fetch_cert($host);
if (is_array($cert) && !empty($cert['validTo_time_t'])) {
$expires = (int) $cert['validTo_time_t'];
$days = floor(($expires - time()) / DAY_IN_SECONDS);
$level = $days < 0 ? 'bad' : ($days < 30 ? 'warn' : 'ok');
$f[] = $this->finding(
'ssl_expiry',
$level,
'SSL certificate',
date('Y-m-d', $expires),
$days < 0 ? abs($days) . ' day(s) EXPIRED' : 'expires in ' . $days . ' day(s)' . (isset($cert['issuer']['O']) ? ' · issuer: ' . $cert['issuer']['O'] : '')
);
} else {
$f[] = $this->finding('ssl_expiry', 'warn', 'SSL certificate', 'could not fetch', 'TLS handshake to ' . $host . ':443 failed; check manually.');
}
} else {
$f[] = $this->finding('ssl_expiry', 'bad', 'SSL', 'not HTTPS', 'Site URL is not https — install/configure a certificate.');
}
// Administrator audit
$admins = get_users(['role' => 'administrator', 'number' => 50]);
$f[] = $this->finding(
'admin_count',
count($admins) > 5 ? 'warn' : 'ok',
'Administrator accounts',
(string) count($admins),
count($admins) > 5 ? 'More than 5 administrators — review whether all are necessary.' : ''
);
foreach ($admins as $u) {
$last_login = get_user_meta($u->ID, 'last_login', true); // if a plugin tracks it
$f[] = $this->finding(
'admin_' . $u->ID,
'info',
'admin: ' . $u->user_login,
$u->user_email,
'Registered ' . $u->user_registered . ($last_login ? ' · last login ' . $last_login : '')
);
}
// xmlrpc.php reachability
$xmlrpc_url = trailingslashit(get_site_url()) . 'xmlrpc.php';
$resp = wp_remote_post($xmlrpc_url, [
'timeout' => 5,
'headers' => ['Content-Type' => 'text/xml'],
'body' => 'system.listMethods',
]);
if (is_wp_error($resp)) {
$f[] = $this->finding('xmlrpc', 'ok', 'xmlrpc.php', 'unreachable', $resp->get_error_message());
} else {
$code = wp_remote_retrieve_response_code($resp);
$body = (string) wp_remote_retrieve_body($resp);
$is_open = ($code === 200 && (strpos($body, '') !== false));
$f[] = $this->finding(
'xmlrpc',
$is_open ? 'warn' : 'ok',
'xmlrpc.php',
$is_open ? 'open (responds to system.listMethods)' : 'restricted/disabled (' . $code . ')',
$is_open ? 'If not in use, consider disabling — common brute-force/DDoS target.' : ''
);
}
// Login URL — detect known "hide login" plugins
$hide_login_plugins = [
'wps-hide-login/wps-hide-login.php' => 'WPS Hide Login',
'rename-wp-login/rename-wp-login.php' => 'Rename wp-login.php',
];
$hidden = false;
foreach ($hide_login_plugins as $file => $label) {
if (is_plugin_active($file)) { $hidden = $label; break; }
}
$f[] = $this->finding(
'login_url',
$hidden ? 'ok' : 'info',
'Login URL hardening',
$hidden ? 'custom (' . $hidden . ')' : 'default (/wp-admin, /wp-login.php)',
$hidden ? '' : 'Not necessarily a problem — confirm with client whether hardening was previously applied.'
);
return $f;
}
private function fetch_cert(string $host) {
$ctx = stream_context_create([
'ssl' => [
'capture_peer_cert' => true,
'verify_peer' => false,
'verify_peer_name' => false,
'SNI_enabled' => true,
'peer_name' => $host,
],
]);
$errno = 0; $errstr = '';
$sock = @stream_socket_client('ssl://' . $host . ':443', $errno, $errstr, 5, STREAM_CLIENT_CONNECT, $ctx);
if (!$sock) return null;
$params = stream_context_get_params($sock);
fclose($sock);
$cert = $params['options']['ssl']['peer_certificate'] ?? null;
return $cert ? openssl_x509_parse($cert) : null;
}
};