wp-healthcheck/includes/steps/40-plugins.php

<?php
if (!defined('ABSPATH')) exit;

return new class extends WPH_Step {
    public function id(): string { return 'plugins'; }
    public function title(): string { return 'Step 4 — Plugin Updates'; }
    public function sub_items(): array {
        return [
            'Go to Dashboard → Updates and review all pending plugin updates',
            'Before updating, note which plugins have updates and what versions they are moving to',
            'Update plugins one at a time if the site is complex or has many interdependencies; batch update is acceptable for straightforward sites',
            'After each update (or after a batch), check the front-end and any key functional areas (forms, checkout, membership, etc.)',
            'Check for any plugins that have been deactivated but not deleted — flag these to the client',
        ];
    }
    public function watch_outs(): array {
        return [
            'WooCommerce updates — always treat these as high-risk, test checkout flow afterwards',
            'Page builder updates (Elementor, Divi, Beaver Builder) — can affect layout rendering',
            'Security plugin updates — confirm they reactivate and are still reporting clean',
            'Plugins that haven\'t been updated by their developer in over 12 months — flag as a risk',
            'Plugins showing "Update unavailable" or removed from the WordPress repository — flag immediately, these can indicate abandoned or compromised plugins',
        ];
    }

    public function autocheck(array $session_state): array {
        if (!function_exists('get_plugins')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
        $plugins = get_plugins();
        $f = [];
        $abandoned = 0;
        $removed = 0;
        $update_avail = 0;

        // Refresh update transient (no-op if recent)
        if (function_exists('wp_update_plugins')) wp_update_plugins();
        $updates = get_site_transient('update_plugins');
        $update_map = isset($updates->response) && is_array($updates->response) ? $updates->response : [];

        foreach ($plugins as $file => $meta) {
            $slug = dirname($file);
            if ($slug === '.' || $slug === '') $slug = basename($file, '.php');
            $info = $this->wp_org_info($slug);
            $detail_parts = [];
            $level = 'ok';

            if ($info === 'not_in_repo') {
                $level = 'warn';
                $detail_parts[] = 'Not in WP.org repo (could be premium, custom, or removed)';
                $removed++;
            } elseif ($info === 'removed') {
                $level = 'bad';
                $detail_parts[] = '⚠ Removed from WP.org repo — possible abandonment or compromise';
                $removed++;
            } elseif (is_array($info)) {
                if (!empty($info['last_updated'])) {
                    $age_days = floor((time() - strtotime($info['last_updated'])) / DAY_IN_SECONDS);
                    $detail_parts[] = 'Last release ' . $age_days . ' day(s) ago (' . $info['last_updated'] . ')';
                    if ($age_days > 365) {
                        $level = 'warn';
                        $abandoned++;
                        $detail_parts[] = 'no release in >12 months';
                    }
                }
                if (!empty($info['active_installs'])) {
                    $detail_parts[] = number_format($info['active_installs']) . ' active installs';
                }
            }

            if (isset($update_map[$file])) {
                $level = 'warn';
                $detail_parts[] = 'Update available → ' . ($update_map[$file]->new_version ?? '?');
                $update_avail++;
            }

            $f[] = $this->finding(
                'plugin_' . sanitize_key($file),
                $level,
                $meta['Name'] ?? $file,
                (string) ($meta['Version'] ?? ''),
                implode(' · ', $detail_parts)
            );
        }

        // Summary at the top
        array_unshift($f, $this->finding(
            'summary', 'info',
            'Summary',
            count($plugins) . ' plugins',
            $update_avail . ' with updates · ' . $abandoned . ' not updated in 12 mo · ' . $removed . ' not in WP.org'
        ));

        return $f;
    }

    /**
     * Returns ['name' => ..., 'last_updated' => ..., 'active_installs' => ...]
     * or 'not_in_repo' / 'removed' on failure. Cached 24h per slug via transient.
     */
    private function wp_org_info(string $slug) {
        $cache_key = 'wph_pi_' . md5($slug);
        $cached = get_transient($cache_key);
        if ($cached !== false) return $cached;

        $url = 'https://api.wordpress.org/plugins/info/1.0/' . rawurlencode($slug) . '.json';
        $resp = wp_remote_get($url, ['timeout' => 4]);
        if (is_wp_error($resp)) {
            set_transient($cache_key, 'not_in_repo', HOUR_IN_SECONDS);
            return 'not_in_repo';
        }
        $code = wp_remote_retrieve_response_code($resp);
        $body = wp_remote_retrieve_body($resp);
        if ($code === 404) {
            set_transient($cache_key, 'not_in_repo', DAY_IN_SECONDS);
            return 'not_in_repo';
        }
        $data = json_decode((string) $body, true);
        if (!is_array($data)) {
            set_transient($cache_key, 'not_in_repo', HOUR_IN_SECONDS);
            return 'not_in_repo';
        }
        if (isset($data['error'])) {
            set_transient($cache_key, 'removed', DAY_IN_SECONDS);
            return 'removed';
        }
        $out = [
            'name'            => $data['name'] ?? $slug,
            'last_updated'    => $data['last_updated'] ?? null,
            'active_installs' => $data['active_installs'] ?? null,
        ];
        set_transient($cache_key, $out, DAY_IN_SECONDS);
        return $out;
    }
};