                );
                ?>
            </p>
            <?php endif; ?>
            <div id="vigilante-last-scan-results">
                <?php if ( $last_results || $has_closed ) : ?>
                    <div class="vigilante-scan-summary">
                        <?php if ( $last_results ) : ?>
                        <div class="vigilante-scan-stat vigilante-stat-ok">
                            <span class="vigilante-stat-number"><?php echo esc_html( $last_results['ok'] ?? 0 ); ?></span>
                            <span class="vigilante-stat-label"><?php esc_html_e( 'OK', 'vigilante' ); ?></span>
                        </div>
                        <div class="vigilante-scan-stat vigilante-stat-modified">
                            <span class="vigilante-stat-number"><?php echo esc_html( count( $last_results['modified'] ?? array() ) ); ?></span>
                            <span class="vigilante-stat-label"><?php esc_html_e( 'Modified', 'vigilante' ); ?></span>
                        </div>
                        <div class="vigilante-scan-stat vigilante-stat-suspicious">
                            <span class="vigilante-stat-number"><?php echo esc_html( count( $last_results['suspicious'] ?? array() ) ); ?></span>
                            <span class="vigilante-stat-label"><?php esc_html_e( 'Suspicious', 'vigilante' ); ?></span>
                        </div>
                        <div class="vigilante-scan-stat vigilante-stat-extra">
                            <span class="vigilante-stat-number"><?php echo esc_html( count( $last_results['extra'] ?? array() ) ); ?></span>
                            <span class="vigilante-stat-label"><?php esc_html_e( 'Extra', 'vigilante' ); ?></span>
                        </div>
                        <?php endif; ?>
                        <?php if ( $has_closed ) : ?>
                        <div class="vigilante-scan-stat vigilante-stat-suspicious">
                            <span class="vigilante-stat-number" style="color: #d63638;"><?php echo (int) count( $closed_plugins ); ?></span>
                            <span class="vigilante-stat-label"><?php esc_html_e( 'Closed/Removed', 'vigilante' ); ?></span>
                        </div>
                        <?php endif; ?>
                        <?php if ( ! empty( $ignored_files ) ) : ?>
                        <div class="vigilante-scan-stat vigilante-stat-ignored">
                            <span class="vigilante-stat-number"><?php echo esc_html( count( $ignored_files ) ); ?></span>
                            <span class="vigilante-stat-label"><?php esc_html_e( 'Ignored', 'vigilante' ); ?></span>
                        </div>
                        <?php endif; ?>
                    </div>

                    <?php if ( ! empty( $last_results['suspicious'] ) ) : ?>
                    <div class="vigilante-file-list vigilante-suspicious-files vigilante-paginated-section" data-bulk-mode="ignore">
                        <h3 style="color: #d63638;"><?php esc_html_e( 'Suspicious Files', 'vigilante' ); ?></h3>
                        <p class="description" style="color: #d63638;"><?php esc_html_e( '&#9888; Warning: These files may contain malicious code or are in unexpected locations. Review immediately!', 'vigilante' ); ?></p>
                        <div class="vigilante-fi-bulk-bar">
                            <button type="button" class="button vigilante-bulk-ignore" disabled><?php esc_html_e( 'Ignore selected', 'vigilante' ); ?></button>
                            <span class="vigilante-fi-bulk-count" aria-live="polite"></span>
                        </div>
                        <div class="vigilante-fi-pagination-wrap"></div>
                        <table class="wp-list-table widefat fixed striped vigilante-fi-paginated">
                            <thead>
                                <tr>
                                    <td class="manage-column column-cb check-column"><input type="checkbox" class="vigilante-fi-cb-all" aria-label="<?php esc_attr_e( 'Select all', 'vigilante' ); ?>"></td>
                                    <th><?php esc_html_e( 'File', 'vigilante' ); ?></th>
                                    <th style="width: 250px;"><?php esc_html_e( 'Reason', 'vigilante' ); ?></th>
                                    <th style="width: 120px;"><?php esc_html_e( 'Type', 'vigilante' ); ?></th>
                                    <th style="width: 80px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php
                                foreach ( $last_results['suspicious'] as $item ) {
                                    $file_path = '';
                                    $file_reason = __( 'Unknown', 'vigilante' );
                                    $file_type = 'unknown';

                                    if ( is_array( $item ) ) {
                                        if ( isset( $item['file'] ) ) {
                                            $file_path = $item['file'];
                                        }
                                        if ( isset( $item['reason'] ) ) {
                                            $file_reason = $item['reason'];
                                        }
                                        if ( isset( $item['type'] ) ) {
                                            $file_type = $item['type'];
                                        }
                                    } else {
                                        $file_path = (string) $item;
                                    }
                                    ?>
                                    <tr>
                                        <th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file_path ); ?>"></th>
                                        <td><code style="color: #d63638;"><?php echo esc_html( $file_path ); ?></code></td>
                                        <td><?php echo esc_html( $file_reason ); ?></td>
                                        <td><?php echo esc_html( $file_type ); ?></td>
                                        <td><button type="button" class="button button-small vigilante-ignore-file" data-file="<?php echo esc_attr( $file_path ); ?>"><?php esc_html_e( 'Ignore', 'vigilante' ); ?></button></td>
                                    </tr>
                                    <?php
                                }
                                ?>
                            </tbody>
                        </table>
                    </div>
                    <?php endif; ?>

                    <?php if ( ! empty( $last_results['extra'] ) ) : ?>
                    <div class="vigilante-file-list vigilante-extra-files vigilante-paginated-section" data-bulk-mode="ignore">
                        <h3 style="color: #b32d2e;"><?php esc_html_e( 'Extra Files', 'vigilante' ); ?></h3>
                        <p class="description"><?php esc_html_e( 'PHP files found in plugins or themes that are not part of the original distribution from WordPress.org. May be legitimate customizations or injected backdoors.', 'vigilante' ); ?></p>
                        <div class="vigilante-fi-bulk-bar">
                            <button type="button" class="button vigilante-bulk-ignore" disabled><?php esc_html_e( 'Ignore selected', 'vigilante' ); ?></button>
                            <span class="vigilante-fi-bulk-count" aria-live="polite"></span>
                        </div>
                        <div class="vigilante-fi-pagination-wrap"></div>
                        <table class="wp-list-table widefat fixed striped vigilante-fi-paginated">
                            <thead>
                                <tr>
                                    <td class="manage-column column-cb check-column"><input type="checkbox" class="vigilante-fi-cb-all" aria-label="<?php esc_attr_e( 'Select all', 'vigilante' ); ?>"></td>
                                    <th><?php esc_html_e( 'File', 'vigilante' ); ?></th>
                                    <th style="width: 250px;"><?php esc_html_e( 'Reason', 'vigilante' ); ?></th>
                                    <th style="width: 120px;"><?php esc_html_e( 'Type', 'vigilante' ); ?></th>
                                    <th style="width: 80px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php
                                foreach ( $last_results['extra'] as $item ) {
                                    $file_path = is_array( $item ) ? ( $item['file'] ?? '' ) : (string) $item;
                                    $file_reason = is_array( $item ) ? ( $item['reason'] ?? __( 'Unknown', 'vigilante' ) ) : __( 'Unknown', 'vigilante' );
                                    $file_type = is_array( $item ) ? ( $item['type'] ?? 'unknown' ) : 'unknown';
                                    ?>
                                    <tr>
                                        <th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file_path ); ?>"></th>
                                        <td><code style="color: #b32d2e;"><?php echo esc_html( $file_path ); ?></code></td>
                                        <td><?php echo esc_html( $file_reason ); ?></td>
                                        <td><?php echo esc_html( $file_type ); ?></td>
                                        <td><button type="button" class="button button-small vigilante-ignore-file" data-file="<?php echo esc_attr( $file_path ); ?>"><?php esc_html_e( 'Ignore', 'vigilante' ); ?></button></td>
                                    </tr>
                                    <?php
                                }
                                ?>
                            </tbody>
                        </table>
                    </div>
                    <?php endif; ?>

                    <?php
                    // Split critical config files from regular modified files.
                    // Computed unconditionally so the three sub-sections that consume
                    // these arrays (Critical Config, Closed + Removed, Modified Files)
                    // can render independently and in the order the team picked.
                    $critical_modified = array();
                    $regular_modified  = array();
                    if ( $last_results && ! empty( $last_results['modified'] ) ) {
                        foreach ( $last_results['modified'] as $item ) {
                            if ( is_array( $item ) && isset( $item['type'] ) && 'critical_config' === $item['type'] ) {
                                $critical_modified[] = $item;
                            } else {
                                $regular_modified[] = $item;
                            }
                        }
                    }
                    ?>

                    <?php if ( ! empty( $critical_modified ) ) : ?>
                    <div class="vigilante-file-list vigilante-critical-config-files">
                        <h3 style="color: #e36210;"><?php esc_html_e( 'Critical config files modified', 'vigilante' ); ?></h3>
                        <p class="description">
                            <?php esc_html_e( 'These files are common targets for code injection. Review the changes and approve if they are legitimate. Vigilant\'s own blocks are excluded from this check.', 'vigilante' ); ?>
                        </p>
                        <table class="wp-list-table widefat fixed striped">
                            <thead>
                                <tr>
                                    <th><?php esc_html_e( 'File', 'vigilante' ); ?></th>
                                    <th style="width: 200px;"><?php esc_html_e( 'Changes', 'vigilante' ); ?></th>
                                    <th style="width: 220px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ( $critical_modified as $crit_item ) :
                                    $crit_file = $crit_item['file'] ?? '';
                                    $crit_baseline_size = $crit_item['baseline_size'] ?? 0;
                                    $crit_current_size = $crit_item['current_size'] ?? 0;
                                    $crit_diff = $crit_item['diff'] ?? array();
                                    $crit_id = sanitize_html_class( $crit_file );
                                    $added_count = is_array( $crit_diff ) ? count( $crit_diff['added'] ?? array() ) : 0;
                                    $removed_count = is_array( $crit_diff ) ? count( $crit_diff['removed'] ?? array() ) : 0;
                                    // The lines of a shared file are for whoever approves it. Results
                                    // stored before 2.11.8 on the main site still carry them, so the
                                    // screen asks too, not only the scan that wrote them.
                                    $diff_network     = ( is_array( $crit_diff ) && ! empty( $crit_diff['network'] ) ) || $this->critical_approval_locked();
                                    $diff_rescan      = is_array( $crit_diff ) && ! empty( $crit_diff['rescan'] );
                                    $diff_redaction   = is_array( $crit_diff ) && ! empty( $crit_diff['redaction'] );
                                    $diff_unavailable = $diff_network || ( is_array( $crit_diff ) && ! empty( $crit_diff['unavailable'] ) );
                                ?>
                                <tr>
                                    <td><code style="color: #e36210;"><?php echo esc_html( $crit_file ); ?></code></td>
                                    <td>
                                        <?php if ( ! $diff_unavailable ) : ?>
                                            <span style="color: #007017;">+<?php echo (int) $added_count; ?></span>
                                            <span style="color: #b32d2e;">-<?php echo (int) $removed_count; ?></span>
                                            <?php esc_html_e( 'lines', 'vigilante' ); ?><br>
                                        <?php endif; ?>
                                        <small style="color: #50575e;">
                                            <?php
                                            printf(
                                                /* translators: 1: baseline size, 2: current size */
                                                esc_html__( '%1$s &rarr; %2$s bytes', 'vigilante' ),
                                                esc_html( number_format_i18n( $crit_baseline_size ) ),
                                                esc_html( number_format_i18n( $crit_current_size ) )
                                            );
                                            ?>
                                        </small>
                                    </td>
                                    <td>
                                        <button type="button" class="button button-small vigilante-toggle-critical-content" data-target="vigilante-critical-content-<?php echo esc_attr( $crit_id ); ?>" data-label-show="<?php esc_attr_e( 'Review changes', 'vigilante' ); ?>" data-label-hide="<?php esc_attr_e( 'Hide changes', 'vigilante' ); ?>">
                                            <?php esc_html_e( 'Review changes', 'vigilante' ); ?>
                                        </button>
                                        <?php if ( $this->critical_approval_locked() ) : ?>
                                            <span class="description" style="display:block;margin-top:4px;">
                                                <?php echo esc_html( $this->critical_approval_notice() ); ?>
                                            </span>
                                        <?php else : ?>
                                            <button type="button" class="button button-small button-primary vigilante-approve-critical-file" data-file="<?php echo esc_attr( $crit_file ); ?>">
                                                <?php esc_html_e( 'Approve', 'vigilante' ); ?>
                                            </button>
                                        <?php endif; ?>
                                    </td>
                                </tr>
                                <tr id="vigilante-critical-content-<?php echo esc_attr( $crit_id ); ?>" class="vigilante-critical-content-row" style="display:none;">
                                    <td colspan="3" style="padding: 0;">
                                        <div class="vigilante-critical-content" style="max-height: 400px; overflow: auto; background: #fff; padding: 10px; font-size: 12px; line-height: 1.5; font-family: Consolas, Monaco, monospace; border-top: 1px solid #c3c4c7;">
                                            <?php if ( $diff_network ) : ?>
                                                <p style="color: #50575e; font-style: italic; margin: 0;">
                                                    <?php esc_html_e( 'This file belongs to the whole network, so its line changes are only shown to network administrators, on the main site.', 'vigilante' ); ?>
                                                </p>
                                            <?php elseif ( $diff_rescan ) : ?>
                                                <p style="color: #50575e; font-style: italic; margin: 0;">
                                                    <?php esc_html_e( 'Run a new scan to see the line changes of this file.', 'vigilante' ); ?>
                                                </p>
                                            <?php elseif ( $diff_redaction ) : ?>
                                                <p style="color: #50575e; font-style: italic; margin: 0;">
                                                    <?php esc_html_e( 'The line changes of this file are not shown because a value in it could not be hidden safely. The change itself is still detected.', 'vigilante' ); ?>
                                                </p>
                                            <?php elseif ( $diff_unavailable ) : ?>
                                                <p style="color: #50575e; font-style: italic; margin: 0;">
                                                    <?php esc_html_e( 'Diff not available for this file (baseline was created before diff tracking was added). Approve to enable diff on future changes.', 'vigilante' ); ?>
                                                </p>
                                            <?php elseif ( empty( $crit_diff['added'] ) && empty( $crit_diff['removed'] ) ) : ?>
                                                <p style="color: #50575e; font-style: italic; margin: 0;">
                                                    <?php esc_html_e( 'No line-level changes detected (may be whitespace or reordering).', 'vigilante' ); ?>
                                                </p>
                                            <?php else : ?>
                                                <?php if ( ! empty( $crit_diff['removed'] ) ) : ?>
                                                    <?php foreach ( $crit_diff['removed'] as $rline ) : ?>
<div style="background: #fbeaea; color: #b32d2e; padding: 1px 4px; white-space: pre-wrap; word-wrap: break-word;"><span style="display: inline-block; width: 50px; color: #999; user-select: none;"><?php echo (int) $rline['line']; ?></span>- <?php echo esc_html( $rline['content'] ); ?></div>
                                                    <?php endforeach; ?>
                                                <?php endif; ?>
                                                <?php if ( ! empty( $crit_diff['added'] ) ) : ?>
                                                    <?php foreach ( $crit_diff['added'] as $aline ) : ?>
<div style="background: #e6f4e9; color: #007017; padding: 1px 4px; white-space: pre-wrap; word-wrap: break-word;"><span style="display: inline-block; width: 50px; color: #999; user-select: none;"><?php echo (int) $aline['line']; ?></span>+ <?php echo esc_html( $aline['content'] ); ?></div>
                                                    <?php endforeach; ?>
                                                <?php endif; ?>
                                            <?php endif; ?>
                                        </div>
                                    </td>
                                </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                    </div>
                    <?php endif; ?>

                    <?php if ( $has_closed ) : ?>
                    <div class="vigilante-file-list vigilante-closed-plugins">
                        <h3 id="vigilante-section-fi-closed-plugins" style="color: #d63638;"><?php esc_html_e( 'Closed + Removed Plugins', 'vigilante' ); ?></h3>
                        <p class="description" style="color: #d63638;">
                            <?php esc_html_e( '&#9888; Warning: These plugins have been closed in the WordPress.org repository. Closures usually indicate malware, security issues, guideline violations, or supply chain attacks. Uninstall and replace as soon as possible.', 'vigilante' ); ?>
                        </p>
                        <table class="wp-list-table widefat striped">
                            <thead>
                                <tr>
                                    <th><?php esc_html_e( 'Plugin', 'vigilante' ); ?></th>
                                    <th style="width: 70px;"><?php esc_html_e( 'Version', 'vigilante' ); ?></th>
                                    <th style="width: 90px;"><?php esc_html_e( 'State', 'vigilante' ); ?></th>
                                    <th style="width: 110px;"><?php esc_html_e( 'Closed date', 'vigilante' ); ?></th>
                                    <th><?php esc_html_e( 'Reason', 'vigilante' ); ?></th>
                                    <th style="width: 130px;"><?php esc_html_e( 'Detected', 'vigilante' ); ?></th>
                                    <th style="width: 90px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ( $closed_plugins as $cp_slug => $cp_entry ) :
                                    $cp_state       = $cp_entry['state'] ?? '';
                                    $cp_state_label = 'closed' === $cp_state ? __( 'Closed', 'vigilante' ) : __( 'Removed', 'vigilante' );
                                    $cp_state_color = 'closed' === $cp_state ? '#d63638' : '#b32d2e';
                                    $cp_reason      = '';
                                    if ( ! empty( $cp_entry['closed_reason_text'] ) ) {
                                        $cp_reason = $cp_entry['closed_reason_text'];
                                    } elseif ( 'removed' === $cp_state ) {
                                        $cp_reason = __( 'Removed from repository (metadata hidden, typical of Security Issue closures)', 'vigilante' );
                                    }
                                    $cp_detected = isset( $cp_entry['first_detected'] ) ? (int) $cp_entry['first_detected'] : 0;
                                    ?>
                                    <tr>
                                        <td>
                                            <strong><?php echo esc_html( $cp_entry['name'] ?? $cp_slug ); ?></strong><br>
                                            <a href="<?php echo esc_url( 'https://wordpress.org/plugins/' . $cp_slug . '/' ); ?>" target="_blank" rel="noopener noreferrer"><code style="color: #50575e;"><?php echo esc_html( $cp_slug ); ?></code></a>
                                        </td>
                                        <td><?php echo esc_html( $cp_entry['version'] ?? '' ); ?></td>
                                        <td><span style="color: <?php echo esc_attr( $cp_state_color ); ?>; font-weight: 600;"><?php echo esc_html( $cp_state_label ); ?></span></td>
                                        <td><?php echo esc_html( $cp_entry['closed_date'] ?? '' ); ?></td>
                                        <td><?php echo esc_html( $cp_reason ); ?></td>
                                        <td>
                                            <?php echo $cp_detected > 0 ? esc_html( wp_date( $datetime_format, $cp_detected ) ) : '&mdash;'; ?>
                                        </td>
                                        <td>
                                            <button type="button" class="button button-small vigilante-ignore-closed-plugin" data-slug="<?php echo esc_attr( $cp_slug ); ?>">
                                                <?php esc_html_e( 'Ignore', 'vigilante' ); ?>
                                            </button>
                                        </td>
                                    </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                    </div>
                    <?php endif; ?>

                    <?php if ( ! empty( $regular_modified ) ) : ?>
                    <div class="vigilante-file-list vigilante-paginated-section" data-bulk-mode="ignore">
                        <h3><?php esc_html_e( 'Modified Files', 'vigilante' ); ?></h3>
                        <p class="description"><?php esc_html_e( 'These files (apparently) differ from the original WordPress or plugin versions.', 'vigilante' ); ?></p>
                        <div class="vigilante-fi-bulk-bar">
                            <button type="button" class="button vigilante-bulk-ignore" disabled><?php esc_html_e( 'Ignore selected', 'vigilante' ); ?></button>
                            <span class="vigilante-fi-bulk-count" aria-live="polite"></span>
                        </div>
                        <div class="vigilante-fi-pagination-wrap"></div>
                        <table class="wp-list-table widefat fixed striped vigilante-fi-paginated">
                            <thead>
                                <tr>
                                    <td class="manage-column column-cb check-column"><input type="checkbox" class="vigilante-fi-cb-all" aria-label="<?php esc_attr_e( 'Select all', 'vigilante' ); ?>"></td>
                                    <th><?php esc_html_e( 'File', 'vigilante' ); ?></th>
                                    <th style="width: 100px;"><?php esc_html_e( 'Type', 'vigilante' ); ?></th>
                                    <th style="width: 80px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php
                                foreach ( $regular_modified as $item ) {
                                    $file_path = '';
                                    $file_type = 'unknown';

                                    if ( is_array( $item ) ) {
                                        if ( isset( $item['file'] ) ) {
                                            $file_path = $item['file'];
                                        }
                                        if ( isset( $item['type'] ) ) {
                                            $file_type = $item['type'];
                                        }
                                    } else {
                                        $file_path = (string) $item;
                                    }
                                    ?>
                                    <tr>
                                        <th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file_path ); ?>"></th>
                                        <td><code><?php echo esc_html( $file_path ); ?></code></td>
                                        <td><?php echo esc_html( $file_type ); ?></td>
                                        <td><button type="button" class="button button-small vigilante-ignore-file" data-file="<?php echo esc_attr( $file_path ); ?>"><?php esc_html_e( 'Ignore', 'vigilante' ); ?></button></td>
                                    </tr>
                                    <?php
                                }
                                ?>
                            </tbody>
                        </table>
                    </div>
                    <?php endif; ?>

                    <?php if ( $last_results && empty( $last_results['modified'] ) && empty( $last_results['suspicious'] ) && empty( $last_results['extra'] ) && ! $has_closed ) : ?>
                    <p class="vigilante-all-clear" style="color: #00a32a; font-weight: bold;">
                        <?php esc_html_e( 'Good Job! All files passed integrity check. No issues found.', 'vigilante' ); ?>
                    </p>
                    <?php endif; ?>
                <?php endif; ?>
            </div>
        </div>
        <?php endif; ?>

        <?php if ( ! empty( $ignored_closed_plugins ) ) : ?>
        <div id="vigilante-section-fi-ignored-closed" class="vigilante-settings-section">
            <h2><?php esc_html_e( 'Ignored Closed + Removed Plugins', 'vigilante' ); ?></h2>
            <p class="description"><?php esc_html_e( 'These plugins remain closed/removed in WordPress.org but you have chosen to hide them from the main list and from email alerts. They are still installed on the site and still running their code &mdash; the silencing is purely cosmetic.', 'vigilante' ); ?></p>
            <table class="wp-list-table widefat fixed striped">
                <thead>
                    <tr>
                        <th><?php esc_html_e( 'Plugin', 'vigilante' ); ?></th>
                        <th style="width: 110px;"><?php esc_html_e( 'State', 'vigilante' ); ?></th>
                        <th style="width: 120px;"><?php esc_html_e( 'Closed date', 'vigilante' ); ?></th>
                        <th style="width: 130px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach ( $ignored_closed_plugins as $icp_slug => $icp_entry ) :
                        $icp_state       = $icp_entry['state'] ?? '';
                        $icp_state_label = 'closed' === $icp_state ? __( 'Closed', 'vigilante' ) : __( 'Removed', 'vigilante' );
                        ?>
                        <tr>
                            <td>
                                <strong><?php echo esc_html( $icp_entry['name'] ?? $icp_slug ); ?></strong><br>
                                <a href="<?php echo esc_url( 'https://wordpress.org/plugins/' . $icp_slug . '/' ); ?>" target="_blank" rel="noopener noreferrer"><code style="color: #50575e;"><?php echo esc_html( $icp_slug ); ?></code></a>
                            </td>
                            <td><?php echo esc_html( $icp_state_label ); ?></td>
                            <td><?php echo esc_html( $icp_entry['closed_date'] ?? '' ); ?></td>
                            <td>
                                <button type="button" class="button button-small vigilante-unignore-closed-plugin" data-slug="<?php echo esc_attr( $icp_slug ); ?>">
                                    <?php esc_html_e( 'Stop ignoring', 'vigilante' ); ?>
                                </button>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
            <p style="margin-top: 10px;">
                <button type="button" class="button vigilante-clear-ignored-closed-plugins"><?php esc_html_e( 'Clear All Ignored Closed + Removed Plugins', 'vigilante' ); ?></button>
            </p>
        </div>
        <?php endif; ?>

        <?php if ( ! empty( $ignored_files ) ) : ?>
        <div id="vigilante-section-fi-ignored" class="vigilante-settings-section">
            <h2><?php esc_html_e( 'Ignored Files', 'vigilante' ); ?></h2>
            <p class="description"><?php esc_html_e( 'These files are excluded from scan results and email notifications. They will still be scanned but any findings will be hidden.', 'vigilante' ); ?></p>
            <div class="vigilante-paginated-section" data-bulk-mode="unignore">
                <div class="vigilante-fi-bulk-bar">
                    <button type="button" class="button vigilante-bulk-unignore" disabled><?php esc_html_e( 'Stop ignoring selected', 'vigilante' ); ?></button>
                    <span class="vigilante-fi-bulk-count" aria-live="polite"></span>
                </div>
                <div class="vigilante-fi-pagination-wrap"></div>
                <table class="wp-list-table widefat fixed striped vigilante-fi-paginated">
                <thead>
                    <tr>
                        <td class="manage-column column-cb check-column"><input type="checkbox" class="vigilante-fi-cb-all" aria-label="<?php esc_attr_e( 'Select all', 'vigilante' ); ?>"></td>
                        <th><?php esc_html_e( 'File', 'vigilante' ); ?></th>
                        <th style="width: 120px;"><?php esc_html_e( 'Actions', 'vigilante' ); ?></th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach ( $ignored_files as $file ) : ?>
                    <tr>
                        <th scope="row" class="check-column"><input type="checkbox" class="vigilante-fi-cb" value="<?php echo esc_attr( $file ); ?>"></th>
                        <td><code><?php echo esc_html( $file ); ?></code></td>
                        <td><button type="button" class="button button-small vigilante-unignore-file" data-file="<?php echo esc_attr( $file ); ?>"><?php esc_html_e( 'Stop ignoring', 'vigilante' ); ?></button></td>
                    </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
            </div>
            <p style="margin-top: 10px;">
                <button type="button" class="button vigilante-clear-ignored"><?php esc_html_e( 'Clear All Ignored Files', 'vigilante' ); ?></button>
            </p>
        </div>
        <?php endif; ?>
        <?php
    }

    /**
     * Render sidebar with promotional widgets
     */
    private function render_sidebar() {
        $promo_banner = new Vigilante_Promo_Banner( 'vigilante' );
        $promo_banner->render();
    }

    /**
     * AJAX: Download a ZIP backup of the critical config files.
     *
     * Streams wp-config.php and .htaccess (and robots.txt if present) as a
     * downloadable archive. Config backups are no longer left as files under the
     * web root, so this hands the admin the archive directly.
     */
    public function ajax_download_files_backup() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_die( esc_html__( 'Permission denied.', 'vigilante' ), 403 );
        }

        // The archive carries wp-config.php, which a whole network shares. On a
        // network manage_options is held by every subsite administrator, so the
        // same gate the writers use applies here.
        if ( ! Vigilante_Settings::can_write_shared_files() ) {
            wp_die( esc_html( Vigilante_Settings::get_shared_files_notice() ), 403 );
        }

        $backup_manager = new Vigilante_Backup_Manager();
        $result         = $backup_manager->stream_files_zip();

        // stream_files_zip() exits on success; only a WP_Error returns here.
        if ( is_wp_error( $result ) ) {
            wp_die( esc_html( $result->get_error_message() ), 500 );
        }
    }

    /**
     * AJAX: Save settings
     */
    public function ajax_save_settings() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $section = isset( $_POST['section'] ) ? sanitize_key( $_POST['section'] ) : '';
        
        // Handle $_POST['data'] based on type
        if ( isset( $_POST['data'] ) && is_array( $_POST['data'] ) ) {
            $data = map_deep( wp_unslash( $_POST['data'] ), 'sanitize_text_field' );
        } elseif ( isset( $_POST['data'] ) ) {
            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
            $raw_data = wp_unslash( $_POST['data'] );
            parse_str( $raw_data, $data );
            $data = map_deep( $data, 'sanitize_textarea_field' );
        } else {
            $data = array();
        }

        if ( empty( $section ) ) {
            wp_send_json_error( __( 'Invalid section.', 'vigilante' ) );
        }

        // Check if 2FA is being enabled or method changed (for notification sending)
        $send_2fa_notification = false;
        $send_login_url_notification = false;
        
        if ( 'login_security' === $section ) {
            // Read old state from DB
            $db_options = get_option( Vigilante_Settings::OPTION_NAME, array() );
            $old_2fa_enabled = ! empty( $db_options['login_security']['two_factor']['enabled'] );
            $old_method = $db_options['login_security']['two_factor']['method'] ?? 'email';
            
            // Check new state from submitted data
            $new_2fa_enabled = false;
            $notify_on_enable = false;
            $new_method = isset( $data['login_security']['two_factor']['method'] ) 
                ? sanitize_key( $data['login_security']['two_factor']['method'] ) 
                : 'email';
            
            if ( isset( $data['login_security']['two_factor']['enabled'] ) ) {
                $new_2fa_enabled = filter_var( $data['login_security']['two_factor']['enabled'], FILTER_VALIDATE_BOOLEAN );
            }
            if ( isset( $data['login_security']['two_factor']['notify_on_enable'] ) ) {
                $notify_on_enable = filter_var( $data['login_security']['two_factor']['notify_on_enable'], FILTER_VALIDATE_BOOLEAN );
            }
            
            // Send notification if:
            // 1. 2FA is being enabled (was off, now on) OR
            // 2. Method changed while 2FA is enabled
            if ( $notify_on_enable && $new_2fa_enabled ) {
                if ( ! $old_2fa_enabled || ( $old_2fa_enabled && $old_method !== $new_method ) ) {
                    $send_2fa_notification = true;
                }
            }

            // Check if login URL changed and notification is enabled
            $old_login_url = $db_options['login_security']['custom_login_url'] ?? '';
            $new_login_url = isset( $data['login_security']['custom_login_url'] )
                ? sanitize_title( $data['login_security']['custom_login_url'] )
                : '';
            $notify_on_url_change = isset( $data['login_security']['notify_on_login_url_change'] )
                ? filter_var( $data['login_security']['notify_on_login_url_change'], FILTER_VALIDATE_BOOLEAN )
                : false;

            if ( $notify_on_url_change && ! empty( $new_login_url ) && $new_login_url !== $old_login_url ) {
                $send_login_url_notification = true;
            }
        }
        
        // Get defaults
        $defaults = $this->settings->get_default_options();

        // Read ONLY saved options from database (not merged with defaults)
        $saved_options = get_option( Vigilante_Settings::OPTION_NAME, array() );

        // What is stored before this request changes anything: the shared file
        // settings this user may not change are put back from here (2.11.6).
        $stored_options = $saved_options;
        $locked         = Vigilante_Settings::get_locked_file_settings();

        if ( isset( $locked[ $section ] ) && true === $locked[ $section ] ) {
            wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
        }

        // A module switch is a single key, so refusing says more than a success
        // that changed nothing, and the dashboard puts the toggle back.
        if ( 'modules' === $section && isset( $locked['modules'], $data['modules'] ) && is_array( $locked['modules'] ) && is_array( $data['modules'] ) ) {
            foreach ( array_keys( $data['modules'] ) as $vg_module ) {
                if ( in_array( sanitize_key( $vg_module ), $locked['modules'], true ) ) {
                    wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
                }
            }
        }

        $rejected_ips     = array();
        $rejected_proxies = array();

        // Handle modules
        if ( 'modules' === $section && isset( $data['modules'] ) ) {
            if ( ! isset( $saved_options['modules'] ) ) {
                $saved_options['modules'] = array();
            }
            foreach ( $data['modules'] as $module => $enabled ) {
                $module = sanitize_key( $module );
                $saved_options['modules'][ $module ] = in_array( $enabled, array( '1', 1, 'true', true ), true );
            }
            // Clear active preset when modules change
            update_option( 'vigilante_active_preset', '' );
        } else {
            // Process primary section
            if ( isset( $data[ $section ] ) && is_array( $data[ $section ] ) ) {
                $section_defaults = isset( $defaults[ $section ] ) ? $defaults[ $section ] : array();
                $current_section = isset( $saved_options[ $section ] ) ? $saved_options[ $section ] : array();
                
                // Process the submitted data
                $processed = $this->process_section_data( $data[ $section ], $section_defaults, $current_section );

                // The IP boxes are free text and, until 2.9.9, whatever was typed
                // went straight into the option. An entry the matcher can never
                // match still sits in a security list looking like protection,
                // so the ones that cannot match are dropped and reported back
                // instead of being stored in silence.
                $rejected_ips = $this->filter_ip_lists( $section, $processed, $rejected_proxies );

                // Save the processed section
                $saved_options[ $section ] = $processed;
                
                // Clear active preset when any section settings change
                update_option( 'vigilante_active_preset', '' );
            }
        }

        // Clear cache before saving
        wp_cache_delete( Vigilante_Settings::OPTION_NAME, 'options' );
        
        $saved_options = Vigilante_Settings::keep_locked_file_settings( $saved_options, $stored_options );

        // Save to database
        update_option( Vigilante_Settings::OPTION_NAME, $saved_options );
        
        // Clear the settings cache
        $this->settings->clear_cache();

        // Apply changes based on section
        $this->apply_section_changes( $section, $saved_options );

        // Send 2FA notifications after settings are saved
        $notification_result = null;
        if ( $send_2fa_notification ) {
            $notification_result = $this->send_2fa_enable_notifications();
        }

        // Send login URL notifications after settings are saved
        $login_url_result = null;
        if ( $send_login_url_notification ) {
            $login_url_result = $this->send_login_url_notifications();
        }

        // Build success message
        $message = __( 'Settings saved successfully.', 'vigilante' );
        
        if ( $notification_result && $notification_result['sent'] > 0 ) {
            $message .= ' ' . sprintf(
                /* translators: %d: Number of emails sent */
                _n(
                    '2FA notification sent to %d user.',
                    '2FA notifications sent to %d users.',
                    $notification_result['sent'],
                    'vigilante'
                ),
                $notification_result['sent']
            );
        }

        if ( $login_url_result && $login_url_result['sent'] > 0 ) {
            $message .= ' ' . sprintf(
                /* translators: %d: Number of emails sent */
                _n(
                    'Login URL notification sent to %d user.',
                    'Login URL notifications sent to %d users.',
                    $login_url_result['sent'],
                    'vigilante'
                ),
                $login_url_result['sent']
            );
        }

        if ( ! empty( $rejected_ips ) ) {
            $message .= ' ' . sprintf(
                /* translators: %s: comma separated list of the entries that were not saved. */
                _n(
                    'This entry is not a valid IP, CIDR range or wildcard, so it was not saved: %s',
                    'These entries are not valid IPs, CIDR ranges or wildcards, so they were not saved: %s',
                    count( $rejected_ips ),
                    'vigilante'
                ),
                implode( ', ', array_map( 'esc_html', $rejected_ips ) )
            );
        }

        if ( ! empty( $rejected_proxies ) ) {
            $message .= ' ' . sprintf(
                /* translators: %s: comma separated list of the trusted proxy entries that were not saved. */
                _n(
                    'A trusted proxy must be an exact IP or a CIDR range, not a wildcard, so this entry was not saved: %s',
                    'A trusted proxy must be an exact IP or a CIDR range, not a wildcard, so these entries were not saved: %s',
                    count( $rejected_proxies ),
                    'vigilante'
                ),
                implode( ', ', array_map( 'esc_html', $rejected_proxies ) )
            );
        }

        wp_send_json_success( $message );
    }

    /**
     * Keep only the IP patterns the matcher can actually match
     *
     * @since 2.9.9
     *
     * @param string $section   Section being saved.
     * @param array  $processed Section data, edited in place.
     * @return array Entries that were dropped, for the message back to the user.
     */
    private function filter_ip_lists( $section, &$processed, &$rejected_proxies = array() ) {
        $rejected_proxies = array();

        // Trusted proxies feed an identity decision, so only exact addresses and
        // CIDR ranges belong there: a wildcard is stripped with its own message,
        // never stored looking effective. The matcher ignores it anyway (see
        // Vigilante_IP_Utils::in_list_ip_or_cidr), this stops it persisting.
        if ( 'firewall' === $section && isset( $processed['trusted_proxies'] ) && is_array( $processed['trusted_proxies'] ) ) {
            $split                          = Vigilante_IP_Utils::split_list_ip_or_cidr( $processed['trusted_proxies'] );
            $processed['trusted_proxies']   = $split['valid'];
            $rejected_proxies               = $split['rejected'];
        }

        $lists = array(
            'firewall'       => array( 'ip_whitelist', 'ip_blacklist' ),
            'login_security' => array( 'ip_whitelist' ),
        );

        if ( ! isset( $lists[ $section ] ) ) {
            return array();
        }

        $rejected = array();

        foreach ( $lists[ $section ] as $key ) {
            if ( ! isset( $processed[ $key ] ) || ! is_array( $processed[ $key ] ) ) {
                continue;
            }

            $split             = Vigilante_IP_Utils::split_list( $processed[ $key ] );
            $processed[ $key ] = $split['valid'];
            $rejected          = array_merge( $rejected, $split['rejected'] );
        }

        return array_values( array_unique( $rejected ) );
    }

    /**
     * Send 2FA enable notifications to users
     *
     * @return array Result with 'sent' and 'failed' counts.
     */
    private function send_2fa_enable_notifications() {
        $result = array(
            'sent'   => 0,
            'failed' => 0,
        );
        
        // Get settings for roles and method
        $login_security = $this->settings->get_section( 'login_security' );
        $two_factor = isset( $login_security['two_factor'] ) ? $login_security['two_factor'] : array();
        $roles  = isset( $two_factor['enforced_roles'] ) ? $two_factor['enforced_roles'] : array( 'administrator' );
        $method = isset( $two_factor['method'] ) ? $two_factor['method'] : 'email';
        
        if ( empty( $roles ) ) {
            $roles = array( 'administrator' );
        }
        
        $excluded = isset( $two_factor['excluded_users'] ) ? array_map( 'absint', $two_factor['excluded_users'] ) : array();
        
        // Get users with these roles
        $args = array(
            'role__in' => $roles,
        );
        if ( ! empty( $excluded ) ) {
            // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude -- Small excluded users list from settings.
            $args['exclude'] = $excluded;
        }
        $users = get_users( $args );
        
        if ( empty( $users ) ) {
            return $result;
        }
        
        $site_name = get_bloginfo( 'name' );
        $from_name = ! empty( $two_factor['email_from_name'] ) ? $two_factor['email_from_name'] : $site_name;
        
        if ( 'totp' === $method ) {
            // Use TOTP class for styled HTML emails
            if ( ! class_exists( 'Vigilante_Two_Factor_TOTP' ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-two-factor-totp.php';
            }
            $totp = new Vigilante_Two_Factor_TOTP( $this->settings, $this->database, $this->activity_log );
            
            foreach ( $users as $user ) {
                // Skip users who already have TOTP configured
                $totp_data = $this->database->get_totp_data( $user->ID );
                if ( $totp_data && ! empty( $totp_data['is_configured'] ) ) {
                    continue;
                }
                
                $sent = $totp->send_activation_email( $user, $site_name, $from_name );
                
                if ( $sent ) {
                    $this->database->mark_2fa_notified( $user->ID );
                    $result['sent']++;
                } else {
                    $result['failed']++;
                }
            }
        } else {
            // Email method - use existing email 2FA class
            if ( ! class_exists( 'Vigilante_Two_Factor_Email' ) ) {
                require_once VIGILANTE_INCLUDES_DIR . 'class-two-factor-email.php';
            }
            $email_2fa = new Vigilante_Two_Factor_Email( $this->settings, $this->database, $this->activity_log );
            return $email_2fa->send_activation_notifications( false );
        }
        
        return $result;
    }

    /**
     * Send login URL change notifications to users with admin access
     *
     * @return array Result with 'sent' and 'failed' counts.
     */
    private function send_login_url_notifications() {
        $login_options = $this->settings->get_section( 'login_security' );
        $custom_url    = ! empty( $login_options['custom_login_url'] ) ? sanitize_title( $login_options['custom_login_url'] ) : '';

        if ( empty( $custom_url ) ) {
            return array( 'sent' => 0, 'failed' => 0 );
        }

        $login_url = home_url( $custom_url . '/' );
        $site_name = get_bloginfo( 'name' );

        $admin_roles = array( 'administrator', 'editor', 'author', 'contributor' );
        $users = get_users( array( 'role__in' => $admin_roles ) );

        if ( empty( $users ) ) {
            return array( 'sent' => 0, 'failed' => 0 );
        }

        $subject = sprintf(
            /* translators: %s: Site name */
            __( '[%s] Your login URL has changed', 'vigilante' ),
            $site_name
        );

        $body  = Vigilante_Email_Template::p( __( 'The login URL for the admin area has been changed. Please save the new URL below and use it from now on.', 'vigilante' ) );
        $body .= Vigilante_Email_Template::url_box( $login_url, __( 'Your new login URL:', 'vigilante' ) );
        $body .= Vigilante_Email_Template::alert_box( __( 'The old login address (wp-login.php) will no longer work.', 'vigilante' ) );
        $body .= Vigilante_Email_Template::button( $login_url, __( 'Go to login', 'vigilante' ) );

        $sent   = 0;
        $failed = 0;

        foreach ( $users as $user ) {
            $result = Vigilante_Email_Template::send(
                $user->user_email,
                $subject,
                __( 'Login URL changed', 'vigilante' ),
                $body
            );
            if ( $result ) {
                $sent++;
            } else {
                $failed++;
            }
        }

        if ( $this->activity_log ) {
            $this->activity_log->log(
                'login',
                'login_url_notified',
                sprintf(
                    /* translators: 1: Sent count, 2: Failed count */
                    __( 'Login URL notification sent on save: %1$d sent, %2$d failed', 'vigilante' ),
                    $sent,
                    $failed
                )
            );
        }

        return array( 'sent' => $sent, 'failed' => $failed );
    }

    /**
     * Process section data maintaining proper types from defaults
     *
     * @param array  $submitted_data Data submitted from form.
     * @param array  $defaults       Default values for this section.
     * @param array  $current        Current saved values.
     * @param string $section_name   Section name for special handling.
     * @return array Processed data.
     */
    private function process_section_data( $submitted_data, $defaults, $current, $section_name = '' ) {
        // Start with defaults, then merge current saved values
        $result = array_replace_recursive( $defaults, $current );
        
        // Process each submitted value
        foreach ( $submitted_data as $key => $value ) {
            $key = sanitize_key( $key );
            
            if ( is_array( $value ) ) {
                // Nested array (like rate_limiting)
                $nested_defaults = isset( $defaults[ $key ] ) && is_array( $defaults[ $key ] ) ? $defaults[ $key ] : array();
                $nested_current = isset( $result[ $key ] ) && is_array( $result[ $key ] ) ? $result[ $key ] : array();
                $result[ $key ] = $this->process_section_data( $value, $nested_defaults, $nested_current, $key );
            } else {
                // Determine type from default value
                $default_value = isset( $defaults[ $key ] ) ? $defaults[ $key ] : null;
                
                if ( null === $default_value ) {
                    // No default, check current value type or use as string
                    $current_value = isset( $current[ $key ] ) ? $current[ $key ] : null;
                    if ( is_bool( $current_value ) ) {
                        $result[ $key ] = in_array( $value, array( '1', 1, 'true', true ), true );
                    } elseif ( is_int( $current_value ) ) {
                        $result[ $key ] = intval( $value );
                    } elseif ( is_array( $current_value ) ) {
                        $result[ $key ] = is_string( $value ) ? array_filter( array_map( 'trim', explode( "\n", $value ) ) ) : (array) $value;
                    } else {
                        $result[ $key ] = sanitize_text_field( $value );
                    }
                } elseif ( is_bool( $default_value ) ) {
                    // Boolean: '1', 1, 'true' become true; '0', 0, '', 'false' become false
                    $result[ $key ] = in_array( $value, array( '1', 1, 'true', true ), true );
                } elseif ( is_int( $default_value ) ) {
                    // Integer - with special handling for time fields shown in minutes
                    $int_value = intval( $value );
                    
                    // Convert minutes to seconds for login_security duration fields
                    // These are displayed as minutes in the form but stored as seconds
                    if ( in_array( $key, array( 'lockout_duration', 'max_lockout_duration' ), true ) ) {
                        $int_value = $int_value * 60;
                    }
                    
                    $result[ $key ] = $int_value;
                } elseif ( is_array( $default_value ) ) {
                    // Array from textarea (e.g., IP lists)
                    if ( is_string( $value ) ) {
                        $result[ $key ] = array_filter( array_map( 'trim', explode( "\n", $value ) ) );
                    } else {
                        $result[ $key ] = (array) $value;
                    }
                } else {
                    // String - preserve newlines for textarea fields
                    if ( is_string( $value ) && ( strpos( $value, "\n" ) !== false || strpos( $value, "\r" ) !== false ) ) {
                        $result[ $key ] = sanitize_textarea_field( $value );
                    } else {
                        $result[ $key ] = sanitize_text_field( $value );
                    }
                }
            }
        }
        
        // Handle unchecked checkboxes: HTML forms don't submit unchecked boxes
        // If a boolean field exists in defaults but NOT in submitted_data, set it to false
        //
        // EXCEPTION: the top-level 'enabled' flag of every section is the
        // module's master switch and is controlled by the Dashboard module
        // toggle, NOT by a checkbox inside the section's form. Treating it
        // like a regular checkbox here would silently switch the module off
        // every time the user saves the tab — see the REST API enabled=false
        // regression. We only skip it at the top level (when section_name is
        // empty); nested 'enabled' fields like security_headers.csp.enabled
        // are real checkboxes and must keep the auto-unset behaviour.
        $preserve_top_level = array( 'enabled' );

        foreach ( $defaults as $key => $default_value ) {
            if ( '' === $section_name && in_array( $key, $preserve_top_level, true ) ) {
                continue;
            }
            if ( is_bool( $default_value ) && ! array_key_exists( $key, $submitted_data ) ) {
                $result[ $key ] = false;
            } elseif ( is_array( $default_value ) && ! isset( $submitted_data[ $key ] ) ) {
                // Check if this is a flat value list (like excluded_users, enforced_roles, ip_whitelist)
                // vs a nested settings group (like rate_limiting, two_factor)
                // Flat lists: default is empty array OR all values are scalar
                $is_value_list = empty( $default_value );
                if ( ! $is_value_list ) {
                    $is_value_list = true;
                    foreach ( $default_value as $dv ) {
                        if ( ! is_scalar( $dv ) ) {
                            $is_value_list = false;
                            break;
                        }
                    }
                }

                if ( $is_value_list ) {
                    // All items removed - reset to empty array
                    $result[ $key ] = array();
                } else {
                    // Nested settings group - handle boolean children
                    foreach ( $default_value as $nested_key => $nested_default ) {
                        if ( is_bool( $nested_default ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) ) {
                            $nested_submitted = isset( $submitted_data[ $key ] ) && is_array( $submitted_data[ $key ] ) 
                                ? $submitted_data[ $key ] 
                                : array();
                            if ( ! array_key_exists( $nested_key, $nested_submitted ) ) {
                                $result[ $key ][ $nested_key ] = false;
                            }
                        }
                    }
                }
            }
        }
        
        return $result;
    }

    /**
     * AJAX: Export settings
     */
    public function ajax_export_settings() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $options = $this->settings->get_all_options();
        $filename = 'vigilante-settings-' . gmdate( 'Y-m-d-His' ) . '.json';

        wp_send_json_success( array(
            'content'  => wp_json_encode( $options, JSON_PRETTY_PRINT ),
            'filename' => $filename,
        ) );
    }

    /**
     * AJAX: Import settings
     */
    public function ajax_import_settings() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        // Accept both 'settings' (from JS) and 'content' (legacy).
        // Do NOT run sanitize_text_field() on the raw payload: it calls
        // wp_strip_all_tags() internally, which removes any "<...>" substring
        // and turns a valid export JSON into garbage if any stored value
        // contains < or > (htaccess snippets, email templates, etc.). The
        // real sanitization happens after json_decode(), via map_deep() on
        // the parsed array.
        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
        $content = isset( $_POST['settings'] ) ? wp_unslash( $_POST['settings'] ) : '';
        if ( empty( $content ) ) {
            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
            $content = isset( $_POST['content'] ) ? wp_unslash( $_POST['content'] ) : '';
        }

        if ( empty( $content ) || ! is_string( $content ) ) {
            wp_send_json_error( __( 'No content provided.', 'vigilante' ) );
        }

        $imported = json_decode( $content, true );

        if ( json_last_error() !== JSON_ERROR_NONE || ! is_array( $imported ) ) {
            wp_send_json_error( __( 'Invalid JSON format.', 'vigilante' ) );
        }

        // Sanitize imported data recursively
        $imported = map_deep( $imported, 'sanitize_text_field' );

        // Validate structure: only sections and keys of the schema survive, and
        // every value takes the type of its default. Until 2.11.0 this was an
        // array_replace_recursive() of the file over the defaults, so any key in
        // the file, known or not, landed in vigilante_options (S7). Sections
        // the file does not carry keep their defaults; a section it does carry
        // replaces the default one whole, because validate_options() has
        // already filled in whatever the file left out.
        $defaults  = $this->settings->get_default_options();
        $validated = $this->settings->validate_options( $imported );
        $merged    = $defaults;

        foreach ( $validated as $section => $data ) {
            if ( is_array( $data ) ) {
                $merged[ $section ] = $data;
            }
        }

        // Save
        $merged = Vigilante_Settings::keep_locked_file_settings( $merged, get_option( Vigilante_Settings::OPTION_NAME, array() ) );
        update_option( Vigilante_Settings::OPTION_NAME, $merged );
        $this->settings->clear_cache();

        // Re-evaluate the active preset marker. The imported config may match
        // a known preset exactly, partially, or not at all — without this step
        // the dashboard would keep showing whatever preset was active before
        // the import even if the new config no longer matches it.
        $matched_preset = $this->detect_matching_preset( $merged );
        if ( null === $matched_preset ) {
            delete_option( 'vigilante_active_preset' );
        } else {
            update_option( 'vigilante_active_preset', $matched_preset );
        }

        // Apply file changes after import
        $this->apply_all_file_changes( $merged );

        // Refresh the Security Analyzer score so the dashboard widget reflects
        // the imported config rather than the pre-import scan. Reuse the
        // post-Under-Attack scan hook (same job: full scan, async).
        if ( ! wp_next_scheduled( 'vigilante_under_attack_post_scan' ) ) {
            wp_schedule_single_event( time() + 5, 'vigilante_under_attack_post_scan' );
        }

        wp_send_json_success( __( 'Settings imported successfully.', 'vigilante' ) . $this->locked_file_settings_message() );
    }

    /**
     * Detect whether a vigilante_options array matches a known preset.
     *
     * A preset matches when every field the preset explicitly declares is
     * present in the config with the same (normalised) value. Fields outside
     * the preset are ignored — they may have been modified by the user before
     * applying the preset and do not invalidate the match. This mirrors how
     * apply_preset() now layers presets on top of the user's existing config.
     *
     * @param array $options The current/imported vigilante_options.
     * @return string|null   Preset id ('standard', 'maximum') or null if custom.
     */
    private function detect_matching_preset( $options ) {
        if ( ! is_array( $options ) ) {
            return null;
        }

        $presets = $this->settings->get_presets();

        foreach ( $presets as $preset_id => $preset_data ) {
            unset( $preset_data['name'], $preset_data['description'] );
            if ( $this->preset_subset_matches( $preset_data, $options ) ) {
                return $preset_id;
            }
        }

        return null;
    }

    /**
     * Check whether every leaf value inside $preset_subset exists with the
     * same (normalised) value at the same path inside $config.
     *
     * @param mixed $preset_subset Branch of the preset definition.
     * @param mixed $config        Same branch in the live/imported config.
     * @return bool
     */
    private function preset_subset_matches( $preset_subset, $config ) {
        if ( is_array( $preset_subset ) ) {
            if ( ! is_array( $config ) ) {
                return false;
            }
            foreach ( $preset_subset as $key => $value ) {
                if ( ! array_key_exists( $key, $config ) ) {
                    return false;
                }
                if ( ! $this->preset_subset_matches( $value, $config[ $key ] ) ) {
                    return false;
                }
            }
            return true;
        }

        return $this->normalise_scalar_for_compare( $preset_subset ) === $this->normalise_scalar_for_compare( $config );
    }

    /**
     * Normalise a scalar value so that the variants WordPress and the form
     * layer routinely produce ('1' / 1 / true → "1"; '' / '0' / 0 / false /
     * null → "") compare equal. Other values become strings unchanged.
     *
     * @param mixed $value
     * @return string
     */
    private function normalise_scalar_for_compare( $value ) {
        if ( is_bool( $value ) ) {
            return $value ? '1' : '';
        }
        if ( null === $value ) {
            return '';
        }
        if ( is_int( $value ) || is_float( $value ) ) {
            return (string) $value;
        }
        if ( is_string( $value ) ) {
            if ( 'true' === $value ) {
                return '1';
            }
            if ( 'false' === $value ) {
                return '';
            }
            return $value;
        }
        // Arrays and objects shouldn't reach here (handled by recursion above),
        // but if they do, fall back to a stable comparable representation.
        return wp_json_encode( $value );
    }

    /**
     * AJAX: Apply preset
     */
    public function ajax_apply_preset() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $preset = isset( $_POST['preset'] ) ? sanitize_key( $_POST['preset'] ) : '';
        
        // Handle reset to defaults
        if ( 'reset' === $preset ) {
            $stored_options = get_option( Vigilante_Settings::OPTION_NAME, array() );
            $defaults       = Vigilante_Settings::get_defaults_preserving_user_data( $stored_options );
            $defaults       = Vigilante_Settings::keep_locked_file_settings( $defaults, $stored_options );
            update_option( Vigilante_Settings::OPTION_NAME, $defaults );
            $this->settings->clear_cache();
            
            // Clear active preset
            update_option( 'vigilante_active_preset', '' );
            
            // Apply file changes after reset
            $this->apply_all_file_changes( $defaults );
            
            wp_send_json_success( __( 'Settings reset to defaults.', 'vigilante' ) . $this->locked_file_settings_message() );
            return;
        }
        
        $presets = $this->settings->get_presets();

        if ( ! isset( $presets[ $preset ] ) ) {
            wp_send_json_error( __( 'Invalid preset.', 'vigilante' ) );
        }

        $preset_options = $presets[ $preset ];
        unset( $preset_options['name'], $preset_options['description'] );

        // Layer the preset on top of the user's CURRENT configuration, not on
        // top of defaults. This way applying a preset only changes the fields
        // the preset explicitly mentions; everything else stays as the user
        // had it. For example, applying Maximum will not flip HSTS off if the
        // user had it on — Maximum doesn't touch HSTS, so it's left alone.
        // Use "Reset to Defaults" if a clean slate is needed.
        $current = get_option( Vigilante_Settings::OPTION_NAME, array() );
        if ( ! is_array( $current ) ) {
            $current = array();
        }
        // Make sure all known keys exist before merging — the merge does not
        // invent keys that are missing on both sides.
        $current = Vigilante_Settings::merge_preset( $this->settings->get_default_options(), $current );

        $merged = Vigilante_Settings::merge_preset( $current, $preset_options );
        $merged = Vigilante_Settings::keep_locked_file_settings( $merged, get_option( Vigilante_Settings::OPTION_NAME, array() ) );

        update_option( Vigilante_Settings::OPTION_NAME, $merged );
        $this->settings->clear_cache();

        // Save active preset
        update_option( 'vigilante_active_preset', $preset );

        // Apply file changes after preset
        $this->apply_all_file_changes( $merged );

        wp_send_json_success( __( 'Preset applied successfully.', 'vigilante' ) . $this->locked_file_settings_message() );
    }

    /**
     * AJAX: Reset a specific section to defaults
     */
    public function ajax_reset_section() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $section = isset( $_POST['section'] ) ? sanitize_key( $_POST['section'] ) : '';
        
        if ( empty( $section ) ) {
            wp_send_json_error( __( 'No section specified.', 'vigilante' ) );
        }

        // Get current options and defaults. get_defaults_preserving_user_data()
        // applies the tweaks a fresh installation gets, so the button and a new
        // install agree, and keeps whatever the owner typed in.
        $current_options = $this->settings->get_all_options();
        $defaults        = Vigilante_Settings::get_defaults_preserving_user_data( $current_options );

        // Check if section exists in defaults
        if ( ! isset( $defaults[ $section ] ) ) {
            wp_send_json_error( __( 'Invalid section.', 'vigilante' ) );
        }

        $new_values = $defaults[ $section ];

        /*
         * On a subsite, the settings written to wp-config.php and .htaccess are
         * the main site's business. Resetting the local copy of those would only
         * make this screen disagree with the file, so they are carried over
         * untouched, and a section that is nothing but shared settings is not
         * reset at all. On the main site, a user without network rights keeps
         * the ones the shared files are built from as well (2.11.6).
         */
        $locked = Vigilante_Settings::get_locked_file_settings();

        if ( isset( $locked[ $section ] ) && true === $locked[ $section ] ) {
            wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
        }

        $current_options[ $section ] = $new_values;
        $current_options             = Vigilante_Settings::keep_locked_file_settings( $current_options, get_option( Vigilante_Settings::OPTION_NAME, array() ) );

        // Save
        update_option( Vigilante_Settings::OPTION_NAME, $current_options );
        $this->settings->clear_cache();

        // Apply file changes if needed
        $this->apply_section_changes( $section, $current_options );

        wp_send_json_success( array(
            'message' => __( 'Section reset to defaults.', 'vigilante' ),
            'section' => $section,
            'reload'  => true,
        ) );
    }

    /**
     * AJAX: Clear lockouts
     */
    public function ajax_clear_lockouts() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $ip = isset( $_POST['ip'] ) ? sanitize_text_field( wp_unslash( $_POST['ip'] ) ) : '';
        
        if ( ! empty( $ip ) ) {
            $this->database->clear_lockout( $ip );
        } else {
            $this->database->clear_all_lockouts();
        }

        wp_send_json_success( __( 'Lockouts cleared.', 'vigilante' ) );
    }

    /**
     * AJAX: Clear logs
     */
    public function ajax_clear_logs() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        if ( $this->activity_log ) {
            $result = $this->activity_log->clear_all_logs();
            if ( $result ) {
                wp_send_json_success( __( 'Logs cleared.', 'vigilante' ) );
            } else {
                wp_send_json_error( __( 'Failed to clear logs.', 'vigilante' ) );
            }
        } else {
            wp_send_json_error( __( 'Activity log not available.', 'vigilante' ) );
        }
    }

    /**
     * AJAX: Run file integrity scan.
     *
     * Triggers the file integrity scan, which now also runs the closed plugins
     * check at the end when the `check_closed_plugins` toggle is on. Activity
     * log is passed through so Security Audit entries (both file-level and
     * plugin-status) are recorded from this entry point.
     */
    public function ajax_run_scan() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        // Clear previous results before running new scan
        delete_option( 'vigilante_last_integrity_results' );
        delete_option( 'vigilante_last_integrity_scan' );

        $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database, $this->activity_log );
        $results = $file_integrity->run_scan();

        // Save new results
        update_option( 'vigilante_last_integrity_scan', time() );
        update_option( 'vigilante_last_integrity_results', $results );

        // On the main site the scan does compute the lines of wp-config.php and
        // .htaccess, for the network administrator. Somebody without network
        // rights gets the change and its sizes, not the lines.
        if ( $this->critical_approval_locked() && ! empty( $results['modified'] ) && is_array( $results['modified'] ) ) {
            foreach ( $results['modified'] as $index => $item ) {
                if ( is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
                    $results['modified'][ $index ]['diff'] = Vigilante_File_Integrity::network_only_diff();
                }
            }
        }

        wp_send_json_success( array(
            'message'      => __( 'Scan completed.', 'vigilante' ),
            'results'      => $results,
            'ignored_count' => count( get_option( 'vigilante_ignored_files', array() ) ),
        ) );
    }

    /**
     * AJAX: Clear scan results.
     *
     * Wipes visually everything inside "Last Scan Results": file scan findings
     * (Suspicious / Modified / Extra / Critical Config), file hashes and the
     * Closed + Removed Plugins block.
     *
     * Implementation detail to keep persistence intact:
     *   - We delete the file scan options + hashes outright.
     *   - For plugin status we ONLY delete the last_check timestamp — the state
     *     map and the ignore list are preserved in DB. The render gates the
     *     plugin_status subsections on last_check > 0, so they hide after
     *     Clear (visual reset) and reappear on the next Run Scan Now with the
     *     state intact. This avoids degrading a 'removed' slug (404 without
     *     metadata) back to 'not_in_repo' on the next scan, which would
     *     silently lose the alert.
     *
     * The Ignored Files list and the Ignored Closed + Removed Plugins list
     * are preserved on purpose; each has its own explicit "Clear All …"
     * button.
     */
    public function ajax_clear_scan() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $results   = get_option( 'vigilante_last_integrity_results' );
        $scanned_at = get_option( 'vigilante_last_integrity_scan' );

        delete_option( 'vigilante_last_integrity_results' );
        delete_option( 'vigilante_last_integrity_scan' );

        /*
         * A pending change to wp-config.php or the root .htaccess is closed by
         * approving it, which takes the network. Clearing the results was one
         * more way to close it without, until the next scan: the ignore list was
         * shut in 2.11.8 and this button was left open, found by the cross
         * review of 2.11.8. So for somebody who cannot approve, those entries
         * stay and everything else goes.
         */
        if ( $this->critical_approval_locked() && is_array( $results ) && ! empty( $results['modified'] ) && is_array( $results['modified'] ) ) {
            $critical = array_values(
                array_filter(
                    $results['modified'],
                    function ( $item ) {
                        return is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' );
                    }
                )
            );

            if ( $critical ) {
                $results['modified']   = $critical;
                $results['suspicious'] = array();
                $results['extra']      = array();
                update_option( 'vigilante_last_integrity_results', $results );
                update_option( 'vigilante_last_integrity_scan', $scanned_at ? $scanned_at : time() );
            }
        }

        if ( $this->database ) {
            $this->database->clear_file_hashes();
        }

        // Visual reset of plugin_status block without touching the state map
        // or the ignored list. See PHPDoc above for the rationale.
        delete_option( 'vigilante_plugin_status_last_check' );

        wp_send_json_success( __( 'Scan results cleared.', 'vigilante' ) );
    }

    /**
     * AJAX: Ignore a file from scan results
     */
    public function ajax_ignore_file() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $file = isset( $_POST['file'] ) ? sanitize_text_field( wp_unslash( $_POST['file'] ) ) : '';

        if ( empty( $file ) ) {
            wp_send_json_error( __( 'No file specified.', 'vigilante' ) );
        }

        // A change to a shared file is closed by approving it, and approving it
        // takes the network. Ignoring it would close the same warning without.
        if ( $this->critical_approval_locked() && in_array( $file, array( 'wp-config.php', '.htaccess' ), true ) ) {
            wp_send_json_error( $this->critical_approval_notice() );
        }

        $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database );
        $file_integrity->ignore_file( $file );

        // Also remove the file from stored scan results so UI updates
        $results = get_option( 'vigilante_last_integrity_results' );
        if ( $results ) {
            foreach ( array( 'modified', 'suspicious', 'extra' ) as $category ) {
                if ( ! empty( $results[ $category ] ) ) {
                    $results[ $category ] = array_values(
                        array_filter(
                            $results[ $category ],
                            function ( $item ) use ( $file ) {
                                return ( is_array( $item ) ? ( $item['file'] ?? '' ) : (string) $item ) !== $file;
                            }
                        )
                    );
                }
            }
            update_option( 'vigilante_last_integrity_results', $results );
        }

        wp_send_json_success( __( 'File added to ignored list.', 'vigilante' ) );
    }

    /**
     * AJAX: Stop ignoring a file
     */
    public function ajax_unignore_file() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $file = isset( $_POST['file'] ) ? sanitize_text_field( wp_unslash( $_POST['file'] ) ) : '';

        if ( empty( $file ) ) {
            wp_send_json_error( __( 'No file specified.', 'vigilante' ) );
        }

        $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database );
        $file_integrity->unignore_file( $file );

        wp_send_json_success( __( 'File removed from ignored list.', 'vigilante' ) );
    }

    /**
     * AJAX: Bulk ignore multiple files at once
     *
     * Processes a single batch into ignored list and prunes them from the
     * stored scan results so the UI updates without a re-scan.
     */
    public function ajax_bulk_ignore_files() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below per-item.
        $raw_files = isset( $_POST['files'] ) ? wp_unslash( $_POST['files'] ) : array();
        if ( ! is_array( $raw_files ) ) {
            wp_send_json_error( __( 'Invalid request.', 'vigilante' ) );
        }

        $files  = array();
        $shared = $this->critical_approval_locked() ? array( 'wp-config.php', '.htaccess' ) : array();
        foreach ( $raw_files as $f ) {
            $clean = sanitize_text_field( $f );
            // Same rule as ajax_ignore_file() for the two shared files.
            if ( '' !== $clean && ! in_array( $clean, $shared, true ) ) {
                $files[] = $clean;
            }
        }

        if ( empty( $files ) ) {
            wp_send_json_error( __( 'No files selected.', 'vigilante' ) );
        }

        $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database );
        $count = 0;
        foreach ( $files as $file ) {
            $file_integrity->ignore_file( $file );
            $count++;
        }

        // Also prune the stored scan results so the UI matches the new ignore list.
        $results = get_option( 'vigilante_last_integrity_results' );
        if ( $results ) {
            $files_set = array_flip( $files );
            foreach ( array( 'modified', 'suspicious', 'extra' ) as $category ) {
                if ( ! empty( $results[ $category ] ) ) {
                    $results[ $category ] = array_values(
                        array_filter(
                            $results[ $category ],
                            function ( $item ) use ( $files_set ) {
                                $path = is_array( $item ) ? ( $item['file'] ?? '' ) : (string) $item;
                                return ! isset( $files_set[ $path ] );
                            }
                        )
                    );
                }
            }
            update_option( 'vigilante_last_integrity_results', $results );
        }

        wp_send_json_success(
            array(
                'count'   => $count,
                'message' => sprintf(
                    /* translators: %d: number of files added to the ignored list */
                    _n( '%d file added to ignored list.', '%d files added to ignored list.', $count, 'vigilante' ),
                    $count
                ),
            )
        );
    }

    /**
     * AJAX: Bulk un-ignore multiple files at once
     */
    public function ajax_bulk_unignore_files() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below per-item.
        $raw_files = isset( $_POST['files'] ) ? wp_unslash( $_POST['files'] ) : array();
        if ( ! is_array( $raw_files ) ) {
            wp_send_json_error( __( 'Invalid request.', 'vigilante' ) );
        }

        $files = array();
        foreach ( $raw_files as $f ) {
            $clean = sanitize_text_field( $f );
            if ( '' !== $clean ) {
                $files[] = $clean;
            }
        }

        if ( empty( $files ) ) {
            wp_send_json_error( __( 'No files selected.', 'vigilante' ) );
        }

        $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database );
        $count = 0;
        foreach ( $files as $file ) {
            $file_integrity->unignore_file( $file );
            $count++;
        }

        wp_send_json_success(
            array(
                'count'   => $count,
                'message' => sprintf(
                    /* translators: %d: number of files removed from the ignored list */
                    _n( '%d file removed from ignored list.', '%d files removed from ignored list.', $count, 'vigilante' ),
                    $count
                ),
            )
        );
    }

    /**
     * AJAX: Clear all ignored files
     */
    public function ajax_clear_ignored() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database );
        $file_integrity->clear_ignored_files();

        wp_send_json_success( __( 'Ignored files list cleared.', 'vigilante' ) );
    }

    /**
     * AJAX: Ignore a closed/removed plugin slug so it stops appearing in the
     * main list and email digests. The plugin keeps running on the site;
     * silencing is purely cosmetic and reversible.
     */
    public function ajax_ignore_closed_plugin() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $slug = isset( $_POST['slug'] ) ? sanitize_key( wp_unslash( $_POST['slug'] ) ) : '';
        if ( '' === $slug ) {
            wp_send_json_error( __( 'No slug specified.', 'vigilante' ) );
        }

        if ( ! class_exists( 'Vigilante_Plugin_Status' ) ) {
            require_once VIGILANTE_INCLUDES_DIR . 'class-plugin-status.php';
        }
        $checker = new Vigilante_Plugin_Status( $this->settings, $this->activity_log );
        $checker->ignore_slug( $slug );

        wp_send_json_success( __( 'Plugin added to the ignored list.', 'vigilante' ) );
    }

    /**
     * AJAX: Stop ignoring a previously-ignored closed/removed plugin slug.
     */
    public function ajax_unignore_closed_plugin() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        $slug = isset( $_POST['slug'] ) ? sanitize_key( wp_unslash( $_POST['slug'] ) ) : '';
        if ( '' === $slug ) {
            wp_send_json_error( __( 'No slug specified.', 'vigilante' ) );
        }

        if ( ! class_exists( 'Vigilante_Plugin_Status' ) ) {
            require_once VIGILANTE_INCLUDES_DIR . 'class-plugin-status.php';
        }
        $checker = new Vigilante_Plugin_Status( $this->settings, $this->activity_log );
        $checker->unignore_slug( $slug );

        wp_send_json_success( __( 'Plugin removed from the ignored list.', 'vigilante' ) );
    }

    /**
     * AJAX: Clear the entire ignored-closed-plugins list.
     */
    public function ajax_clear_ignored_closed_plugins() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        if ( ! class_exists( 'Vigilante_Plugin_Status' ) ) {
            require_once VIGILANTE_INCLUDES_DIR . 'class-plugin-status.php';
        }
        $checker = new Vigilante_Plugin_Status( $this->settings, $this->activity_log );
        $checker->clear_ignored();

        wp_send_json_success( __( 'Ignored closed plugins list cleared.', 'vigilante' ) );
    }

    /**
     * AJAX: Test security headers
     */
    public function ajax_test_headers() {
        check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
        }

        // Get security grade from settings (not from actual HTTP request)
        $security_headers = new Vigilante_Security_Headers( $this->settings );
        $results = $security_headers->get_security_grade();

        wp_send_json_success( $results );
    }

    /**
     * Sanitize section data (kept for compatibility)
     *
     * @param string $section Section name.
     * @param array  $data    Section data.
     * @return array
     */
    private function sanitize_section_data( $section, $data ) {
        $sanitized = array();

        foreach ( $data as $key => $value ) {
            $key = sanitize_key( $key );
            
            if ( is_array( $value ) ) {
                $sanitized[ $key ] = $this->sanitize_section_data( $key, $value );
            } elseif ( is_numeric( $value ) ) {
                $sanitized[ $key ] = intval( $value );
            } else {
                $sanitized[ $key ] = sanitize_text_field( $value );
            }
        }

        return $sanitized;
    }

    /**
     * Apply changes after saving settings
     *
     * @param string $section     Section that was updated.
     * @param array  $all_options All options.
     */
    private function apply_section_changes( $section, $all_options ) {
        // Create fresh settings instance to ensure we have the latest data
        $fresh_settings = new Vigilante_Settings();

        // The shared Vigilant .htaccess block carries BOTH the firewall's
        // file-protection rules and the server-signature / fingerprinting rules
        // that are configured under Security Headers. So it must be regenerated
        // whenever either section (or the module toggles) changes, not only on
        // the firewall save — otherwise toggling "Hide server signature" or
        // "Remove fingerprinting headers" never reaches the .htaccess.
        if ( in_array( $section, array( 'firewall', 'security_headers', 'modules' ), true ) ) {
            $htaccess = new Vigilante_Htaccess_Protection( $fresh_settings );
            $sh       = $fresh_settings->get_section( 'security_headers' );
            $needs_htaccess_block = ! empty( $all_options['modules']['firewall'] )
                || ! empty( $sh['hide_server_signature'] )
                || ! empty( $sh['remove_fingerprinting_headers'] );

            if ( $needs_htaccess_block ) {
                $htaccess->apply_rules();
            } else {
                $htaccess->remove_rules();
            }
        }

        // Regenerate the HTTP security headers (sent by PHP) for the headers section.
        if ( 'security_headers' === $section || 'modules' === $section ) {
            $security_headers = new Vigilante_Security_Headers( $fresh_settings );
            $headers_enabled = ! empty( $all_options['modules']['security_headers'] );

            if ( $headers_enabled ) {
                $security_headers->apply_rules();
            } else {
                $security_headers->remove_rules();
            }
        }

        // Regenerate wp-config for wp_hardening section
        if ( 'wp_hardening' === $section || 'modules' === $section ) {
            $wpconfig = new Vigilante_Wpconfig_Security( $fresh_settings );
            $hardening_enabled = ! empty( $all_options['modules']['wp_hardening'] );
            
            if ( $hardening_enabled ) {
                $wpconfig->apply_security_constants();
            } else {
                $wpconfig->remove_constants();
            }

            // Apply WordPress options for comments/pingbacks
            $hardening_options = $all_options['wp_hardening'] ?? array();

            if ( $hardening_enabled ) {
                // Pingbacks
                if ( ! empty( $hardening_options['disable_pingbacks'] ) ) {
                    update_option( 'default_pingback_flag', 0 );
                } else {
                    // Restore default: pingbacks enabled
                    update_option( 'default_pingback_flag', 1 );
                }

                // Trackbacks and ping status
                // Only close if either pingbacks OR trackbacks are disabled
                if ( ! empty( $hardening_options['disable_pingbacks'] ) || ! empty( $hardening_options['disable_trackbacks'] ) ) {
                    update_option( 'default_ping_status', 'closed' );
                } else {
                    // Restore default: pings open
                    update_option( 'default_ping_status', 'open' );
                }

                // Comment moderation
                if ( ! empty( $hardening_options['require_comment_moderation'] ) ) {
                    update_option( 'comment_moderation', 1 );
                } else {
                    // Restore default: no moderation required
                    update_option( 'comment_moderation', 0 );
                }
            }
        }

        // Trim activity log entries immediately when limits change
        if ( 'activity_log' === $section && $this->activity_log ) {
            $this->activity_log->cleanup_old_logs();
        }

        // Flush rewrite rules if login URL changed
        if ( 'login_security' === $section ) {
            $login_options = $all_options['login_security'] ?? array();
            if ( ! empty( $login_options['custom_login_url'] ) ) {
                delete_option( 'vigilante_login_rules_version' );
            }
        }

        // Log the settings change with readable section name
        if ( $this->activity_log ) {
            $section_names = array(
                'firewall'         => __( 'Firewall', 'vigilante' ),
                'login_security'   => __( 'Login Security', 'vigilante' ),
                'security_headers' => __( 'Security Headers', 'vigilante' ),
                'rest_api_security'=> __( 'REST API Security', 'vigilante' ),
                'user_security'    => __( 'User Security', 'vigilante' ),
                'wp_hardening'     => __( 'WP Hardening', 'vigilante' ),
                'activity_log'     => __( 'Security Audit', 'vigilante' ),
                'file_integrity'   => __( 'File Integrity', 'vigilante' ),
                'email'            => __( 'Notification Settings', 'vigilante' ),
                'backup'           => __( 'Backup', 'vigilante' ),
                'advanced'         => __( 'Advanced', 'vigilante' ),
                'modules'          => __( 'Modules', 'vigilante' ),
            );
            $display_name = isset( $section_names[ $section ] ) ? $section_names[ $section ] : $section;

            $this->activity_log->log(
                'settings',
                'settings_updated',
                sprintf(
                    /* translators: %s: Section name */
                    __( 'Settings updated: %s', 'vigilante' ),
                    $display_name
                ),
                array( 'section' => $section ),
                'info'
            );
        }
    }

    /**
     * Apply all file changes (htaccess, wp-config) based on current options
     *
     * Used after preset, import, or reset operations
     *
     * @param array $all_options All plugin options.
     */
    private function apply_all_file_changes( $all_options ) {
        // Refresh settings cache first
        $this->settings->clear_cache();

        // Create fresh settings instance
        $fresh_settings = new Vigilante_Settings();

        // Apply firewall htaccess changes
        $htaccess = new Vigilante_Htaccess_Protection( $fresh_settings );
        $firewall_enabled = ! empty( $all_options['modules']['firewall'] );
        
        if ( $firewall_enabled ) {
            $htaccess->apply_rules();
        } else {
            $htaccess->remove_rules();
        }

        // Apply security headers htaccess changes
        $security_headers = new Vigilante_Security_Headers( $fresh_settings );
        $headers_enabled = ! empty( $all_options['modules']['security_headers'] );
        
        if ( $headers_enabled ) {
            $security_headers->apply_rules();
        } else {
            $security_headers->remove_rules();
        }

        // Apply wp-config changes
        $wpconfig = new Vigilante_Wpconfig_Security( $fresh_settings );
        $hardening_enabled = ! empty( $all_options['modules']['wp_hardening'] );
        
        if ( $hardening_enabled ) {
            $wpconfig->apply_security_constants();
        } else {
            $wpconfig->remove_constants();
        }

        // Apply WordPress options for comments/pingbacks
        $hardening_options = $all_options['wp_hardening'] ?? array();

        if ( $hardening_enabled ) {
            // Pingbacks
            if ( ! empty( $hardening_options['disable_pingbacks'] ) ) {
                update_option( 'default_pingback_flag', 0 );
            } else {
                // Restore default: pingbacks enabled
                update_option( 'default_pingback_flag', 1 );
            }

            // Trackbacks and ping status
            // Only close if either pingbacks OR trackbacks are disabled
            if ( ! empty( $hardening_options['disable_pingbacks'] ) || ! empty( $hardening_options['disable_trackbacks'] ) ) {
                update_option( 'default_ping_status', 'closed' );
            } else {
                // Restore default: pings open
                update_option( 'default_ping_status', 'open' );
            }

            // Comment moderation
            if ( ! empty( $hardening_options['require_comment_moderation'] ) ) {
                update_option( 'comment_moderation', 1 );
            } else {
                // Restore default: no moderation required
                update_option( 'comment_moderation', 0 );
            }
        }

        // Log the change
        if ( $this->activity_log ) {
            $this->activity_log->log(
                'settings',
                'bulk_settings_applied',
                __( 'Bulk settings applied (preset/import/reset)', 'vigilante' ),
                array(),
                'info'
            );
        }
    }
}