wp-healthcheck/includes/steps/80-security.php

<?php
if (!defined('ABSPATH')) exit;

return new class extends WPH_Step {
    public function id(): string { return 'security'; }
    public function title(): string { return 'Step 8 — Security Check'; }
    public function sub_items(): array {
        return [
            'Confirm the SSL certificate is valid and not expiring within 30 days — flag if so',
            'Check the WordPress user list — flag any unfamiliar admin accounts',
            'Check for any recently modified core files if you have file change monitoring in place',
            'Confirm the login URL is not the default /wp-admin if security hardening was previously applied',
            'If a security plugin is active, review its dashboard for any flagged issues',
            'Check that xmlrpc.php is disabled or restricted if not in use',
        ];
    }

    public function autocheck(array $session_state): array {
        $f = [];

        // SSL cert expiry — only meaningful for https sites
        $host = parse_url(get_site_url(), PHP_URL_HOST);
        $scheme = parse_url(get_site_url(), PHP_URL_SCHEME);
        if ($scheme === 'https' && $host) {
            $cert = $this->fetch_cert($host);
            if (is_array($cert) && !empty($cert['validTo_time_t'])) {
                $expires = (int) $cert['validTo_time_t'];
                $days = floor(($expires - time()) / DAY_IN_SECONDS);
                $level = $days < 0 ? 'bad' : ($days < 30 ? 'warn' : 'ok');
                $f[] = $this->finding(
                    'ssl_expiry',
                    $level,
                    'SSL certificate',
                    date('Y-m-d', $expires),
                    $days < 0 ? abs($days) . ' day(s) EXPIRED' : 'expires in ' . $days . ' day(s)' . (isset($cert['issuer']['O']) ? ' · issuer: ' . $cert['issuer']['O'] : '')
                );
            } else {
                $f[] = $this->finding('ssl_expiry', 'warn', 'SSL certificate', 'could not fetch', 'TLS handshake to ' . $host . ':443 failed; check manually.');
            }
        } else {
            $f[] = $this->finding('ssl_expiry', 'bad', 'SSL', 'not HTTPS', 'Site URL is not https — install/configure a certificate.');
        }

        // Administrator audit
        $admins = get_users(['role' => 'administrator', 'number' => 50]);
        $f[] = $this->finding(
            'admin_count',
            count($admins) > 5 ? 'warn' : 'ok',
            'Administrator accounts',
            (string) count($admins),
            count($admins) > 5 ? 'More than 5 administrators — review whether all are necessary.' : ''
        );
        foreach ($admins as $u) {
            $last_login = get_user_meta($u->ID, 'last_login', true); // if a plugin tracks it
            $f[] = $this->finding(
                'admin_' . $u->ID,
                'info',
                'admin: ' . $u->user_login,
                $u->user_email,
                'Registered ' . $u->user_registered . ($last_login ? ' · last login ' . $last_login : '')
            );
        }

        // xmlrpc.php reachability
        $xmlrpc_url = trailingslashit(get_site_url()) . 'xmlrpc.php';
        $resp = wp_remote_post($xmlrpc_url, [
            'timeout' => 5,
            'headers' => ['Content-Type' => 'text/xml'],
            'body'    => '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>',
        ]);
        if (is_wp_error($resp)) {
            $f[] = $this->finding('xmlrpc', 'ok', 'xmlrpc.php', 'unreachable', $resp->get_error_message());
        } else {
            $code = wp_remote_retrieve_response_code($resp);
            $body = (string) wp_remote_retrieve_body($resp);
            $is_open = ($code === 200 && (strpos($body, '<methodResponse>') !== false));
            $f[] = $this->finding(
                'xmlrpc',
                $is_open ? 'warn' : 'ok',
                'xmlrpc.php',
                $is_open ? 'open (responds to system.listMethods)' : 'restricted/disabled (' . $code . ')',
                $is_open ? 'If not in use, consider disabling — common brute-force/DDoS target.' : ''
            );
        }

        // Login URL — detect known "hide login" plugins
        $hide_login_plugins = [
            'wps-hide-login/wps-hide-login.php' => 'WPS Hide Login',
            'rename-wp-login/rename-wp-login.php' => 'Rename wp-login.php',
        ];
        $hidden = false;
        foreach ($hide_login_plugins as $file => $label) {
            if (is_plugin_active($file)) { $hidden = $label; break; }
        }
        $f[] = $this->finding(
            'login_url',
            $hidden ? 'ok' : 'info',
            'Login URL hardening',
            $hidden ? 'custom (' . $hidden . ')' : 'default (/wp-admin, /wp-login.php)',
            $hidden ? '' : 'Not necessarily a problem — confirm with client whether hardening was previously applied.'
        );

        return $f;
    }

    private function fetch_cert(string $host) {
        $ctx = stream_context_create([
            'ssl' => [
                'capture_peer_cert' => true,
                'verify_peer'       => false,
                'verify_peer_name'  => false,
                'SNI_enabled'       => true,
                'peer_name'         => $host,
            ],
        ]);
        $errno = 0; $errstr = '';
        $sock = @stream_socket_client('ssl://' . $host . ':443', $errno, $errstr, 5, STREAM_CLIENT_CONNECT, $ctx);
        if (!$sock) return null;
        $params = stream_context_get_params($sock);
        fclose($sock);
        $cert = $params['options']['ssl']['peer_certificate'] ?? null;
        return $cert ? openssl_x509_parse($cert) : null;
    }
};