steve/wp-healthcheck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 3 v1: autocheck framework + six step automations

Browse Source 
Infrastructure:
- WPH_Step::autocheck($session_state) returns an array of findings
  shaped {id, level: ok/warn/bad/info, label, value, detail}.
- WPH_Session stores results keyed by step id (persisted in the option-
  backed session).
- WPH_Step::has_autocheck() reflection check so the UI only renders the
  panel for steps that implement automation.
- 'Run checks' / 'Refresh' button per step, admin-post handler runs
  autocheck() and stashes the result on the session.
- Findings rendered as a coloured table on the step card; included
  verbatim in the Markdown report with status icons.

Step automations implemented:
- Step 1 (Backup): detection of 11 known backup plugins by slug;
  active/inactive state; UpdraftPlus last-backup timestamp.
- Step 2 (Environment): PHP version + EOL, WP version vs latest, disk
  usage, wp-config flags, file perms on wp-config/wp-content/uploads,
  error-log sizes.
- Step 4 (Plugins): WP.org API enrichment with 24h transient cache —
  last_updated, active_installs, abandonment flag, removed-from-repo
  flag, update-available count. Summary line at the top.
- Step 8 (Security): SSL cert expiry via stream_socket_client +
  openssl_x509_parse, administrator audit, xmlrpc reachability, login
  URL hardening detection.
- Step 9 (Database): spam comments, post revisions, autoload size (WP
  6.6+ value handling), top 3 largest tables.
- Step 11 (Small fixes): deactivated-but-installed plugin list,
  homepage alt-text scan.

Smoke-tested on testsite — all six steps return findings with
correctly-classified levels. Report regenerated with automated findings
section.
This commit is contained in:
Steve Hanlon
2026-06-11 16:02:34 +01:00
parent 8de7cad0de
commit 0d51fc3b59
11 changed files with 646 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
includes/steps/80-security.php
View File

@@ -14,4 +14,111 @@ return new class extends WPH_Step {
'Check that xmlrpc.php is disabled or restricted if not in use',
];
}
public function autocheck(array $session_state): array {
$f = [];
// SSL cert expiry — only meaningful for https sites
$host = parse_url(get_site_url(), PHP_URL_HOST);
$scheme = parse_url(get_site_url(), PHP_URL_SCHEME);
if ($scheme === 'https' && $host) {
$cert = $this->fetch_cert($host);
if (is_array($cert) && !empty($cert['validTo_time_t'])) {
$expires = (int) $cert['validTo_time_t'];
$days = floor(($expires - time()) / DAY_IN_SECONDS);
$level = $days < 0 ? 'bad' : ($days < 30 ? 'warn' : 'ok');
$f[] = $this->finding(
'ssl_expiry',
$level,
'SSL certificate',
date('Y-m-d', $expires),
$days < 0 ? abs($days) . ' day(s) EXPIRED' : 'expires in ' . $days . ' day(s)' . (isset($cert['issuer']['O']) ? ' · issuer: ' . $cert['issuer']['O'] : '')
);
} else {
$f[] = $this->finding('ssl_expiry', 'warn', 'SSL certificate', 'could not fetch', 'TLS handshake to ' . $host . ':443 failed; check manually.');
}
} else {
$f[] = $this->finding('ssl_expiry', 'bad', 'SSL', 'not HTTPS', 'Site URL is not https — install/configure a certificate.');
}
// Administrator audit
$admins = get_users(['role' => 'administrator', 'number' => 50]);
$f[] = $this->finding(
'admin_count',
count($admins) > 5 ? 'warn' : 'ok',
'Administrator accounts',
(string) count($admins),
count($admins) > 5 ? 'More than 5 administrators — review whether all are necessary.' : ''
);
foreach ($admins as $u) {
$last_login = get_user_meta($u->ID, 'last_login', true); // if a plugin tracks it
$f[] = $this->finding(
'admin_' . $u->ID,
'info',
'admin: ' . $u->user_login,
$u->user_email,
'Registered ' . $u->user_registered . ($last_login ? ' · last login ' . $last_login : '')
);
}
// xmlrpc.php reachability
$xmlrpc_url = trailingslashit(get_site_url()) . 'xmlrpc.php';
$resp = wp_remote_post($xmlrpc_url, [
'timeout' => 5,
'headers' => ['Content-Type' => 'text/xml'],
'body' => '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>',
]);
if (is_wp_error($resp)) {
$f[] = $this->finding('xmlrpc', 'ok', 'xmlrpc.php', 'unreachable', $resp->get_error_message());
} else {
$code = wp_remote_retrieve_response_code($resp);
$body = (string) wp_remote_retrieve_body($resp);
$is_open = ($code === 200 && (strpos($body, '<methodResponse>') !== false));
$f[] = $this->finding(
'xmlrpc',
$is_open ? 'warn' : 'ok',
'xmlrpc.php',
$is_open ? 'open (responds to system.listMethods)' : 'restricted/disabled (' . $code . ')',
$is_open ? 'If not in use, consider disabling — common brute-force/DDoS target.' : ''
);
}
// Login URL — detect known "hide login" plugins
$hide_login_plugins = [
'wps-hide-login/wps-hide-login.php' => 'WPS Hide Login',
'rename-wp-login/rename-wp-login.php' => 'Rename wp-login.php',
];
$hidden = false;
foreach ($hide_login_plugins as $file => $label) {
if (is_plugin_active($file)) { $hidden = $label; break; }
}
$f[] = $this->finding(
'login_url',
$hidden ? 'ok' : 'info',
'Login URL hardening',
$hidden ? 'custom (' . $hidden . ')' : 'default (/wp-admin, /wp-login.php)',
$hidden ? '' : 'Not necessarily a problem — confirm with client whether hardening was previously applied.'
);
return $f;
}
private function fetch_cert(string $host) {
$ctx = stream_context_create([
'ssl' => [
'capture_peer_cert' => true,
'verify_peer' => false,
'verify_peer_name' => false,
'SNI_enabled' => true,
'peer_name' => $host,
],
]);
$errno = 0; $errstr = '';
$sock = @stream_socket_client('ssl://' . $host . ':443', $errno, $errstr, 5, STREAM_CLIENT_CONNECT, $ctx);
if (!$sock) return null;
$params = stream_context_get_params($sock);
fclose($sock);
$cert = $params['options']['ssl']['peer_certificate'] ?? null;
return $cert ? openssl_x509_parse($cert) : null;
}
};