Changeset 3682123

Timestamp:

09/05/2026 05:52:11 AM (7 weeks ago)

Author:

gopalbogati

Message:

Release 1.4.0: guided security dashboard, bounded file checks, saved reports, clearer listing and refreshed assets

Location:

site-security-auditor

Files:

• assets/banner-1544x500.png (added)
• assets/banner-772x250.png (modified) ( previous)
• assets/icon-128x128.png (added)
• assets/icon-256x256.png (modified) ( previous)
• assets/screenshot-1.png (added)
• assets/screenshot-2.png (added)
• assets/screenshot-3.png (added)
• tags/1.4.0 (copied) (copied from site-security-auditor/trunk )
• tags/1.4.0/assets (added)
• tags/1.4.0/assets/admin.css (added)
• tags/1.4.0/assets/icon.png (added)
• tags/1.4.0/includes (added)
• tags/1.4.0/includes/class-scanner.php (added)
• tags/1.4.0/includes/dashboard.php (added)
• tags/1.4.0/languages/site-security-auditor.pot (modified) (1 diff)
• tags/1.4.0/readme.txt (modified) (1 diff)
• tags/1.4.0/site-security-auditor.php (modified) (1 diff)
• trunk/assets (added)
• trunk/assets/admin.css (added)
• trunk/assets/icon.png (added)
• trunk/includes (added)
• trunk/includes/class-scanner.php (added)
• trunk/includes/dashboard.php (added)
• trunk/languages/site-security-auditor.pot (modified) (1 diff)
• trunk/readme.txt (modified) (1 diff)
• trunk/site-security-auditor.php (modified) (1 diff)

site-security-auditor/tags/1.4.0/languages/site-security-auditor.pot

@@ -1 @@
-# POT placeholder
+# Copyright (C) 2026 Gopal Bogati
+# This file is distributed under the GPL-2.0-or-later.
+msgid ""
+msgstr ""
+"Project-Id-Version: Site Security Auditor 1.4.0\n"
+"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/trunk\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"POT-Creation-Date: 2026-09-05T05:49:37+00:00\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"X-Generator: WP-CLI 2.12.0\n"
+"X-Domain: site-security-auditor\n"
+
+#. Plugin Name of the plugin
+#: site-security-auditor.php
+msgid "Site Security Auditor"
+msgstr ""
+
+#. Description of the plugin
+#: site-security-auditor.php
+msgid "Review plugin updates, compare plugin and theme files, and follow a clear WordPress security checklist."
+msgstr ""
+
+#. Author of the plugin
+#: site-security-auditor.php
+msgid "Gopal Bogati"
+msgstr ""
+
+#. Author URI of the plugin
+#: site-security-auditor.php
+msgid "https://profiles.wordpress.org/gopalbogati/"
+msgstr ""
+
+#: includes/dashboard.php:8
+msgid "SITE SECURITY AUDITOR"
+msgstr ""
+
+#: includes/dashboard.php:9
+msgid "Your security review"
+msgstr ""
+
+#: includes/dashboard.php:10
+msgid "Know what changed. Understand your next step."
+msgstr ""
+
+#: includes/dashboard.php:13
+msgid "Plugin updates available"
+msgstr ""
+
+#: includes/dashboard.php:13
+msgid "Review plugin information"
+msgstr ""
+
+#: includes/dashboard.php:14
+msgid "Settings to review"
+msgstr ""
+
+#: includes/dashboard.php:14
+msgid "Open your checklist"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "File comparison"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "Baseline ready"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "Set up first"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "Review files"
+msgstr ""
+
+#: includes/dashboard.php:17
+msgid "These checks reduce guesswork, not all security risks. This is not a malware scanner, firewall, or vulnerability database."
+msgstr ""
+
+#: includes/dashboard.php:19
+msgid "1. Check for file changes"
+msgstr ""
+
+#: includes/dashboard.php:20
+msgid "A baseline is a snapshot of files you trust. Compare against it after maintenance or whenever you want to investigate unexpected changes."
+msgstr ""
+
+#: includes/dashboard.php:22
+msgid "Back up your site and confirm its files are trustworthy."
+msgstr ""
+
+#: includes/dashboard.php:23
+msgid "Save a baseline, then run a comparison when you return."
+msgstr ""
+
+#: includes/dashboard.php:24
+msgid "Review changes with your update history or developer before replacing the baseline."
+msgstr ""
+
+#: includes/dashboard.php:27
+msgid "Baseline saved:"
+msgstr ""
+
+#: includes/dashboard.php:29
+msgid "Compare files now"
+msgstr ""
+
+#: includes/dashboard.php:31
+msgid "Replace the trusted baseline"
+msgstr ""
+
+#: includes/dashboard.php:31
+msgid "Create your first baseline"
+msgstr ""
+
+#: includes/dashboard.php:32
+msgid "Saving a snapshot does not prove that files are clean. Replacing it accepts all current changes as your new reference."
+msgstr ""
+
+#: includes/dashboard.php:33
+msgid "Save trusted baseline"
+msgstr ""
+
+#: includes/dashboard.php:36
+#: includes/dashboard.php:37
+msgid "Latest file report"
+msgstr ""
+
+#. translators: %d: number of files read.
+#: includes/dashboard.php:39
+#, php-format
+msgid "%d files read"
+msgstr ""
+
+#: includes/dashboard.php:41
+msgid "Incomplete — no comparison or baseline replacement was made."
+msgstr ""
+
+#: includes/dashboard.php:42
+msgid "Finish any updates, check file permissions with your host, and retry. Large sites may need a host-level integrity tool."
+msgstr ""
+
+#: includes/dashboard.php:45
+msgid "Baseline saved. Your next comparison will use this snapshot."
+msgstr ""
+
+#: includes/dashboard.php:47
+msgid "Changes are not necessarily malicious: updates and intentional edits also change files. No changes does not guarantee a secure site."
+msgstr ""
+
+#: includes/dashboard.php:48
+msgid "Added"
+msgstr ""
+
+#: includes/dashboard.php:48
+msgid "Modified"
+msgstr ""
+
+#: includes/dashboard.php:48
+msgid "Removed"
+msgstr ""
+
+#: includes/dashboard.php:53
+msgid "Showing the first 100 paths. Download the full report below."
+msgstr ""
+
+#: includes/dashboard.php:57
+msgid "Download file report (JSON)"
+msgstr ""
+
+#: includes/dashboard.php:58
+msgid "The download includes relative file paths. Share only with people you trust."
+msgstr ""
+
+#: includes/dashboard.php:61
+msgid "What is included in a scan?"
+msgstr ""
+
+#: includes/dashboard.php:62
+msgid "Plugin and registered theme directories: PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and make a scan incomplete."
+msgstr ""
+
+#: includes/dashboard.php:63
+msgid "Limits: 20,000 directory entries, 100 MiB total, 8 MiB per file and an approximately 8-second processing budget. An incomplete scan never replaces your baseline. Files should not be edited while a scan runs."
+msgstr ""
+
+#: includes/dashboard.php:64
+msgid "Your older baseline excludes JS and CSS. Comparisons keep that scope until you save a new trusted baseline."
+msgstr ""
+
+#: includes/dashboard.php:68
+msgid "2. Review your plugins"
+msgstr ""
+
+#: includes/dashboard.php:69
+msgid "Uses the update information already stored by WordPress. Unknown means information is missing or more than two days old; premium plugins may use their own update systems."
+msgstr ""
+
+#: includes/dashboard.php:70
+msgid "Open WordPress Updates"
+msgstr ""
+
+#: includes/dashboard.php:71
+msgid "Manage plugins"
+msgstr ""
+
+#: includes/dashboard.php:72
+msgid "Plugin maintenance table"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Plugin"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Status"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Update information"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Next step"
+msgstr ""
+
+#: includes/dashboard.php:78
+msgid "Active"
+msgstr ""
+
+#: includes/dashboard.php:78
+msgid "Inactive"
+msgstr ""
+
+#: includes/dashboard.php:79
+msgid "Update available"
+msgstr ""
+
+#: includes/dashboard.php:79
+msgid "Unknown — refresh in Updates"
+msgstr ""
+
+#: includes/dashboard.php:79
+msgid "No update reported"
+msgstr ""
+
+#: includes/dashboard.php:80
+msgid "Back up, review the release notes, then update."
+msgstr ""
+
+#: includes/dashboard.php:80
+msgid "Remove it if no longer needed, after checking dependencies."
+msgstr ""
+
+#: includes/dashboard.php:80
+msgid "Keep maintained and review auto-update settings."
+msgstr ""
+
+#: includes/dashboard.php:81
+msgid "Auto-updates selected in WordPress; host or plugin policy may override this."
+msgstr ""
+
+#: includes/dashboard.php:84
+msgid "No update reported is not a security verdict. This tool does not check a vulnerability database or certify plugins as safe."
+msgstr ""
+
+#: includes/dashboard.php:87
+msgid "3. Follow your security checklist"
+msgstr ""
+
+#: includes/dashboard.php:89
+msgid "Configured"
+msgstr ""
+
+#: includes/dashboard.php:89
+msgid "Review"
+msgstr ""
+
+#: includes/dashboard.php:92
+msgid "Also check these with your host or administrator"
+msgstr ""
+
+#: includes/dashboard.php:93
+msgid "Test your backups, use unique passwords and two-factor authentication, remove unused accounts, and keep WordPress and themes updated. These are manual checks; this plugin does not verify them."
+msgstr ""
+
+#: includes/dashboard.php:94
+msgid "Open WordPress Site Health"
+msgstr ""
+
+#: includes/dashboard.php:95
+msgid "Read the official security guide"
+msgstr ""
+
+#: includes/dashboard.php:97
+msgid "Read-only checks. No automatic file edits, tracking, or additional remote metadata requests. Only the latest file report is stored."
+msgstr ""
+
+#: site-security-auditor.php:36
+msgid "Security Audit"
+msgstr ""
+
+#: site-security-auditor.php:45
+msgid "You are not allowed to perform this action."
+msgstr ""
+
+#: site-security-auditor.php:66
+msgid "Run a file check first."
+msgstr ""
+
+#: site-security-auditor.php:95
+msgid "Create a trusted baseline before comparing files."
+msgstr ""
+
+#: site-security-auditor.php:139
+msgid "Encrypted website address"
+msgstr ""
+
+#: site-security-auditor.php:139
+msgid "Use HTTPS for your public site. Ask your host to configure a certificate and redirects."
+msgstr ""
+
+#: site-security-auditor.php:140
+msgid "HTTPS required for administration"
+msgstr ""
+
+#: site-security-auditor.php:140
+msgid "Ask your host to check FORCE_SSL_ADMIN and your HTTPS proxy configuration."
+msgstr ""
+
+#: site-security-auditor.php:141
+msgid "Dashboard code editing disabled"
+msgstr ""
+
+#: site-security-auditor.php:141
+msgid "Consider DISALLOW_FILE_EDIT in wp-config.php. Back up the file and ask your developer before editing it."
+msgstr ""
+
+#: site-security-auditor.php:142
+msgid "WordPress debug display off"
+msgstr ""
+
+#: site-security-auditor.php:142
+msgid "On production sites, keep WordPress debug messages out of public pages. Server-level error display needs a separate host check."
+msgstr ""
+
+#: site-security-auditor.php:160
+msgid "I have reviewed this site and trust its current files. This replaces the previous baseline."
+msgstr ""

site-security-auditor/tags/1.4.0/readme.txt

@@ -1 @@
-=== Site Security Auditor ===
+=== Site Security Auditor – Plugin & File Checks ===
 Contributors: gopalbogati
+Tags: security audit, file integrity, plugin updates, security checklist, site health
+Requires at least: 5.8
+Tested up to: 7.0
 Requires PHP: 7.4
-Tested up to: 6.8
-Stable tag: 1.0
+Stable tag: 1.4.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-A simple admin tool to audit plugins, file integrity (baseline + changes), and hardening settings. No tracking or updater hooks.
+Review plugin updates, detect plugin and theme file changes, and follow a clear WordPress security checklist. No account required.
 
 == Description ==
-Site Security Auditor helps admins spot risks from outdated/inactive plugins, monitor file changes in plugins/themes, and review hardening settings like DISALLOW_FILE_EDIT or FORCE_SSL_ADMIN. It uses only WordPress core APIs and stores data in options.
+
+Site Security Auditor gives WordPress administrators a practical security review dashboard. See plugin update information, compare plugin and theme files against a trusted snapshot, and understand which settings deserve attention.
+
+Open **Tools → Security Audit** to start. Each section explains what it checks, what the result means, and what to do next. It is designed for routine maintenance and investigating unexpected file changes, without automatically editing your site.
+
+= What you can do =
+
+* **Review plugin updates:** see available updates, inactive plugins and missing or stale update information. Open the familiar WordPress update screen to take action.
+* **Compare files:** save a trusted SHA-256 baseline, then identify added, modified and removed code files in plugin and theme directories.
+* **Return to your latest report:** the most recent file check stays visible with its timestamp and file count. Simply opening the dashboard does not start another scan.
+* **Download a file report:** export the latest result as JSON to review with your developer or host.
+* **Follow a plain-language checklist:** review HTTPS configuration, dashboard code editing and WordPress debug display, with links to Site Health and official guidance.
+* **Use a responsive dashboard:** clear sections, keyboard-accessible controls and a scrollable plugin table on small screens.
+
+= A useful maintenance routine =
+
+1. Review available updates and take a backup.
+2. Confirm your files are trustworthy before saving the first baseline.
+3. Run a comparison after maintenance or when investigating changes.
+4. Match changed files to intentional updates or edits.
+5. Replace the baseline only after reviewing and trusting the current files.
+
+A baseline records the current state; it does not prove that state is clean. Keep independent backups and ask a trusted professional about unexplained changes.
+
+= Scope and limitations =
+
+New baselines cover PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files inside the configured plugin directory and registered theme directories. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and cause an incomplete result.
+
+Each run is bounded to 20,000 directory entries, 100 MiB of file data, 8 MiB per file and an approximately 8-second processing budget. Unreadable files or exceeded limits produce an incomplete report. Incomplete scans never replace a baseline or present a partial comparison as complete. Large sites may need a host-level integrity tool. Avoid editing files or running updates during a scan.
+
+This plugin is **not a malware scanner, firewall or vulnerability database**. It does not repair files, guarantee security, or certify a plugin as safe. An update or legitimate edit can change a file; unchanged files can still contain problems.
+
+= Privacy and performance =
+
+No account, API key, telemetry or additional remote metadata requests are required. The dashboard uses the update information already maintained by WordPress; WordPress itself may contact its normal update services.
+
+File hashes, relative paths, baseline time and the latest file report are stored in the site's options, without autoloading them. Reports are restricted to administrators; on multisite they require a network administrator. Downloaded reports contain relative file paths, so share them only with trusted people. Deactivation and deletion preserve these records to avoid silently discarding your trusted reference.
 
 == Installation ==
-1. Upload the ZIP via Plugins → Add New → Upload Plugin
-2. Activate
-3. Go to Tools → Security Audit
-4. Create/Update Baseline → Scan Now
 
-== Changeling ==
+1. Install Site Security Auditor from Plugins → Add New, or upload the plugin ZIP.
+2. Activate the plugin.
+3. Open Tools → Security Audit using an administrator account.
+4. Read the baseline warning, confirm that you trust the current files, and choose Save trusted baseline.
+5. Return and select Compare files now to review changes.
+
+On multisite, a network administrator can open the dashboard from a site's Tools menu. Baselines and reports are stored per site, while plugin and theme files may be shared across the network.
+
+== Frequently Asked Questions ==
+
+= Does it scan for malware or known vulnerabilities? =
+
+No. It compares code-file hashes with your own baseline and shows maintenance/configuration checks. Use other appropriate controls and professional advice alongside this tool.
+
+= When should I replace the baseline? =
+
+Only after verifying the current files, for example after reviewing an intentional plugin update. Replacing it accepts the current state as the reference and removes the previous comparison point.
+
+= Why does a plugin say Unknown? =
+
+WordPress has not supplied current update information for it, or that information is more than two days old. Open WordPress Updates to refresh it. Some premium or custom plugins use separate update systems. Unknown does not mean unsafe or safe.
+
+= What happens to my existing baseline when I update? =
+
+Your baseline is retained. Baselines made before 1.4.0 continue comparing their original file types, without JS and CSS. A newly saved trusted baseline includes JS and CSS. Review changes before replacing it.
+
+= Why is a scan incomplete? =
+
+The scan reached a resource limit, encountered a symbolic link, could not read a directory/file, or found a file changing during the run. The report explains the issue. Finish updates and ask your host to check permissions; large sites may need another integrity tool.
+
+= Does it change my security settings automatically? =
+
+No. It provides guidance and links. Configuration changes can affect hosting or integrations, so review them with your administrator.
+
+= Can I use this every day? =
+
+You can manually review the dashboard and compare files whenever useful. There are no scheduled scans or email alerts in this version. The dashboard stores only the latest file report; download reports you need to keep.
+
+== Screenshots ==
+
+1. Security review dashboard with maintenance summaries and the trusted-baseline workflow.
+2. Saved file comparison with added, modified and removed file groups.
+3. Plugin maintenance information and a plain-language configuration checklist.
+
+== Changelog ==
+
+= 1.4.0 =
+* New responsive dashboard, guided baseline workflow and actionable security checklist.
+* Save the latest file report and download it as JSON.
+* Run scans only through authenticated, nonce-protected POST actions.
+* Preserve baselines when scans are incomplete; add resource limits and explicit coverage warnings.
+* Include JS and CSS in new baselines while preserving legacy comparison scope.
+* Use cached WordPress update data instead of per-plugin remote lookups on dashboard views.
+* Recognize network-active plugins and restrict multisite access to network administrators.
+* Refresh directory branding, documentation, screenshots and release metadata.
+
 = 1.0 =
-* Add full dashboard sections and escaping
-* Fix text domain packaging
+* Initial dashboard for plugin information, file baselines and hardening checks.
+
+== Upgrade Notice ==
+
+= 1.4.0 =
+New dashboard and safer file checks. Existing baselines remain intact; newly saved baselines also include JS and CSS. Review changes before replacing a baseline.
+

site-security-auditor/tags/1.4.0/site-security-auditor.php

@@ -1 +1 @@
 <?php
 /**
- * Plugin Name:       Site Security Auditor
- * Description:       Audits plugins, file integrity, and hardening to improve site security.
- * Version:           1.3.3
- * Author:            Gopal Bogati
- * Author URI:        https://wordpress.org/
- * Text Domain:       site-security-auditor
- * Domain Path:       /languages
+ * Plugin Name: Site Security Auditor
+ * Description: Review plugin updates, compare plugin and theme files, and follow a clear WordPress security checklist.
+ * Version: 1.4.0
+ * Author: Gopal Bogati
+ * Author URI: https://profiles.wordpress.org/gopalbogati/
+ * Text Domain: site-security-auditor
+ * Domain Path: /languages
  * Requires at least: 5.8
- * Tested up to:      6.8
- * Requires PHP:      7.4
- * License:           GPL-2.0+
+ * Requires PHP: 7.4
+ * License: GPL-2.0-or-later
  */
+if ( ! defined( 'ABSPATH' ) ) { exit; }
 define( 'SITESEAU_PLUGIN_FILE', __FILE__ );
 define( 'SITESEAU_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'SITESEAU_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
+require_once SITESEAU_PLUGIN_DIR . 'includes/class-scanner.php';
 
+class Siteseau_Site_Security_Auditor {
+        const OPT_HASHES = 'siteseau_hashes';
+        const OPT_HASHES_TIME = 'siteseau_hashes_time';
+        const OPT_REPORT = 'siteseau_report';
 
-if ( ! defined( 'ABSPATH' ) ) {
-        exit;
-}
-
-if ( ! class_exists( 'Siteseau_Site_Security_Auditor' ) ) :
-
-/**
- * Main plugin class.
- */
-class Siteseau_Site_Security_Auditor {
-
-        const OPT_HASHES      = 'siteseau_hashes';
-        const OPT_HASHES_TIME = 'siteseau_hashes_time';
-
-        /**
-         * Bootstrap.
-         */
         public static function init() {
                 add_action( 'admin_menu', array( __CLASS__, 'add_menu' ) );
+                add_action( 'admin_enqueue_scripts', array( __CLASS__, 'assets' ) );
                 add_action( 'admin_post_ssa_make_baseline', array( __CLASS__, 'handle_baseline' ) );
                 add_action( 'admin_post_ssa_run_scan', array( __CLASS__, 'handle_scan' ) );
+                add_action( 'admin_post_ssa_export', array( __CLASS__, 'handle_export' ) );
         }
-
-        /**
-         * Add Tools -> Security Audit page.
-         */
+        public static function capability() {
+                return is_multisite() ? 'manage_network_options' : 'manage_options';
+        }
         public static function add_menu() {
-                add_management_page(
-                        __( 'Security Audit', 'site-security-auditor' ),
-                        __( 'Security Audit', 'site-security-auditor' ),
-                        'manage_options',
-                        'site-security-auditor',
-                        array( __CLASS__, 'render_page' )
-                );
+                add_management_page( __( 'Security Audit', 'site-security-auditor' ), __( 'Security Audit', 'site-security-auditor' ), self::capability(), 'site-security-auditor', array( __CLASS__, 'render_page' ) );
         }
-
-        /**
-         * Create/update baseline handler.
-         */
+        public static function assets( $hook ) {
+                if ( 'tools_page_site-security-auditor' === $hook ) {
+                        wp_enqueue_style( 'siteseau-admin', SITESEAU_PLUGIN_URL . 'assets/admin.css', array(), '1.4.0' );
+                }
+        }
+        private static function authorize( $action ) {
+                if ( ! current_user_can( self::capability() ) || 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : '' ) ) {
+                        wp_die( esc_html__( 'You are not allowed to perform this action.', 'site-security-auditor' ), '', array( 'response' => 403 ) );
+                }
+                check_admin_referer( $action );
+        }
         public static function handle_baseline() {
-                if ( ! current_user_can( 'manage_options' ) ) {
-                        wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'site-security-auditor' ) );
-                }
-                check_admin_referer( 'ssa_make_baseline' );
-
-                $paths  = self::get_scan_paths();
-                $hashes = self::hash_paths( $paths );
-                update_option( self::OPT_HASHES, $hashes, false );
-                update_option( self::OPT_HASHES_TIME, time(), false );
-
-                wp_safe_redirect( add_query_arg( array( 'page' => 'site-security-auditor', 'ssa_msg' => 'baseline_done' ), admin_url( 'tools.php' ) ) );
+                self::authorize( 'ssa_make_baseline' );
+                self::run_audit( true );
+                self::redirect();
+        }
+        public static function handle_scan() {
+                self::authorize( 'ssa_run_scan' );
+                self::run_audit( false );
+                self::redirect();
+        }
+        private static function redirect() {
+                wp_safe_redirect( admin_url( 'tools.php?page=site-security-auditor' ) );
                 exit;
         }
-
-        /**
-         * Run scan handler.
-         */
-        public static function handle_scan() {
-                if ( ! current_user_can( 'manage_options' ) ) {
-                        wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'site-security-auditor' ) );
-                }
-                check_admin_referer( 'ssa_run_scan' );
-
-                wp_safe_redirect( add_query_arg( array( 'page' => 'site-security-auditor', 'ssa_scan' => '1' ), admin_url( 'tools.php' ) ) );
+        public static function handle_export() {
+                self::authorize( 'ssa_export' );
+                $report = get_option( self::OPT_REPORT, array() );
+                if ( ! $report ) { wp_die( esc_html__( 'Run a file check first.', 'site-security-auditor' ) ); }
+                nocache_headers();
+                header( 'Content-Type: application/json; charset=utf-8' );
+                header( 'Content-Disposition: attachment; filename="site-security-auditor-report.json"' );
+                echo wp_json_encode( $report, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES );
                 exit;
         }
-
-        /**
-         * Render admin page.
-         */
-        public static function render_page() {
-                if ( ! current_user_can( 'manage_options' ) ) {
-                        return;
+        protected static function scan_roots() {
+                global $wp_theme_directories;
+                $roots = array( 'wp-content/plugins' => WP_PLUGIN_DIR );
+                $themes = (array) $wp_theme_directories;
+                if ( ! $themes ) { $themes = array( WP_CONTENT_DIR . '/themes' ); }
+                foreach ( array_values( array_unique( $themes ) ) as $i => $path ) {
+                        $label = wp_normalize_path( $path ) === wp_normalize_path( WP_CONTENT_DIR . '/themes' ) ? 'wp-content/themes' : 'theme-root-' . $i;
+                        $roots[ $label ] = $path;
                 }
-
-                $plugins_info = self::collect_plugins_info();
-                $hardening    = self::hardening_checks();
-                $baseline_ts  = intval( get_option( self::OPT_HASHES_TIME, 0 ) );
-                $hashes       = get_option( self::OPT_HASHES, array() );
-                $scan_results = array();
-
-                if ( isset( $_GET['ssa_scan'] ) && '1' === $_GET['ssa_scan'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-                        $scan_results = self::compare_hashes( is_array( $hashes ) ? $hashes : array(), self::hash_paths( self::get_scan_paths() ) );
-                }
-
-                echo '<div class="wrap">';
-                echo '<h1>' . esc_html__( 'Security Audit Dashboard', 'site-security-auditor' ) . '</h1>';
-
-                if ( isset( $_GET['ssa_msg'] ) && 'baseline_done' === $_GET['ssa_msg'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-                        echo '<div class="notice notice-success"><p>' . esc_html__( 'File integrity baseline created/updated.', 'site-security-auditor' ) . '</p></div>';
-                }
-
-                // Plugins Risk Overview.
-                echo '<h2>' . esc_html__( 'Plugins Risk Overview', 'site-security-auditor' ) . '</h2>';
-                echo '<p>' . esc_html__( 'Flags plugins with updates available, last updated over a year ago, or inactive status.', 'site-security-auditor' ) . '</p>';
-                echo '<table class="widefat striped"><thead><tr>';
-                echo '<th>' . esc_html__( 'Plugin', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Version', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Status', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Update Available', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Last Updated', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Risk', 'site-security-auditor' ) . '</th>';
-                echo '</tr></thead><tbody>';
-
-                if ( empty( $plugins_info ) ) {
-                        echo '<tr><td colspan="6">' . esc_html__( 'No plugins found.', 'site-security-auditor' ) . '</td></tr>';
-                } else {
-                        foreach ( $plugins_info as $row ) {
-                                $risk_labels = array();
-                                if ( ! empty( $row['update_available'] ) ) {
-                                        $risk_labels[] = __( 'Update available', 'site-security-auditor' );
-                                }
-                                if ( ! empty( $row['stale'] ) ) {
-                                        $risk_labels[] = __( 'Stale (> 1 year)', 'site-security-auditor' );
-                                }
-                                if ( empty( $row['active'] ) ) {
-                                        $risk_labels[] = __( 'Inactive', 'site-security-auditor' );
-                                }
-                                echo '<tr>';
-                                echo '<td>' . esc_html( $row['name'] ) . '</td>';
-                                echo '<td>' . esc_html( $row['version'] ) . '</td>';
-                                echo '<td>' . ( ! empty( $row['active'] ) ? esc_html__( 'Active', 'site-security-auditor' ) : esc_html__( 'Inactive', 'site-security-auditor' ) ) . '</td>';
-                                echo '<td>' . ( ! empty( $row['update_available'] ) ? esc_html__( 'Yes', 'site-security-auditor' ) : esc_html__( 'No', 'site-security-auditor' ) ) . '</td>';
-                                echo '<td>' . esc_html( $row['last_updated'] ) . '</td>';
-                                echo '<td>' . ( $risk_labels ? esc_html( implode( ', ', $risk_labels ) ) : esc_html__( 'OK', 'site-security-auditor' ) ) . '</td>';
-                                echo '</tr>';
-                        }
-                }
-                echo '</tbody></table>';
-
-                // File Integrity Monitor.
-                echo '<hr /><h2>' . esc_html__( 'File Integrity Monitor', 'site-security-auditor' ) . '</h2>';
-                echo '<p>' . esc_html__( 'Create a hash baseline for plugins/themes and scan to detect added, modified or removed files.', 'site-security-auditor' ) . '</p>';
-
-                if ( $baseline_ts ) {
-                        /* translators: %s: date/time. */
-                        $baseline_text = sprintf( esc_html__( 'Baseline last updated: %s', 'site-security-auditor' ), wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $baseline_ts ) );
-                        echo '<p>' . esc_html( $baseline_text ) . '</p>';
-                } else {
-                        echo '<p>' . esc_html__( 'No baseline yet.', 'site-security-auditor' ) . '</p>';
-                }
-
-                echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" style="display:inline-block;margin-right:10px;">';
-                wp_nonce_field( 'ssa_make_baseline' );
-                echo '<input type="hidden" name="action" value="ssa_make_baseline" />';
-                echo '<button type="submit" class="button button-primary" onclick="return confirm(\'' . esc_js( __( 'Create/Update baseline now?', 'site-security-auditor' ) ) . '\');">' . esc_html__( 'Create/Update Baseline', 'site-security-auditor' ) . '</button>';
-                echo '</form>';
-
-                echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" style="display:inline-block;">';
-                wp_nonce_field( 'ssa_run_scan' );
-                echo '<input type="hidden" name="action" value="ssa_run_scan" />';
-                echo '<button type="submit" class="button">' . esc_html__( 'Scan Now', 'site-security-auditor' ) . '</button>';
-                echo '</form>';
-
-                if ( ! empty( $scan_results ) ) {
-                        echo '<h3 style="margin-top:20px;">' . esc_html__( 'Scan Results', 'site-security-auditor' ) . '</h3>';
-                        echo '<table class="widefat striped"><thead><tr><th>' . esc_html__( 'Change', 'site-security-auditor' ) . '</th><th>' . esc_html__( 'File', 'site-security-auditor' ) . '</th></tr></thead><tbody>';
-                        $printed = false;
-                        foreach ( array( 'added', 'modified', 'removed' ) as $key ) {
-                                if ( ! empty( $scan_results[ $key ] ) ) {
-                                        foreach ( $scan_results[ $key ] as $file ) {
-                                                echo '<tr><td>' . esc_html( ucfirst( $key ) ) . '</td><td>' . esc_html( $file ) . '</td></tr>';
-                                                $printed = true;
+                return $roots;
+        }
+        /** Protected operation, invoked only by the authorized POST handlers. */
+        protected static function run_audit( $make_baseline ) {
+                $lock = (int) get_option( 'siteseau_scan_lock', 0 );
+                if ( $lock && $lock < time() - 300 ) { delete_option( 'siteseau_scan_lock' ); }
+                if ( ! add_option( 'siteseau_scan_lock', time(), '', false ) ) { return; }
+                try {
+                        $baseline_time = (int) get_option( self::OPT_HASHES_TIME, 0 );
+                        $old = get_option( self::OPT_HASHES, array() );
+                        $scope = $make_baseline ? 2 : (int) get_option( 'siteseau_scope', 1 );
+                        $report = array( 'time' => time(), 'baseline_time' => $baseline_time, 'scope' => $scope, 'kind' => $make_baseline ? 'baseline' : 'comparison', 'complete' => false, 'files' => 0, 'issues' => array(), 'changes' => array() );
+                        if ( ! $make_baseline && ( ! $baseline_time || ! is_array( $old ) ) ) {
+                                $report['issues'][] = __( 'Create a trusted baseline before comparing files.', 'site-security-auditor' );
+                        } else {
+                                $limits = 1 === $scope ? array( 'extensions' => array( 'php', 'php7', 'phtml', 'inc', 'twig', 'json' ) ) : array();
+                                // Older releases scanned these fixed directories, even with custom plugin/theme roots.
+                                $roots = 1 === $scope ? array( 'wp-content/plugins' => WP_CONTENT_DIR . '/plugins', 'wp-content/themes' => WP_CONTENT_DIR . '/themes' ) : self::scan_roots();
+                                $scan = Siteseau_Scanner::scan( $roots, $limits );
+                                $report['complete'] = $scan['complete'];
+                                $report['files'] = count( $scan['hashes'] );
+                                $report['issues'] = $scan['issues'];
+                                if ( $scan['complete'] ) {
+                                        if ( $make_baseline ) {
+                                                update_option( self::OPT_HASHES, $scan['hashes'], false );
+                                                update_option( self::OPT_HASHES_TIME, $report['time'], false );
+                                                update_option( 'siteseau_scope', 2, false );
+                                                $report['baseline_time'] = $report['time'];
+                                        } else {
+                                                $report['changes'] = Siteseau_Scanner::compare( $old, $scan['hashes'] );
                                         }
                                 }
                         }
-                        if ( ! $printed ) {
-                                echo '<tr><td colspan="2">' . esc_html__( 'No changes detected.', 'site-security-auditor' ) . '</td></tr>';
-                        }
-                        echo '</tbody></table>';
+                        update_option( self::OPT_REPORT, $report, false );
+                } finally {
+                        delete_option( 'siteseau_scan_lock' );
                 }
-
-                // Hardening checks.
-                echo '<hr /><h2>' . esc_html__( 'Hardening Checks', 'site-security-auditor' ) . '</h2>';
-                echo '<table class="widefat striped"><thead><tr><th>' . esc_html__( 'Check', 'site-security-auditor' ) . '</th><th>' . esc_html__( 'Status', 'site-security-auditor' ) . '</th></tr></thead><tbody>';
-
-                echo '<tr><td>' . esc_html__( 'DISALLOW_FILE_EDIT', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['disallow_file_edit'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-                echo '<tr><td>' . esc_html__( 'FORCE_SSL_ADMIN', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['force_ssl_admin'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-                echo '<tr><td>' . esc_html__( 'Plugin auto-updates (general)', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['plugin_updates_enabled'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-                echo '<tr><td>' . esc_html__( 'XML-RPC availability', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['xmlrpc_enabled'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-
-                echo '</tbody></table>';
-                echo '</div>';
         }
-
-        /**
-         * Collect plugin info and risk signals.
-         *
-         * @return array
-         */
         protected static function collect_plugins_info() {
-                if ( ! function_exists( 'get_plugins' ) ) {
-                        require_once ABSPATH . 'wp-admin/includes/plugin.php';
+                if ( ! function_exists( 'get_plugins' ) ) { require_once ABSPATH . 'wp-admin/includes/plugin.php'; }
+                $updates = get_site_transient( 'update_plugins' );
+                $recent = is_object( $updates ) && ! empty( $updates->last_checked ) && $updates->last_checked > time() - 2 * DAY_IN_SECONDS;
+                $auto = (array) get_site_option( 'auto_update_plugins', array() );
+                $results = array();
+                foreach ( get_plugins() as $file => $data ) {
+                        $known = $recent && isset( $updates->checked[ $file ] ) && $updates->checked[ $file ] === $data['Version'] && ( isset( $updates->response[ $file ] ) || isset( $updates->no_update[ $file ] ) );
+                        $results[] = array(
+                                'name' => $data['Name'], 'version' => $data['Version'],
+                                'active' => is_plugin_active( $file ) || is_plugin_active_for_network( $file ),
+                                'update' => $known ? ( isset( $updates->response[ $file ] ) ? 'available' : 'none' ) : 'unknown',
+                                'auto' => in_array( $file, $auto, true ),
+                        );
                 }
-                $all_plugins = get_plugins();
-                $active      = get_option( 'active_plugins', array() );
-                $active_map  = array_fill_keys( $active, true );
-
-                $updates     = get_site_transient( 'update_plugins' );
-                $updates_map = array();
-                if ( isset( $updates->response ) && is_array( $updates->response ) ) {
-                        foreach ( $updates->response as $file => $obj ) {
-                                $updates_map[ $file ] = true;
-                        }
-                }
-
-                $results = array();
-                foreach ( $all_plugins as $file => $data ) {
-                        $slug = dirname( $file );
-                        $info = array(
-                                'name'            => isset( $data['Name'] ) ? $data['Name'] : $file,
-                                'version'         => isset( $data['Version'] ) ? $data['Version'] : '',
-                                'active'          => isset( $active_map[ $file ] ),
-                                'update_available'=> isset( $updates_map[ $file ] ),
-                                'last_updated'    => __( 'Unknown', 'site-security-auditor' ),
-                                'stale'           => false,
-                        );
-
-                        // Try wp.org API for last_updated.
-                        if ( ! function_exists( 'plugins_api' ) ) {
-                                
-                        }
-                        $args = array(
-                                'slug'   => $slug,
-                                'fields' => array( 'last_updated' => true ),
-                        );
-if ( is_admin() && ! function_exists( 'plugins_api' ) ) {
-        require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
-}
-                        $api = @plugins_api( 'plugin_information', $args ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
-                        if ( ! is_wp_error( $api ) && ! empty( $api->last_updated ) ) {
-                                $info['last_updated'] = mysql2date( get_option( 'date_format' ), $api->last_updated );
-                                $ts = strtotime( $api->last_updated );
-                                if ( $ts && ( time() - $ts ) > YEAR_IN_SECONDS ) {
-                                        $info['stale'] = true;
-                                }
-                        }
-
-                        $results[] = $info;
-                }
-
                 return $results;
         }
-
-        /**
-         * Directories to scan.
-         *
-         * @return array
-         */
-        protected static function get_scan_paths() {
+        protected static function hardening_checks() {
                 return array(
-                        WP_CONTENT_DIR . '/plugins',
-                        WP_CONTENT_DIR . '/themes',
+                        array( __( 'Encrypted website address', 'site-security-auditor' ), 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ), __( 'Use HTTPS for your public site. Ask your host to configure a certificate and redirects.', 'site-security-auditor' ) ),
+                        array( __( 'HTTPS required for administration', 'site-security-auditor' ), (bool) force_ssl_admin(), __( 'Ask your host to check FORCE_SSL_ADMIN and your HTTPS proxy configuration.', 'site-security-auditor' ) ),
+                        array( __( 'Dashboard code editing disabled', 'site-security-auditor' ), ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ) || ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ), __( 'Consider DISALLOW_FILE_EDIT in wp-config.php. Back up the file and ask your developer before editing it.', 'site-security-auditor' ) ),
+                        array( __( 'WordPress debug display off', 'site-security-auditor' ), ! ( defined( 'WP_DEBUG' ) && WP_DEBUG && ( ! defined( 'WP_DEBUG_DISPLAY' ) || WP_DEBUG_DISPLAY ) ), __( 'On production sites, keep WordPress debug messages out of public pages. Server-level error display needs a separate host check.', 'site-security-auditor' ) ),
                 );
         }
-
-        /**
-         * Hash files in given paths.
-         *
-         * @param array $paths Paths.
-         * @return array Map file => hash.
-         */
-        protected static function hash_paths( $paths ) {
-                $map = array();
-
-                foreach ( $paths as $path ) {
-                        if ( ! is_dir( $path ) ) {
-                                continue;
-                        }
-                        $iterator = new RecursiveIteratorIterator( new RecursiveDirectoryIterator( $path, FilesystemIterator::SKIP_DOTS ) );
-                        foreach ( $iterator as $file ) {
-                                /** @var SplFileInfo $file */
-                                $ext = strtolower( pathinfo( $file->getFilename(), PATHINFO_EXTENSION ) );
-                                if ( in_array( $ext, array( 'php', 'php7', 'phtml', 'inc', 'twig', 'json' ), true ) ) {
-                                        $real = $file->getPathname();
-                                        $rel  = ltrim( str_replace( WP_CONTENT_DIR, 'wp-content', $real ), '/' );
-                                        $hash = @hash_file( 'sha256', $real ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
-                                        if ( $hash ) {
-                                                $map[ $rel ] = $hash;
-                                        }
-                                }
-                        }
+        public static function render_page() {
+                if ( ! current_user_can( self::capability() ) ) { return; }
+                $plugins = self::collect_plugins_info();
+                $checks = self::hardening_checks();
+                $report = get_option( self::OPT_REPORT, array() );
+                $baseline_time = (int) get_option( self::OPT_HASHES_TIME, 0 );
+                $updates = count( array_filter( $plugins, function( $row ) { return 'available' === $row['update']; } ) );
+                $review = count( array_filter( $checks, function( $row ) { return ! $row[1]; } ) );
+                require SITESEAU_PLUGIN_DIR . 'includes/dashboard.php';
+        }
+        public static function action_form( $action, $label, $disabled = false, $confirm = false ) {
+                echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" class="ssa-action">';
+                wp_nonce_field( $action );
+                echo '<input type="hidden" name="action" value="' . esc_attr( $action ) . '">';
+                if ( $confirm ) {
+                        echo '<label class="ssa-confirm"><input type="checkbox" required> ' . esc_html__( 'I have reviewed this site and trust its current files. This replaces the previous baseline.', 'site-security-auditor' ) . '</label>';
                 }
-                ksort( $map );
-                return $map;
-        }
-
-        /**
-         * Compare old and new hash maps.
-         *
-         * @param array $old Old.
-         * @param array $new New.
-         * @return array
-         */
-        protected static function compare_hashes( $old, $new ) {
-                $old = is_array( $old ) ? $old : array();
-                $new = is_array( $new ) ? $new : array();
-
-                $added    = array_diff_key( $new, $old );
-                $removed  = array_diff_key( $old, $new );
-                $modified = array();
-
-                $common = array_intersect_key( $new, $old );
-                foreach ( $common as $file => $hash ) {
-                        if ( $old[ $file ] !== $hash ) {
-                                $modified[ $file ] = $hash;
-                        }
-                }
-
-                return array(
-                        'added'    => array_keys( $added ),
-                        'modified' => array_keys( $modified ),
-                        'removed'  => array_keys( $removed ),
-                );
-        }
-
-        /**
-         * Hardening checks.
-         *
-         * @return array
-         */
-        protected static function hardening_checks() {
-                // Generic on/off for auto-updates by type (does not hook into filters).
-                $auto_plugins = function_exists( 'wp_is_auto_update_enabled_for_type' ) ? (bool) wp_is_auto_update_enabled_for_type( 'plugin' ) : false;
-                $xmlrpc_on    = apply_filters( 'xmlrpc_enabled', true );
-
-                return array(
-                        'disallow_file_edit' => defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT,
-                        'force_ssl_admin'    => defined( 'FORCE_SSL_ADMIN' ) && FORCE_SSL_ADMIN,
-                        'plugin_updates_enabled'=> $auto_plugins,
-                        'xmlrpc_enabled'     => (bool) $xmlrpc_on,
-                );
+                echo '<button class="button ' . ( 'ssa_run_scan' === $action ? 'button-primary' : '' ) . '" type="submit"' . disabled( $disabled, true, false ) . '>' . esc_html( $label ) . '</button></form>';
         }
 }
-
 Siteseau_Site_Security_Auditor::init();
-
-endif;

site-security-auditor/trunk/languages/site-security-auditor.pot

@@ -1 @@
-# POT placeholder
+# Copyright (C) 2026 Gopal Bogati
+# This file is distributed under the GPL-2.0-or-later.
+msgid ""
+msgstr ""
+"Project-Id-Version: Site Security Auditor 1.4.0\n"
+"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/trunk\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"POT-Creation-Date: 2026-09-05T05:49:37+00:00\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"X-Generator: WP-CLI 2.12.0\n"
+"X-Domain: site-security-auditor\n"
+
+#. Plugin Name of the plugin
+#: site-security-auditor.php
+msgid "Site Security Auditor"
+msgstr ""
+
+#. Description of the plugin
+#: site-security-auditor.php
+msgid "Review plugin updates, compare plugin and theme files, and follow a clear WordPress security checklist."
+msgstr ""
+
+#. Author of the plugin
+#: site-security-auditor.php
+msgid "Gopal Bogati"
+msgstr ""
+
+#. Author URI of the plugin
+#: site-security-auditor.php
+msgid "https://profiles.wordpress.org/gopalbogati/"
+msgstr ""
+
+#: includes/dashboard.php:8
+msgid "SITE SECURITY AUDITOR"
+msgstr ""
+
+#: includes/dashboard.php:9
+msgid "Your security review"
+msgstr ""
+
+#: includes/dashboard.php:10
+msgid "Know what changed. Understand your next step."
+msgstr ""
+
+#: includes/dashboard.php:13
+msgid "Plugin updates available"
+msgstr ""
+
+#: includes/dashboard.php:13
+msgid "Review plugin information"
+msgstr ""
+
+#: includes/dashboard.php:14
+msgid "Settings to review"
+msgstr ""
+
+#: includes/dashboard.php:14
+msgid "Open your checklist"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "File comparison"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "Baseline ready"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "Set up first"
+msgstr ""
+
+#: includes/dashboard.php:15
+msgid "Review files"
+msgstr ""
+
+#: includes/dashboard.php:17
+msgid "These checks reduce guesswork, not all security risks. This is not a malware scanner, firewall, or vulnerability database."
+msgstr ""
+
+#: includes/dashboard.php:19
+msgid "1. Check for file changes"
+msgstr ""
+
+#: includes/dashboard.php:20
+msgid "A baseline is a snapshot of files you trust. Compare against it after maintenance or whenever you want to investigate unexpected changes."
+msgstr ""
+
+#: includes/dashboard.php:22
+msgid "Back up your site and confirm its files are trustworthy."
+msgstr ""
+
+#: includes/dashboard.php:23
+msgid "Save a baseline, then run a comparison when you return."
+msgstr ""
+
+#: includes/dashboard.php:24
+msgid "Review changes with your update history or developer before replacing the baseline."
+msgstr ""
+
+#: includes/dashboard.php:27
+msgid "Baseline saved:"
+msgstr ""
+
+#: includes/dashboard.php:29
+msgid "Compare files now"
+msgstr ""
+
+#: includes/dashboard.php:31
+msgid "Replace the trusted baseline"
+msgstr ""
+
+#: includes/dashboard.php:31
+msgid "Create your first baseline"
+msgstr ""
+
+#: includes/dashboard.php:32
+msgid "Saving a snapshot does not prove that files are clean. Replacing it accepts all current changes as your new reference."
+msgstr ""
+
+#: includes/dashboard.php:33
+msgid "Save trusted baseline"
+msgstr ""
+
+#: includes/dashboard.php:36
+#: includes/dashboard.php:37
+msgid "Latest file report"
+msgstr ""
+
+#. translators: %d: number of files read.
+#: includes/dashboard.php:39
+#, php-format
+msgid "%d files read"
+msgstr ""
+
+#: includes/dashboard.php:41
+msgid "Incomplete — no comparison or baseline replacement was made."
+msgstr ""
+
+#: includes/dashboard.php:42
+msgid "Finish any updates, check file permissions with your host, and retry. Large sites may need a host-level integrity tool."
+msgstr ""
+
+#: includes/dashboard.php:45
+msgid "Baseline saved. Your next comparison will use this snapshot."
+msgstr ""
+
+#: includes/dashboard.php:47
+msgid "Changes are not necessarily malicious: updates and intentional edits also change files. No changes does not guarantee a secure site."
+msgstr ""
+
+#: includes/dashboard.php:48
+msgid "Added"
+msgstr ""
+
+#: includes/dashboard.php:48
+msgid "Modified"
+msgstr ""
+
+#: includes/dashboard.php:48
+msgid "Removed"
+msgstr ""
+
+#: includes/dashboard.php:53
+msgid "Showing the first 100 paths. Download the full report below."
+msgstr ""
+
+#: includes/dashboard.php:57
+msgid "Download file report (JSON)"
+msgstr ""
+
+#: includes/dashboard.php:58
+msgid "The download includes relative file paths. Share only with people you trust."
+msgstr ""
+
+#: includes/dashboard.php:61
+msgid "What is included in a scan?"
+msgstr ""
+
+#: includes/dashboard.php:62
+msgid "Plugin and registered theme directories: PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and make a scan incomplete."
+msgstr ""
+
+#: includes/dashboard.php:63
+msgid "Limits: 20,000 directory entries, 100 MiB total, 8 MiB per file and an approximately 8-second processing budget. An incomplete scan never replaces your baseline. Files should not be edited while a scan runs."
+msgstr ""
+
+#: includes/dashboard.php:64
+msgid "Your older baseline excludes JS and CSS. Comparisons keep that scope until you save a new trusted baseline."
+msgstr ""
+
+#: includes/dashboard.php:68
+msgid "2. Review your plugins"
+msgstr ""
+
+#: includes/dashboard.php:69
+msgid "Uses the update information already stored by WordPress. Unknown means information is missing or more than two days old; premium plugins may use their own update systems."
+msgstr ""
+
+#: includes/dashboard.php:70
+msgid "Open WordPress Updates"
+msgstr ""
+
+#: includes/dashboard.php:71
+msgid "Manage plugins"
+msgstr ""
+
+#: includes/dashboard.php:72
+msgid "Plugin maintenance table"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Plugin"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Status"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Update information"
+msgstr ""
+
+#: includes/dashboard.php:74
+msgid "Next step"
+msgstr ""
+
+#: includes/dashboard.php:78
+msgid "Active"
+msgstr ""
+
+#: includes/dashboard.php:78
+msgid "Inactive"
+msgstr ""
+
+#: includes/dashboard.php:79
+msgid "Update available"
+msgstr ""
+
+#: includes/dashboard.php:79
+msgid "Unknown — refresh in Updates"
+msgstr ""
+
+#: includes/dashboard.php:79
+msgid "No update reported"
+msgstr ""
+
+#: includes/dashboard.php:80
+msgid "Back up, review the release notes, then update."
+msgstr ""
+
+#: includes/dashboard.php:80
+msgid "Remove it if no longer needed, after checking dependencies."
+msgstr ""
+
+#: includes/dashboard.php:80
+msgid "Keep maintained and review auto-update settings."
+msgstr ""
+
+#: includes/dashboard.php:81
+msgid "Auto-updates selected in WordPress; host or plugin policy may override this."
+msgstr ""
+
+#: includes/dashboard.php:84
+msgid "No update reported is not a security verdict. This tool does not check a vulnerability database or certify plugins as safe."
+msgstr ""
+
+#: includes/dashboard.php:87
+msgid "3. Follow your security checklist"
+msgstr ""
+
+#: includes/dashboard.php:89
+msgid "Configured"
+msgstr ""
+
+#: includes/dashboard.php:89
+msgid "Review"
+msgstr ""
+
+#: includes/dashboard.php:92
+msgid "Also check these with your host or administrator"
+msgstr ""
+
+#: includes/dashboard.php:93
+msgid "Test your backups, use unique passwords and two-factor authentication, remove unused accounts, and keep WordPress and themes updated. These are manual checks; this plugin does not verify them."
+msgstr ""
+
+#: includes/dashboard.php:94
+msgid "Open WordPress Site Health"
+msgstr ""
+
+#: includes/dashboard.php:95
+msgid "Read the official security guide"
+msgstr ""
+
+#: includes/dashboard.php:97
+msgid "Read-only checks. No automatic file edits, tracking, or additional remote metadata requests. Only the latest file report is stored."
+msgstr ""
+
+#: site-security-auditor.php:36
+msgid "Security Audit"
+msgstr ""
+
+#: site-security-auditor.php:45
+msgid "You are not allowed to perform this action."
+msgstr ""
+
+#: site-security-auditor.php:66
+msgid "Run a file check first."
+msgstr ""
+
+#: site-security-auditor.php:95
+msgid "Create a trusted baseline before comparing files."
+msgstr ""
+
+#: site-security-auditor.php:139
+msgid "Encrypted website address"
+msgstr ""
+
+#: site-security-auditor.php:139
+msgid "Use HTTPS for your public site. Ask your host to configure a certificate and redirects."
+msgstr ""
+
+#: site-security-auditor.php:140
+msgid "HTTPS required for administration"
+msgstr ""
+
+#: site-security-auditor.php:140
+msgid "Ask your host to check FORCE_SSL_ADMIN and your HTTPS proxy configuration."
+msgstr ""
+
+#: site-security-auditor.php:141
+msgid "Dashboard code editing disabled"
+msgstr ""
+
+#: site-security-auditor.php:141
+msgid "Consider DISALLOW_FILE_EDIT in wp-config.php. Back up the file and ask your developer before editing it."
+msgstr ""
+
+#: site-security-auditor.php:142
+msgid "WordPress debug display off"
+msgstr ""
+
+#: site-security-auditor.php:142
+msgid "On production sites, keep WordPress debug messages out of public pages. Server-level error display needs a separate host check."
+msgstr ""
+
+#: site-security-auditor.php:160
+msgid "I have reviewed this site and trust its current files. This replaces the previous baseline."
+msgstr ""

site-security-auditor/trunk/readme.txt

@@ -1 @@
-=== Site Security Auditor ===
+=== Site Security Auditor – Plugin & File Checks ===
 Contributors: gopalbogati
+Tags: security audit, file integrity, plugin updates, security checklist, site health
+Requires at least: 5.8
+Tested up to: 7.0
 Requires PHP: 7.4
-Tested up to: 6.8
-Stable tag: 1.0
+Stable tag: 1.4.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-A simple admin tool to audit plugins, file integrity (baseline + changes), and hardening settings. No tracking or updater hooks.
+Review plugin updates, detect plugin and theme file changes, and follow a clear WordPress security checklist. No account required.
 
 == Description ==
-Site Security Auditor helps admins spot risks from outdated/inactive plugins, monitor file changes in plugins/themes, and review hardening settings like DISALLOW_FILE_EDIT or FORCE_SSL_ADMIN. It uses only WordPress core APIs and stores data in options.
+
+Site Security Auditor gives WordPress administrators a practical security review dashboard. See plugin update information, compare plugin and theme files against a trusted snapshot, and understand which settings deserve attention.
+
+Open **Tools → Security Audit** to start. Each section explains what it checks, what the result means, and what to do next. It is designed for routine maintenance and investigating unexpected file changes, without automatically editing your site.
+
+= What you can do =
+
+* **Review plugin updates:** see available updates, inactive plugins and missing or stale update information. Open the familiar WordPress update screen to take action.
+* **Compare files:** save a trusted SHA-256 baseline, then identify added, modified and removed code files in plugin and theme directories.
+* **Return to your latest report:** the most recent file check stays visible with its timestamp and file count. Simply opening the dashboard does not start another scan.
+* **Download a file report:** export the latest result as JSON to review with your developer or host.
+* **Follow a plain-language checklist:** review HTTPS configuration, dashboard code editing and WordPress debug display, with links to Site Health and official guidance.
+* **Use a responsive dashboard:** clear sections, keyboard-accessible controls and a scrollable plugin table on small screens.
+
+= A useful maintenance routine =
+
+1. Review available updates and take a backup.
+2. Confirm your files are trustworthy before saving the first baseline.
+3. Run a comparison after maintenance or when investigating changes.
+4. Match changed files to intentional updates or edits.
+5. Replace the baseline only after reviewing and trusting the current files.
+
+A baseline records the current state; it does not prove that state is clean. Keep independent backups and ask a trusted professional about unexplained changes.
+
+= Scope and limitations =
+
+New baselines cover PHP, PHP7, PHTML, INC, TWIG, JSON, JS and CSS files inside the configured plugin directory and registered theme directories. WordPress core, uploads, must-use plugins, database content and other file types are excluded. Symbolic links are not followed and cause an incomplete result.
+
+Each run is bounded to 20,000 directory entries, 100 MiB of file data, 8 MiB per file and an approximately 8-second processing budget. Unreadable files or exceeded limits produce an incomplete report. Incomplete scans never replace a baseline or present a partial comparison as complete. Large sites may need a host-level integrity tool. Avoid editing files or running updates during a scan.
+
+This plugin is **not a malware scanner, firewall or vulnerability database**. It does not repair files, guarantee security, or certify a plugin as safe. An update or legitimate edit can change a file; unchanged files can still contain problems.
+
+= Privacy and performance =
+
+No account, API key, telemetry or additional remote metadata requests are required. The dashboard uses the update information already maintained by WordPress; WordPress itself may contact its normal update services.
+
+File hashes, relative paths, baseline time and the latest file report are stored in the site's options, without autoloading them. Reports are restricted to administrators; on multisite they require a network administrator. Downloaded reports contain relative file paths, so share them only with trusted people. Deactivation and deletion preserve these records to avoid silently discarding your trusted reference.
 
 == Installation ==
-1. Upload the ZIP via Plugins → Add New → Upload Plugin
-2. Activate
-3. Go to Tools → Security Audit
-4. Create/Update Baseline → Scan Now
 
-== Changeling ==
+1. Install Site Security Auditor from Plugins → Add New, or upload the plugin ZIP.
+2. Activate the plugin.
+3. Open Tools → Security Audit using an administrator account.
+4. Read the baseline warning, confirm that you trust the current files, and choose Save trusted baseline.
+5. Return and select Compare files now to review changes.
+
+On multisite, a network administrator can open the dashboard from a site's Tools menu. Baselines and reports are stored per site, while plugin and theme files may be shared across the network.
+
+== Frequently Asked Questions ==
+
+= Does it scan for malware or known vulnerabilities? =
+
+No. It compares code-file hashes with your own baseline and shows maintenance/configuration checks. Use other appropriate controls and professional advice alongside this tool.
+
+= When should I replace the baseline? =
+
+Only after verifying the current files, for example after reviewing an intentional plugin update. Replacing it accepts the current state as the reference and removes the previous comparison point.
+
+= Why does a plugin say Unknown? =
+
+WordPress has not supplied current update information for it, or that information is more than two days old. Open WordPress Updates to refresh it. Some premium or custom plugins use separate update systems. Unknown does not mean unsafe or safe.
+
+= What happens to my existing baseline when I update? =
+
+Your baseline is retained. Baselines made before 1.4.0 continue comparing their original file types, without JS and CSS. A newly saved trusted baseline includes JS and CSS. Review changes before replacing it.
+
+= Why is a scan incomplete? =
+
+The scan reached a resource limit, encountered a symbolic link, could not read a directory/file, or found a file changing during the run. The report explains the issue. Finish updates and ask your host to check permissions; large sites may need another integrity tool.
+
+= Does it change my security settings automatically? =
+
+No. It provides guidance and links. Configuration changes can affect hosting or integrations, so review them with your administrator.
+
+= Can I use this every day? =
+
+You can manually review the dashboard and compare files whenever useful. There are no scheduled scans or email alerts in this version. The dashboard stores only the latest file report; download reports you need to keep.
+
+== Screenshots ==
+
+1. Security review dashboard with maintenance summaries and the trusted-baseline workflow.
+2. Saved file comparison with added, modified and removed file groups.
+3. Plugin maintenance information and a plain-language configuration checklist.
+
+== Changelog ==
+
+= 1.4.0 =
+* New responsive dashboard, guided baseline workflow and actionable security checklist.
+* Save the latest file report and download it as JSON.
+* Run scans only through authenticated, nonce-protected POST actions.
+* Preserve baselines when scans are incomplete; add resource limits and explicit coverage warnings.
+* Include JS and CSS in new baselines while preserving legacy comparison scope.
+* Use cached WordPress update data instead of per-plugin remote lookups on dashboard views.
+* Recognize network-active plugins and restrict multisite access to network administrators.
+* Refresh directory branding, documentation, screenshots and release metadata.
+
 = 1.0 =
-* Add full dashboard sections and escaping
-* Fix text domain packaging
+* Initial dashboard for plugin information, file baselines and hardening checks.
+
+== Upgrade Notice ==
+
+= 1.4.0 =
+New dashboard and safer file checks. Existing baselines remain intact; newly saved baselines also include JS and CSS. Review changes before replacing a baseline.
+

site-security-auditor/trunk/site-security-auditor.php

@@ -1 +1 @@
 <?php
 /**
- * Plugin Name:       Site Security Auditor
- * Description:       Audits plugins, file integrity, and hardening to improve site security.
- * Version:           1.3.3
- * Author:            Gopal Bogati
- * Author URI:        https://wordpress.org/
- * Text Domain:       site-security-auditor
- * Domain Path:       /languages
+ * Plugin Name: Site Security Auditor
+ * Description: Review plugin updates, compare plugin and theme files, and follow a clear WordPress security checklist.
+ * Version: 1.4.0
+ * Author: Gopal Bogati
+ * Author URI: https://profiles.wordpress.org/gopalbogati/
+ * Text Domain: site-security-auditor
+ * Domain Path: /languages
  * Requires at least: 5.8
- * Tested up to:      6.8
- * Requires PHP:      7.4
- * License:           GPL-2.0+
+ * Requires PHP: 7.4
+ * License: GPL-2.0-or-later
  */
+if ( ! defined( 'ABSPATH' ) ) { exit; }
 define( 'SITESEAU_PLUGIN_FILE', __FILE__ );
 define( 'SITESEAU_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'SITESEAU_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
+require_once SITESEAU_PLUGIN_DIR . 'includes/class-scanner.php';
 
+class Siteseau_Site_Security_Auditor {
+        const OPT_HASHES = 'siteseau_hashes';
+        const OPT_HASHES_TIME = 'siteseau_hashes_time';
+        const OPT_REPORT = 'siteseau_report';
 
-if ( ! defined( 'ABSPATH' ) ) {
-        exit;
-}
-
-if ( ! class_exists( 'Siteseau_Site_Security_Auditor' ) ) :
-
-/**
- * Main plugin class.
- */
-class Siteseau_Site_Security_Auditor {
-
-        const OPT_HASHES      = 'siteseau_hashes';
-        const OPT_HASHES_TIME = 'siteseau_hashes_time';
-
-        /**
-         * Bootstrap.
-         */
         public static function init() {
                 add_action( 'admin_menu', array( __CLASS__, 'add_menu' ) );
+                add_action( 'admin_enqueue_scripts', array( __CLASS__, 'assets' ) );
                 add_action( 'admin_post_ssa_make_baseline', array( __CLASS__, 'handle_baseline' ) );
                 add_action( 'admin_post_ssa_run_scan', array( __CLASS__, 'handle_scan' ) );
+                add_action( 'admin_post_ssa_export', array( __CLASS__, 'handle_export' ) );
         }
-
-        /**
-         * Add Tools -> Security Audit page.
-         */
+        public static function capability() {
+                return is_multisite() ? 'manage_network_options' : 'manage_options';
+        }
         public static function add_menu() {
-                add_management_page(
-                        __( 'Security Audit', 'site-security-auditor' ),
-                        __( 'Security Audit', 'site-security-auditor' ),
-                        'manage_options',
-                        'site-security-auditor',
-                        array( __CLASS__, 'render_page' )
-                );
+                add_management_page( __( 'Security Audit', 'site-security-auditor' ), __( 'Security Audit', 'site-security-auditor' ), self::capability(), 'site-security-auditor', array( __CLASS__, 'render_page' ) );
         }
-
-        /**
-         * Create/update baseline handler.
-         */
+        public static function assets( $hook ) {
+                if ( 'tools_page_site-security-auditor' === $hook ) {
+                        wp_enqueue_style( 'siteseau-admin', SITESEAU_PLUGIN_URL . 'assets/admin.css', array(), '1.4.0' );
+                }
+        }
+        private static function authorize( $action ) {
+                if ( ! current_user_can( self::capability() ) || 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : '' ) ) {
+                        wp_die( esc_html__( 'You are not allowed to perform this action.', 'site-security-auditor' ), '', array( 'response' => 403 ) );
+                }
+                check_admin_referer( $action );
+        }
         public static function handle_baseline() {
-                if ( ! current_user_can( 'manage_options' ) ) {
-                        wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'site-security-auditor' ) );
-                }
-                check_admin_referer( 'ssa_make_baseline' );
-
-                $paths  = self::get_scan_paths();
-                $hashes = self::hash_paths( $paths );
-                update_option( self::OPT_HASHES, $hashes, false );
-                update_option( self::OPT_HASHES_TIME, time(), false );
-
-                wp_safe_redirect( add_query_arg( array( 'page' => 'site-security-auditor', 'ssa_msg' => 'baseline_done' ), admin_url( 'tools.php' ) ) );
+                self::authorize( 'ssa_make_baseline' );
+                self::run_audit( true );
+                self::redirect();
+        }
+        public static function handle_scan() {
+                self::authorize( 'ssa_run_scan' );
+                self::run_audit( false );
+                self::redirect();
+        }
+        private static function redirect() {
+                wp_safe_redirect( admin_url( 'tools.php?page=site-security-auditor' ) );
                 exit;
         }
-
-        /**
-         * Run scan handler.
-         */
-        public static function handle_scan() {
-                if ( ! current_user_can( 'manage_options' ) ) {
-                        wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'site-security-auditor' ) );
-                }
-                check_admin_referer( 'ssa_run_scan' );
-
-                wp_safe_redirect( add_query_arg( array( 'page' => 'site-security-auditor', 'ssa_scan' => '1' ), admin_url( 'tools.php' ) ) );
+        public static function handle_export() {
+                self::authorize( 'ssa_export' );
+                $report = get_option( self::OPT_REPORT, array() );
+                if ( ! $report ) { wp_die( esc_html__( 'Run a file check first.', 'site-security-auditor' ) ); }
+                nocache_headers();
+                header( 'Content-Type: application/json; charset=utf-8' );
+                header( 'Content-Disposition: attachment; filename="site-security-auditor-report.json"' );
+                echo wp_json_encode( $report, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES );
                 exit;
         }
-
-        /**
-         * Render admin page.
-         */
-        public static function render_page() {
-                if ( ! current_user_can( 'manage_options' ) ) {
-                        return;
+        protected static function scan_roots() {
+                global $wp_theme_directories;
+                $roots = array( 'wp-content/plugins' => WP_PLUGIN_DIR );
+                $themes = (array) $wp_theme_directories;
+                if ( ! $themes ) { $themes = array( WP_CONTENT_DIR . '/themes' ); }
+                foreach ( array_values( array_unique( $themes ) ) as $i => $path ) {
+                        $label = wp_normalize_path( $path ) === wp_normalize_path( WP_CONTENT_DIR . '/themes' ) ? 'wp-content/themes' : 'theme-root-' . $i;
+                        $roots[ $label ] = $path;
                 }
-
-                $plugins_info = self::collect_plugins_info();
-                $hardening    = self::hardening_checks();
-                $baseline_ts  = intval( get_option( self::OPT_HASHES_TIME, 0 ) );
-                $hashes       = get_option( self::OPT_HASHES, array() );
-                $scan_results = array();
-
-                if ( isset( $_GET['ssa_scan'] ) && '1' === $_GET['ssa_scan'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-                        $scan_results = self::compare_hashes( is_array( $hashes ) ? $hashes : array(), self::hash_paths( self::get_scan_paths() ) );
-                }
-
-                echo '<div class="wrap">';
-                echo '<h1>' . esc_html__( 'Security Audit Dashboard', 'site-security-auditor' ) . '</h1>';
-
-                if ( isset( $_GET['ssa_msg'] ) && 'baseline_done' === $_GET['ssa_msg'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-                        echo '<div class="notice notice-success"><p>' . esc_html__( 'File integrity baseline created/updated.', 'site-security-auditor' ) . '</p></div>';
-                }
-
-                // Plugins Risk Overview.
-                echo '<h2>' . esc_html__( 'Plugins Risk Overview', 'site-security-auditor' ) . '</h2>';
-                echo '<p>' . esc_html__( 'Flags plugins with updates available, last updated over a year ago, or inactive status.', 'site-security-auditor' ) . '</p>';
-                echo '<table class="widefat striped"><thead><tr>';
-                echo '<th>' . esc_html__( 'Plugin', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Version', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Status', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Update Available', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Last Updated', 'site-security-auditor' ) . '</th>';
-                echo '<th>' . esc_html__( 'Risk', 'site-security-auditor' ) . '</th>';
-                echo '</tr></thead><tbody>';
-
-                if ( empty( $plugins_info ) ) {
-                        echo '<tr><td colspan="6">' . esc_html__( 'No plugins found.', 'site-security-auditor' ) . '</td></tr>';
-                } else {
-                        foreach ( $plugins_info as $row ) {
-                                $risk_labels = array();
-                                if ( ! empty( $row['update_available'] ) ) {
-                                        $risk_labels[] = __( 'Update available', 'site-security-auditor' );
-                                }
-                                if ( ! empty( $row['stale'] ) ) {
-                                        $risk_labels[] = __( 'Stale (> 1 year)', 'site-security-auditor' );
-                                }
-                                if ( empty( $row['active'] ) ) {
-                                        $risk_labels[] = __( 'Inactive', 'site-security-auditor' );
-                                }
-                                echo '<tr>';
-                                echo '<td>' . esc_html( $row['name'] ) . '</td>';
-                                echo '<td>' . esc_html( $row['version'] ) . '</td>';
-                                echo '<td>' . ( ! empty( $row['active'] ) ? esc_html__( 'Active', 'site-security-auditor' ) : esc_html__( 'Inactive', 'site-security-auditor' ) ) . '</td>';
-                                echo '<td>' . ( ! empty( $row['update_available'] ) ? esc_html__( 'Yes', 'site-security-auditor' ) : esc_html__( 'No', 'site-security-auditor' ) ) . '</td>';
-                                echo '<td>' . esc_html( $row['last_updated'] ) . '</td>';
-                                echo '<td>' . ( $risk_labels ? esc_html( implode( ', ', $risk_labels ) ) : esc_html__( 'OK', 'site-security-auditor' ) ) . '</td>';
-                                echo '</tr>';
-                        }
-                }
-                echo '</tbody></table>';
-
-                // File Integrity Monitor.
-                echo '<hr /><h2>' . esc_html__( 'File Integrity Monitor', 'site-security-auditor' ) . '</h2>';
-                echo '<p>' . esc_html__( 'Create a hash baseline for plugins/themes and scan to detect added, modified or removed files.', 'site-security-auditor' ) . '</p>';
-
-                if ( $baseline_ts ) {
-                        /* translators: %s: date/time. */
-                        $baseline_text = sprintf( esc_html__( 'Baseline last updated: %s', 'site-security-auditor' ), wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $baseline_ts ) );
-                        echo '<p>' . esc_html( $baseline_text ) . '</p>';
-                } else {
-                        echo '<p>' . esc_html__( 'No baseline yet.', 'site-security-auditor' ) . '</p>';
-                }
-
-                echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" style="display:inline-block;margin-right:10px;">';
-                wp_nonce_field( 'ssa_make_baseline' );
-                echo '<input type="hidden" name="action" value="ssa_make_baseline" />';
-                echo '<button type="submit" class="button button-primary" onclick="return confirm(\'' . esc_js( __( 'Create/Update baseline now?', 'site-security-auditor' ) ) . '\');">' . esc_html__( 'Create/Update Baseline', 'site-security-auditor' ) . '</button>';
-                echo '</form>';
-
-                echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" style="display:inline-block;">';
-                wp_nonce_field( 'ssa_run_scan' );
-                echo '<input type="hidden" name="action" value="ssa_run_scan" />';
-                echo '<button type="submit" class="button">' . esc_html__( 'Scan Now', 'site-security-auditor' ) . '</button>';
-                echo '</form>';
-
-                if ( ! empty( $scan_results ) ) {
-                        echo '<h3 style="margin-top:20px;">' . esc_html__( 'Scan Results', 'site-security-auditor' ) . '</h3>';
-                        echo '<table class="widefat striped"><thead><tr><th>' . esc_html__( 'Change', 'site-security-auditor' ) . '</th><th>' . esc_html__( 'File', 'site-security-auditor' ) . '</th></tr></thead><tbody>';
-                        $printed = false;
-                        foreach ( array( 'added', 'modified', 'removed' ) as $key ) {
-                                if ( ! empty( $scan_results[ $key ] ) ) {
-                                        foreach ( $scan_results[ $key ] as $file ) {
-                                                echo '<tr><td>' . esc_html( ucfirst( $key ) ) . '</td><td>' . esc_html( $file ) . '</td></tr>';
-                                                $printed = true;
+                return $roots;
+        }
+        /** Protected operation, invoked only by the authorized POST handlers. */
+        protected static function run_audit( $make_baseline ) {
+                $lock = (int) get_option( 'siteseau_scan_lock', 0 );
+                if ( $lock && $lock < time() - 300 ) { delete_option( 'siteseau_scan_lock' ); }
+                if ( ! add_option( 'siteseau_scan_lock', time(), '', false ) ) { return; }
+                try {
+                        $baseline_time = (int) get_option( self::OPT_HASHES_TIME, 0 );
+                        $old = get_option( self::OPT_HASHES, array() );
+                        $scope = $make_baseline ? 2 : (int) get_option( 'siteseau_scope', 1 );
+                        $report = array( 'time' => time(), 'baseline_time' => $baseline_time, 'scope' => $scope, 'kind' => $make_baseline ? 'baseline' : 'comparison', 'complete' => false, 'files' => 0, 'issues' => array(), 'changes' => array() );
+                        if ( ! $make_baseline && ( ! $baseline_time || ! is_array( $old ) ) ) {
+                                $report['issues'][] = __( 'Create a trusted baseline before comparing files.', 'site-security-auditor' );
+                        } else {
+                                $limits = 1 === $scope ? array( 'extensions' => array( 'php', 'php7', 'phtml', 'inc', 'twig', 'json' ) ) : array();
+                                // Older releases scanned these fixed directories, even with custom plugin/theme roots.
+                                $roots = 1 === $scope ? array( 'wp-content/plugins' => WP_CONTENT_DIR . '/plugins', 'wp-content/themes' => WP_CONTENT_DIR . '/themes' ) : self::scan_roots();
+                                $scan = Siteseau_Scanner::scan( $roots, $limits );
+                                $report['complete'] = $scan['complete'];
+                                $report['files'] = count( $scan['hashes'] );
+                                $report['issues'] = $scan['issues'];
+                                if ( $scan['complete'] ) {
+                                        if ( $make_baseline ) {
+                                                update_option( self::OPT_HASHES, $scan['hashes'], false );
+                                                update_option( self::OPT_HASHES_TIME, $report['time'], false );
+                                                update_option( 'siteseau_scope', 2, false );
+                                                $report['baseline_time'] = $report['time'];
+                                        } else {
+                                                $report['changes'] = Siteseau_Scanner::compare( $old, $scan['hashes'] );
                                         }
                                 }
                         }
-                        if ( ! $printed ) {
-                                echo '<tr><td colspan="2">' . esc_html__( 'No changes detected.', 'site-security-auditor' ) . '</td></tr>';
-                        }
-                        echo '</tbody></table>';
+                        update_option( self::OPT_REPORT, $report, false );
+                } finally {
+                        delete_option( 'siteseau_scan_lock' );
                 }
-
-                // Hardening checks.
-                echo '<hr /><h2>' . esc_html__( 'Hardening Checks', 'site-security-auditor' ) . '</h2>';
-                echo '<table class="widefat striped"><thead><tr><th>' . esc_html__( 'Check', 'site-security-auditor' ) . '</th><th>' . esc_html__( 'Status', 'site-security-auditor' ) . '</th></tr></thead><tbody>';
-
-                echo '<tr><td>' . esc_html__( 'DISALLOW_FILE_EDIT', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['disallow_file_edit'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-                echo '<tr><td>' . esc_html__( 'FORCE_SSL_ADMIN', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['force_ssl_admin'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-                echo '<tr><td>' . esc_html__( 'Plugin auto-updates (general)', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['plugin_updates_enabled'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-                echo '<tr><td>' . esc_html__( 'XML-RPC availability', 'site-security-auditor' ) . '</td><td>' . ( ! empty( $hardening['xmlrpc_enabled'] ) ? esc_html__( 'Enabled', 'site-security-auditor' ) : esc_html__( 'Disabled', 'site-security-auditor' ) ) . '</td></tr>';
-
-                echo '</tbody></table>';
-                echo '</div>';
         }
-
-        /**
-         * Collect plugin info and risk signals.
-         *
-         * @return array
-         */
         protected static function collect_plugins_info() {
-                if ( ! function_exists( 'get_plugins' ) ) {
-                        require_once ABSPATH . 'wp-admin/includes/plugin.php';
+                if ( ! function_exists( 'get_plugins' ) ) { require_once ABSPATH . 'wp-admin/includes/plugin.php'; }
+                $updates = get_site_transient( 'update_plugins' );
+                $recent = is_object( $updates ) && ! empty( $updates->last_checked ) && $updates->last_checked > time() - 2 * DAY_IN_SECONDS;
+                $auto = (array) get_site_option( 'auto_update_plugins', array() );
+                $results = array();
+                foreach ( get_plugins() as $file => $data ) {
+                        $known = $recent && isset( $updates->checked[ $file ] ) && $updates->checked[ $file ] === $data['Version'] && ( isset( $updates->response[ $file ] ) || isset( $updates->no_update[ $file ] ) );
+                        $results[] = array(
+                                'name' => $data['Name'], 'version' => $data['Version'],
+                                'active' => is_plugin_active( $file ) || is_plugin_active_for_network( $file ),
+                                'update' => $known ? ( isset( $updates->response[ $file ] ) ? 'available' : 'none' ) : 'unknown',
+                                'auto' => in_array( $file, $auto, true ),
+                        );
                 }
-                $all_plugins = get_plugins();
-                $active      = get_option( 'active_plugins', array() );
-                $active_map  = array_fill_keys( $active, true );
-
-                $updates     = get_site_transient( 'update_plugins' );
-                $updates_map = array();
-                if ( isset( $updates->response ) && is_array( $updates->response ) ) {
-                        foreach ( $updates->response as $file => $obj ) {
-                                $updates_map[ $file ] = true;
-                        }
-                }
-
-                $results = array();
-                foreach ( $all_plugins as $file => $data ) {
-                        $slug = dirname( $file );
-                        $info = array(
-                                'name'            => isset( $data['Name'] ) ? $data['Name'] : $file,
-                                'version'         => isset( $data['Version'] ) ? $data['Version'] : '',
-                                'active'          => isset( $active_map[ $file ] ),
-                                'update_available'=> isset( $updates_map[ $file ] ),
-                                'last_updated'    => __( 'Unknown', 'site-security-auditor' ),
-                                'stale'           => false,
-                        );
-
-                        // Try wp.org API for last_updated.
-                        if ( ! function_exists( 'plugins_api' ) ) {
-                                
-                        }
-                        $args = array(
-                                'slug'   => $slug,
-                                'fields' => array( 'last_updated' => true ),
-                        );
-if ( is_admin() && ! function_exists( 'plugins_api' ) ) {
-        require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
-}
-                        $api = @plugins_api( 'plugin_information', $args ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
-                        if ( ! is_wp_error( $api ) && ! empty( $api->last_updated ) ) {
-                                $info['last_updated'] = mysql2date( get_option( 'date_format' ), $api->last_updated );
-                                $ts = strtotime( $api->last_updated );
-                                if ( $ts && ( time() - $ts ) > YEAR_IN_SECONDS ) {
-                                        $info['stale'] = true;
-                                }
-                        }
-
-                        $results[] = $info;
-                }
-
                 return $results;
         }
-
-        /**
-         * Directories to scan.
-         *
-         * @return array
-         */
-        protected static function get_scan_paths() {
+        protected static function hardening_checks() {
                 return array(
-                        WP_CONTENT_DIR . '/plugins',
-                        WP_CONTENT_DIR . '/themes',
+                        array( __( 'Encrypted website address', 'site-security-auditor' ), 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ), __( 'Use HTTPS for your public site. Ask your host to configure a certificate and redirects.', 'site-security-auditor' ) ),
+                        array( __( 'HTTPS required for administration', 'site-security-auditor' ), (bool) force_ssl_admin(), __( 'Ask your host to check FORCE_SSL_ADMIN and your HTTPS proxy configuration.', 'site-security-auditor' ) ),
+                        array( __( 'Dashboard code editing disabled', 'site-security-auditor' ), ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ) || ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ), __( 'Consider DISALLOW_FILE_EDIT in wp-config.php. Back up the file and ask your developer before editing it.', 'site-security-auditor' ) ),
+                        array( __( 'WordPress debug display off', 'site-security-auditor' ), ! ( defined( 'WP_DEBUG' ) && WP_DEBUG && ( ! defined( 'WP_DEBUG_DISPLAY' ) || WP_DEBUG_DISPLAY ) ), __( 'On production sites, keep WordPress debug messages out of public pages. Server-level error display needs a separate host check.', 'site-security-auditor' ) ),
                 );
         }
-
-        /**
-         * Hash files in given paths.
-         *
-         * @param array $paths Paths.
-         * @return array Map file => hash.
-         */
-        protected static function hash_paths( $paths ) {
-                $map = array();
-
-                foreach ( $paths as $path ) {
-                        if ( ! is_dir( $path ) ) {
-                                continue;
-                        }
-                        $iterator = new RecursiveIteratorIterator( new RecursiveDirectoryIterator( $path, FilesystemIterator::SKIP_DOTS ) );
-                        foreach ( $iterator as $file ) {
-                                /** @var SplFileInfo $file */
-                                $ext = strtolower( pathinfo( $file->getFilename(), PATHINFO_EXTENSION ) );
-                                if ( in_array( $ext, array( 'php', 'php7', 'phtml', 'inc', 'twig', 'json' ), true ) ) {
-                                        $real = $file->getPathname();
-                                        $rel  = ltrim( str_replace( WP_CONTENT_DIR, 'wp-content', $real ), '/' );
-                                        $hash = @hash_file( 'sha256', $real ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
-                                        if ( $hash ) {
-                                                $map[ $rel ] = $hash;
-                                        }
-                                }
-                        }
+        public static function render_page() {
+                if ( ! current_user_can( self::capability() ) ) { return; }
+                $plugins = self::collect_plugins_info();
+                $checks = self::hardening_checks();
+                $report = get_option( self::OPT_REPORT, array() );
+                $baseline_time = (int) get_option( self::OPT_HASHES_TIME, 0 );
+                $updates = count( array_filter( $plugins, function( $row ) { return 'available' === $row['update']; } ) );
+                $review = count( array_filter( $checks, function( $row ) { return ! $row[1]; } ) );
+                require SITESEAU_PLUGIN_DIR . 'includes/dashboard.php';
+        }
+        public static function action_form( $action, $label, $disabled = false, $confirm = false ) {
+                echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" class="ssa-action">';
+                wp_nonce_field( $action );
+                echo '<input type="hidden" name="action" value="' . esc_attr( $action ) . '">';
+                if ( $confirm ) {
+                        echo '<label class="ssa-confirm"><input type="checkbox" required> ' . esc_html__( 'I have reviewed this site and trust its current files. This replaces the previous baseline.', 'site-security-auditor' ) . '</label>';
                 }
-                ksort( $map );
-                return $map;
-        }
-
-        /**
-         * Compare old and new hash maps.
-         *
-         * @param array $old Old.
-         * @param array $new New.
-         * @return array
-         */
-        protected static function compare_hashes( $old, $new ) {
-                $old = is_array( $old ) ? $old : array();
-                $new = is_array( $new ) ? $new : array();
-
-                $added    = array_diff_key( $new, $old );
-                $removed  = array_diff_key( $old, $new );
-                $modified = array();
-
-                $common = array_intersect_key( $new, $old );
-                foreach ( $common as $file => $hash ) {
-                        if ( $old[ $file ] !== $hash ) {
-                                $modified[ $file ] = $hash;
-                        }
-                }
-
-                return array(
-                        'added'    => array_keys( $added ),
-                        'modified' => array_keys( $modified ),
-                        'removed'  => array_keys( $removed ),
-                );
-        }
-
-        /**
-         * Hardening checks.
-         *
-         * @return array
-         */
-        protected static function hardening_checks() {
-                // Generic on/off for auto-updates by type (does not hook into filters).
-                $auto_plugins = function_exists( 'wp_is_auto_update_enabled_for_type' ) ? (bool) wp_is_auto_update_enabled_for_type( 'plugin' ) : false;
-                $xmlrpc_on    = apply_filters( 'xmlrpc_enabled', true );
-
-                return array(
-                        'disallow_file_edit' => defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT,
-                        'force_ssl_admin'    => defined( 'FORCE_SSL_ADMIN' ) && FORCE_SSL_ADMIN,
-                        'plugin_updates_enabled'=> $auto_plugins,
-                        'xmlrpc_enabled'     => (bool) $xmlrpc_on,
-                );
+                echo '<button class="button ' . ( 'ssa_run_scan' === $action ? 'button-primary' : '' ) . '" type="submit"' . disabled( $disabled, true, false ) . '>' . esc_html( $label ) . '</button></form>';
         }
 }
-
 Siteseau_Site_Security_Auditor::init();
-
-endif;