<?php
/**
 * Login URL check.
 *
 * @package advanced-analytics
 *
 * @since 4.9.0
 */

declare(strict_types=1);

namespace ADVAN\Checks\Security;

use ADVAN\Checks\Abstract_Check;
use ADVAN\Helpers\Plugin_Theme_Helper;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( 'ADVAN\Checks\Security\Login_URL_Check' ) ) {
	/**
	 * Login URL check class.
	 *
	 * @since 4.9.0
	 */
	class Login_URL_Check extends Abstract_Check {

		/**
		 * Check identifier (slug).
		 *
		 * @var string Check identifier (slug).
		 *
		 * @since 4.9.0
		 */
		protected static string $id = 'login-url';

		/**
		 * Check category.
		 *
		 * @var string Check category.
		 *
		 * @since 4.9.0
		 */
		protected static string $category = 'security';

		/**
		 * Check weight (1-10).
		 *
		 * @var int Check weight (1-10).
		 *
		 * @since 4.9.0
		 */
		protected static int $weight = 3;

		/**
		 * Check title (translatable).
		 *
		 * @return string Check title.
		 *
		 * @since 4.9.0
		 */
		public static function get_title(): string {
			return __( 'Login URL', '0-day-analytics' );
		}

		/**
		 * Check description (translatable).
		 *
		 * @return string Check description.
		 *
		 * @since 4.9.0
		 */
		public static function get_description(): string {
			return __( 'Checks if the login page uses the default URL.', '0-day-analytics' );
		}

		/**
		 * Run the check.
		 *
		 * @return array Check result.
		 *
		 * This check looks at the login URL and determines if it is the default wp-login.php or if a security plugin is installed that can protect the login page. It provides recommendations based on the findings.
		 *
		 * Details collected include the actual login URL and whether a known security plugin is active. The check returns a warning if the default login URL is in use without a security plugin, and a pass if either a security plugin is found or a custom login URL is detected.
		 *
		 * This check is important because the default login URL is a common target for brute force attacks, and using a custom login URL or a security plugin can help mitigate this risk.
		 *
		 * Note: This check does not attempt to detect custom login URLs that are not using the default wp-login.php path, so it may not catch all cases of custom login URLs. It focuses on the presence of the default URL and common security plugins.
		 *
		 * The check does not fail if the default login URL is detected, but it does provide a warning to encourage users to take action to protect their login page.
		 *
		 * The check emphasizes the importance of securing the login page to prevent unauthorized access and reduce the risk of brute force attacks, which can compromise the security of the WordPress site.
		 *
		 * The check provides actionable recommendations to improve login security, such as installing a security plugin or changing the login URL.
		 *
		 * Overall, this check is a valuable part of a comprehensive security assessment for a WordPress site, as it helps identify potential vulnerabilities related to the login page and encourages best practices for securing access to the site.
		 *
		 * By addressing the findings of this check, site owners can enhance the security of their WordPress site and reduce the likelihood of successful brute force attacks on their login page.
		 *
		 * It's important to note that while changing the login URL can help obscure the login page from automated attacks, it should be done in conjunction with other security measures, such as using strong passwords and enabling two-factor authentication, for optimal protection.
		 *
		 * If a security plugin is detected, the check assumes that the login page is protected, but it does not verify the specific configuration of the plugin. Site owners should ensure that their security plugin is properly configured to protect the login page effectively.
		 *
		 * @since 4.9.0
		 */
		public static function run(): array {
			$login_url    = \wp_login_url();
			$default_path = '/wp-login.php';

			$details = array(
				'is_default_login_url' => ( \wp_login_url() === \site_url( 'wp-login.php', 'login' ) ),
			);

			// Check if using default login URL.
			$is_default = ( strpos( $login_url, $default_path ) !== false );

			// Check for common login protection plugins.
			$protection_plugins = array(
				'wps-hide-login/wps-hide-login.php',
				'rename-wp-login/rename-wp-login.php',
				'lockdown-wp-admin/lockdown-wp-admin.php',
				'all-in-one-wp-security-and-firewall/wp-security.php',
				'wordfence/wordfence.php',
				'ithemes-security-pro/ithemes-security-pro.php',
				'better-wp-security/better-wp-security.php',
			);

			$has_protection = false;
			foreach ( $protection_plugins as $plugin ) {
				if ( Plugin_Theme_Helper::is_plugin_active( $plugin ) ) {
					$has_protection = true;
					break;
				}
			}

			$details['has_security_plugin'] = $has_protection;

			if ( $has_protection ) {
				return static::pass(
					__( 'You have a security plugin installed that can protect your login page from brute force attacks.', '0-day-analytics' ),
					$details
				);
			}

			if ( $is_default ) {
				return static::warning(
					__( 'Your login page uses the default WordPress URL (wp-login.php). Bots constantly scan for this URL to attempt login attacks.', '0-day-analytics' ),
					__( 'Consider installing a security plugin like Wordfence or WPS Hide Login to add brute force protection or change your login URL.', '0-day-analytics' ),
					$details
				);
			}

			return static::pass(
				__( 'Your login page appears to use a custom URL, which adds a layer of protection against automated attacks.', '0-day-analytics' ),
				$details
			);
		}
	}
}