<?php
/**
 * Admin Username check.
 *
 * @package advanced-analytics
 *
 * @since 4.9.0
 */

declare(strict_types=1);

namespace ADVAN\Checks\Security;

use ADVAN\Checks\Abstract_Check;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( 'ADVAN\Checks\Security\Admin_Username_Check' ) ) {

	/**
	 * Admin Username check class.
	 *
	 * @since 4.9.0
	 */
	class Admin_Username_Check extends Abstract_Check {

		/**
		 * Check identifier (slug).
		 *
		 * @var string Check identifier (slug).
		 *
		 * @since 4.9.0
		 */
		protected static string $id = 'admin-username';

		/**
		 * Check category.
		 *
		 * @var string Check category.
		 *
		 * @since 4.9.0
		 */
		protected static string $category = 'security';

		/**
		 * Check weight (1-10).
		 *
		 * @var int Check weight (1-10).
		 *
		 * @since 4.9.0
		 */
		protected static int $weight = 6;

		/**
		 * Check title (translatable).
		 *
		 * @return string Check title.
		 *
		 * @since 4.9.0
		 */
		public static function get_title(): string {
			return __( 'Admin Username', '0-day-analytics' );
		}

		/**
		 * Check description (translatable).
		 *
		 * @return string Check description.
		 *
		 * @since 4.9.0
		 */
		public static function get_description(): string {
			return __( 'Checks for commonly targeted administrator usernames.', '0-day-analytics' );
		}

		/**
		 * Run the check.
		 *
		 * @return array Check result.
		 *
		 * This check looks for administrator accounts with usernames that are commonly targeted by hackers, such as "admin" or "administrator". If any risky usernames are found, it fails the check and provides details on which accounts are at risk. If all administrator accounts have unique usernames, it passes the check.
		 *
		 * The check retrieves all users with the administrator role and compares their usernames against a list of commonly targeted usernames. It then compiles a list of any risky accounts found and includes this information in the check result details.
		 *
		 * The check emphasizes the importance of having unique administrator usernames to enhance the security of the WordPress site, as common usernames are often the first ones hackers attempt to use when trying to gain unauthorized access.
		 *
		 * If risky usernames are found, the check provides a recommendation to create a new administrator account with a unique username and to delete or demote the risky accounts, rather than just changing the display name.
		 *
		 * The check returns a high severity failure if risky usernames are found, and a pass if all administrator accounts have unique usernames.
		 *
		 * The details included in the check result provide the total count of administrator accounts and a list of any risky usernames that were found, which can help site owners understand the scope of the issue and take appropriate action to secure their site.
		 *
		 * Overall, this check is an important part of a comprehensive security assessment for a WordPress site, as it helps identify and mitigate a common vulnerability related to administrator account security.
		 *
		 * By ensuring that administrator accounts do not use commonly targeted usernames, site owners can significantly reduce the risk of unauthorized access and enhance the overall security of their WordPress site.
		 *
		 * It's important to note that while changing the display name of an administrator account can help obscure the identity of the account, it does not change the actual login username, which is what hackers target. Therefore, creating a new administrator account with a unique username and removing or demoting risky accounts is the recommended approach to improve security.
		 *
		 * This check is a proactive measure to help site owners identify and address potential security weaknesses related to administrator account usernames, which can be a critical aspect of maintaining a secure WordPress environment.
		 *
		 * In summary, the Admin Username check is designed to identify administrator accounts with commonly targeted usernames and provide actionable recommendations to enhance the security of the WordPress site by encouraging the use of unique administrator usernames.
		 *
		 * The check contributes to the overall security posture of the site by addressing a common vulnerability that can be easily mitigated with proper account management practices.
		 *
		 * By following the recommendations provided by this check, site owners can significantly reduce the risk of unauthorized access to their WordPress site and protect their data and users from potential security breaches.
		 *
		 * It's important for site owners to regularly review their administrator accounts and ensure that they are following best practices for account security, including using unique usernames and strong passwords, to maintain a secure WordPress environment.
		 *
		 * Overall, the Admin Username check is a valuable tool for site owners to identify and address a common security vulnerability related to administrator account usernames, and it provides clear guidance on how to improve the security of their WordPress site by using unique administrator usernames.
		 *
		 * By implementing the recommendations from this check, site owners can enhance the security of their WordPress site and reduce the likelihood of unauthorized access through commonly targeted administrator usernames.
		 *
		 * In conclusion, the Admin Username check is an essential part of a comprehensive security assessment for WordPress sites, as it helps identify and mitigate a common vulnerability related to administrator account usernames, ultimately contributing to a more secure WordPress environment.
		 *
		 * By ensuring that administrator accounts do not use commonly targeted usernames, site owners can significantly enhance the security of their WordPress site and protect it from potential unauthorized access and security breaches.
		 *
		 * It's crucial for site owners to take the findings of this check seriously and take appropriate action to secure their administrator accounts, as these accounts have the highest level of access and control over the WordPress site, making them a prime target for hackers.
		 *
		 * By following the recommendations provided by this check, site owners can significantly reduce the risk of unauthorized access to their WordPress site and enhance the overall security of their online presence.
		 *
		 * In summary, the Admin Username check is a critical component of a comprehensive security strategy for WordPress sites, as it helps identify and address a common vulnerability related to administrator account usernames, ultimately contributing to a more secure WordPress environment and protecting the site from potential security threats.
		 *
		 * By ensuring that administrator accounts use unique usernames that are not commonly targeted by hackers, site owners can significantly enhance the security of their WordPress site and reduce the risk of unauthorized access through brute force attacks or other hacking attempts that target common administrator usernames.
		 *
		 * @since 4.9.0
		 */
		public static function run(): array {
			// Common usernames that hackers try first.
			$risky_usernames = array( 'admin', 'administrator', 'root', 'user', 'test', 'wordpress', 'demo' );

			// Get administrators.
			$admins = get_users(
				array(
					'role'   => 'administrator',
					'fields' => array( 'ID', 'user_login' ),
				)
			);

			$found_risky = array();

			foreach ( $admins as $admin ) {
				if ( in_array( strtolower( $admin->user_login ), $risky_usernames, true ) ) {
					$found_risky[] = $admin->user_login;
				}
			}

			$details = array(
				'admin_count'    => count( $admins ),
				'risky_accounts' => $found_risky,
			);

			if ( ! empty( $found_risky ) ) {
				$usernames = implode( ', ', $found_risky );

				return static::fail(
					'high',
					sprintf(
					/* translators: %s: list of usernames */
						__( 'You have administrator accounts with commonly targeted usernames: %s. These are the first usernames hackers try when attempting to break into WordPress sites.', '0-day-analytics' ),
						$usernames
					),
					__( 'Create a new administrator account with a unique username, then log in with it and delete or demote the risky accounts. Don\'t just change the display name - the login username is what matters.', '0-day-analytics' ),
					$details
				);
			}

			return static::pass(
				__( 'Your administrator accounts use unique usernames that aren\'t commonly targeted by hackers.', '0-day-analytics' ),
				$details
			);
		}
	}
}