Site Health Checks for Weak Security Settings

add_filter( 'site_status_tests', function ( $tests ) {
    $result = function ( $id, $ok, $good, $bad, $fix, $level = 'recommended' ) {
        return array(
            'label'       => $ok ? $good : $bad,
            'status'      => $ok ? 'good' : $level,
            'badge'       => array( 'label' => 'Security', 'color' => $ok ? 'blue' : 'orange' ),
            'description' => '<p>' . esc_html( $ok ? $good . '.' : $fix ) . '</p>',
            'test'        => $id,
        );
    };

    $tests['direct']['wpide_salts'] = array(
        'label' => 'Security keys',
        'test'  => function () use ( $result ) {
            $values = array();
            foreach ( array( 'AUTH_KEY', 'SECURE_AUTH_KEY', 'LOGGED_IN_KEY', 'NONCE_KEY', 'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT' ) as $name ) {
                $values[] = defined( $name ) ? (string) constant( $name ) : '';
            }
            $weak = array_filter( $values, function ( $v ) {
                return strlen( $v ) < 32 || false !== stripos( $v, 'put your unique phrase here' );
            } );
            $ok = ! $weak && count( array_unique( $values ) ) === count( $values );

            return $result( 'wpide_salts', $ok, 'Security keys are unique and long', 'Security keys are weak or missing', 'Generate new keys at api.wordpress.org/secret-key/1.1/salt/ and replace the ones in wp-config.php. Everyone will be logged out once.', 'critical' );
        },
    );

    $tests['direct']['wpide_admin_user'] = array(
        'label' => 'Admin username',
        'test'  => function () use ( $result ) {
            return $result( 'wpide_admin_user', ! username_exists( 'admin' ), 'No account uses the username "admin"', 'An account uses the username "admin"', 'Attackers try "admin" first. Create a new administrator with a different username, log in with it and delete the old account, attributing its content to the new one.' );
        },
    );

    $tests['direct']['wpide_file_edit'] = array(
        'label' => 'File editor',
        'test'  => function () use ( $result ) {
            $ok = ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ) || ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS );
            return $result( 'wpide_file_edit', $ok, 'The theme and plugin file editor is disabled', 'The theme and plugin file editor is enabled', "Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php so a stolen admin login cannot be used to edit PHP files." );
        },
    );

    $tests['direct']['wpide_config_perms'] = array(
        'label' => 'wp-config.php permissions',
        'test'  => function () use ( $result ) {
            $file = file_exists( ABSPATH . 'wp-config.php' ) ? ABSPATH . 'wp-config.php' : dirname( ABSPATH ) . '/wp-config.php';
            $ok   = ! file_exists( $file ) || 0 === ( fileperms( $file ) & 0007 );
            return $result( 'wpide_config_perms', $ok, 'wp-config.php is not readable by other users on the server', 'wp-config.php can be read by any user on the server', 'Change the file permissions of wp-config.php to 640 or 600 so other accounts on a shared server cannot read your database password.' );
        },
    );

    return $tests;
} );