| [ Index ] |
PHP Cross Reference of WordPress Trunk (Updated Daily) |
[Summary view] [Print] [Text view]
1 <?php 2 /** 3 * Class for looking up a site's health based on a user's WordPress environment. 4 * 5 * @package WordPress 6 * @subpackage Site_Health 7 * @since 5.2.0 8 */ 9 10 #[AllowDynamicProperties] 11 class WP_Site_Health { 12 private static $instance = null; 13 14 private $is_acceptable_mysql_version; 15 private $is_recommended_mysql_version; 16 17 public $is_mariadb = false; 18 private $mysql_server_version = ''; 19 private $mysql_required_version = '5.5'; 20 private $mysql_recommended_version = '8.0'; 21 private $mariadb_recommended_version = '10.11'; 22 23 public $php_memory_limit; 24 25 public $schedules; 26 public $crons; 27 public $last_missed_cron = null; 28 public $last_late_cron = null; 29 private $timeout_missed_cron = null; 30 private $timeout_late_cron = null; 31 32 /** 33 * WP_Site_Health constructor. 34 * 35 * @since 5.2.0 36 */ 37 public function __construct() { 38 $this->maybe_create_scheduled_event(); 39 40 // Save memory limit before it's affected by wp_raise_memory_limit( 'admin' ). 41 $this->php_memory_limit = ini_get( 'memory_limit' ); 42 43 $this->timeout_late_cron = 0; 44 $this->timeout_missed_cron = - 5 * MINUTE_IN_SECONDS; 45 46 if ( defined( 'DISABLE_WP_CRON' ) && DISABLE_WP_CRON ) { 47 $this->timeout_late_cron = - 15 * MINUTE_IN_SECONDS; 48 $this->timeout_missed_cron = - 1 * HOUR_IN_SECONDS; 49 } 50 51 add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) ); 52 53 add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_scripts' ) ); 54 add_action( 'wp_site_health_scheduled_check', array( $this, 'wp_cron_scheduled_check' ) ); 55 56 add_action( 'site_health_tab_content', array( $this, 'show_site_health_tab' ) ); 57 } 58 59 /** 60 * Outputs the content of a tab in the Site Health screen. 61 * 62 * @since 5.8.0 63 * 64 * @param string $tab Slug of the current tab being displayed. 65 */ 66 public function show_site_health_tab( $tab ) { 67 if ( 'debug' === $tab ) { 68 require_once ABSPATH . 'wp-admin/site-health-info.php'; 69 } 70 } 71 72 /** 73 * Returns an instance of the WP_Site_Health class, or create one if none exist yet. 74 * 75 * @since 5.4.0 76 * 77 * @return WP_Site_Health|null 78 */ 79 public static function get_instance() { 80 self::$instance ??= new WP_Site_Health(); 81 82 return self::$instance; 83 } 84 85 /** 86 * Enqueues the site health scripts. 87 * 88 * @since 5.2.0 89 */ 90 public function enqueue_scripts() { 91 $screen = get_current_screen(); 92 if ( 'site-health' !== $screen->id && 'dashboard' !== $screen->id ) { 93 return; 94 } 95 96 $health_check_js_variables = array( 97 'screen' => $screen->id, 98 'nonce' => array( 99 'site_status' => wp_create_nonce( 'health-check-site-status' ), 100 'site_status_result' => wp_create_nonce( 'health-check-site-status-result' ), 101 ), 102 'site_status' => array( 103 'direct' => array(), 104 'async' => array(), 105 'issues' => array( 106 'good' => 0, 107 'recommended' => 0, 108 'critical' => 0, 109 ), 110 ), 111 ); 112 113 $issue_counts = get_transient( 'health-check-site-status-result' ); 114 115 if ( false !== $issue_counts ) { 116 $issue_counts = json_decode( $issue_counts ); 117 118 $health_check_js_variables['site_status']['issues'] = $issue_counts; 119 } 120 121 if ( 'site-health' === $screen->id && ( ! isset( $_GET['tab'] ) || empty( $_GET['tab'] ) ) ) { 122 $tests = WP_Site_Health::get_tests(); 123 124 // Don't run https test on development environments. 125 if ( $this->is_development_environment() ) { 126 unset( $tests['async']['https_status'] ); 127 } 128 129 foreach ( $tests['direct'] as $test ) { 130 if ( is_string( $test['test'] ) ) { 131 $test_function = sprintf( 132 'get_test_%s', 133 $test['test'] 134 ); 135 136 if ( method_exists( $this, $test_function ) && is_callable( array( $this, $test_function ) ) ) { 137 $health_check_js_variables['site_status']['direct'][] = $this->perform_test( array( $this, $test_function ) ); 138 continue; 139 } 140 } 141 142 if ( is_callable( $test['test'] ) ) { 143 $health_check_js_variables['site_status']['direct'][] = $this->perform_test( $test['test'] ); 144 } 145 } 146 147 foreach ( $tests['async'] as $test ) { 148 if ( is_string( $test['test'] ) ) { 149 $health_check_js_variables['site_status']['async'][] = array( 150 'test' => $test['test'], 151 'has_rest' => $test['has_rest'] ?? false, 152 'completed' => false, 153 'headers' => $test['headers'] ?? array(), 154 ); 155 } 156 } 157 } 158 159 wp_localize_script( 'site-health', 'SiteHealth', $health_check_js_variables ); 160 } 161 162 /** 163 * Runs a Site Health test directly. 164 * 165 * @since 5.4.0 166 * 167 * @param callable $callback 168 * @return array{ 169 * label: string, 170 * status: 'good'|'recommended'|'critical', 171 * badge: array{ 172 * label: string, 173 * color: string, 174 * }, 175 * description: string, 176 * actions: string, 177 * test: string, 178 * } 179 */ 180 private function perform_test( $callback ) { 181 /** 182 * Filters the output of a finished Site Health test. 183 * 184 * @since 5.3.0 185 * 186 * @param array $test_result { 187 * An associative array of test result data. 188 * 189 * @type string $label A label describing the test, and is used as a header in the output. 190 * @type string $status The status of the test, which can be a value of `good`, `recommended` or `critical`. 191 * @type array $badge { 192 * Tests are put into categories which have an associated badge shown, these can be modified and assigned here. 193 * 194 * @type string $label The test label, for example `Performance`. 195 * @type string $color Default `blue`. A string representing a color to use for the label. 196 * } 197 * @type string $description A more descriptive explanation of what the test looks for, and why it is important for the end user. 198 * @type string $actions An action to direct the user to where they can resolve the issue, if one exists. 199 * @type string $test The name of the test being ran, used as a reference point. 200 * } 201 */ 202 return apply_filters( 'site_status_test_result', call_user_func( $callback ) ); 203 } 204 205 /** 206 * Runs the SQL version checks. 207 * 208 * These values are used in later tests, but the part of preparing them is more easily managed 209 * early in the class for ease of access and discovery. 210 * 211 * @since 5.2.0 212 * 213 * @global wpdb $wpdb WordPress database abstraction object. 214 */ 215 private function prepare_sql_data() { 216 global $wpdb; 217 218 $mysql_server_type = $wpdb->db_server_info(); 219 220 $this->mysql_server_version = $wpdb->get_var( 'SELECT VERSION()' ); 221 222 if ( stristr( $mysql_server_type, 'mariadb' ) ) { 223 $this->is_mariadb = true; 224 $this->mysql_recommended_version = $this->mariadb_recommended_version; 225 } 226 227 $this->is_acceptable_mysql_version = version_compare( $this->mysql_required_version, $this->mysql_server_version, '<=' ); 228 $this->is_recommended_mysql_version = version_compare( $this->mysql_recommended_version, $this->mysql_server_version, '<=' ); 229 } 230 231 /** 232 * Tests whether `wp_version_check` is blocked. 233 * 234 * It's possible to block updates with the `wp_version_check` filter, but this can't be checked 235 * during an Ajax call, as the filter is never introduced then. 236 * 237 * This filter overrides a standard page request if it's made by an admin through the Ajax call 238 * with the right query argument to check for this. 239 * 240 * @since 5.2.0 241 */ 242 public function check_wp_version_check_exists() { 243 if ( ! is_admin() || ! is_user_logged_in() || ! current_user_can( 'update_core' ) || ! isset( $_GET['health-check-test-wp_version_check'] ) ) { 244 return; 245 } 246 247 echo ( has_filter( 'wp_version_check', 'wp_version_check' ) ? 'yes' : 'no' ); 248 249 die(); 250 } 251 252 /** 253 * Tests for WordPress version and outputs it. 254 * 255 * Gives various results depending on what kind of updates are available, if any, to encourage 256 * the user to install security updates as a priority. 257 * 258 * @since 5.2.0 259 * 260 * @return array The test result. 261 */ 262 public function get_test_wordpress_version() { 263 $result = array( 264 'label' => '', 265 'status' => '', 266 'badge' => array( 267 'label' => __( 'Performance' ), 268 'color' => 'blue', 269 ), 270 'description' => '', 271 'actions' => '', 272 'test' => 'wordpress_version', 273 ); 274 275 $core_current_version = wp_get_wp_version(); 276 $core_updates = get_core_updates(); 277 278 if ( ! is_array( $core_updates ) ) { 279 $result['status'] = 'recommended'; 280 281 $result['label'] = sprintf( 282 /* translators: %s: Your current version of WordPress. */ 283 __( 'WordPress version %s' ), 284 $core_current_version 285 ); 286 287 $result['description'] = sprintf( 288 '<p>%s</p>', 289 __( 'Unable to check if any new versions of WordPress are available.' ) 290 ); 291 292 $result['actions'] = sprintf( 293 '<a href="%s">%s</a>', 294 esc_url( admin_url( 'update-core.php?force-check=1' ) ), 295 __( 'Check for updates manually' ) 296 ); 297 } else { 298 foreach ( $core_updates as $core => $update ) { 299 if ( 'upgrade' === $update->response ) { 300 $current_version = explode( '.', $core_current_version ); 301 $new_version = explode( '.', $update->version ); 302 303 $current_major = $current_version[0] . '.' . $current_version[1]; 304 $new_major = $new_version[0] . '.' . $new_version[1]; 305 306 $result['label'] = sprintf( 307 /* translators: %s: The latest version of WordPress available. */ 308 __( 'WordPress update available (%s)' ), 309 $update->version 310 ); 311 312 $result['actions'] = sprintf( 313 '<a href="%s">%s</a>', 314 esc_url( admin_url( 'update-core.php' ) ), 315 __( 'Install the latest version of WordPress' ) 316 ); 317 318 if ( $current_major !== $new_major ) { 319 // This is a major version mismatch. 320 $result['status'] = 'recommended'; 321 $result['description'] = sprintf( 322 '<p>%s</p>', 323 __( 'A new version of WordPress is available.' ) 324 ); 325 } else { 326 // This is a minor version, sometimes considered more critical. 327 $result['status'] = 'critical'; 328 $result['badge']['label'] = __( 'Security' ); 329 $result['description'] = sprintf( 330 '<p>%s</p>', 331 __( 'A new minor update is available for your site. Because minor updates often address security, it’s important to install them.' ) 332 ); 333 } 334 } else { 335 $result['status'] = 'good'; 336 $result['label'] = sprintf( 337 /* translators: %s: The current version of WordPress installed on this site. */ 338 __( 'Your version of WordPress (%s) is up to date' ), 339 $core_current_version 340 ); 341 342 $result['description'] = sprintf( 343 '<p>%s</p>', 344 __( 'You are currently running the latest version of WordPress available, keep it up!' ) 345 ); 346 } 347 } 348 } 349 350 return $result; 351 } 352 353 /** 354 * Tests if plugins are outdated, or unnecessary. 355 * 356 * The test checks if your plugins are up to date, and encourages you to remove any 357 * that are not in use. 358 * 359 * @since 5.2.0 360 * 361 * @return array The test result. 362 */ 363 public function get_test_plugin_version() { 364 $result = array( 365 'label' => __( 'Your plugins are all up to date' ), 366 'status' => 'good', 367 'badge' => array( 368 'label' => __( 'Security' ), 369 'color' => 'blue', 370 ), 371 'description' => sprintf( 372 '<p>%s</p>', 373 __( 'Plugins extend your site’s functionality with things like contact forms, ecommerce and much more. That means they have deep access to your site, so it’s vital to keep them up to date.' ) 374 ), 375 'actions' => sprintf( 376 '<p><a href="%s">%s</a></p>', 377 esc_url( admin_url( 'plugins.php' ) ), 378 __( 'Manage your plugins' ) 379 ), 380 'test' => 'plugin_version', 381 ); 382 383 $plugins = get_plugins(); 384 $plugin_updates = get_plugin_updates(); 385 386 $plugins_active = 0; 387 $plugins_total = 0; 388 $plugins_need_update = 0; 389 390 // Loop over the available plugins and check their versions and active state. 391 foreach ( $plugins as $plugin_path => $plugin ) { 392 ++$plugins_total; 393 394 if ( is_plugin_active( $plugin_path ) ) { 395 ++$plugins_active; 396 } 397 398 if ( array_key_exists( $plugin_path, $plugin_updates ) ) { 399 ++$plugins_need_update; 400 } 401 } 402 403 // Add a notice if there are outdated plugins. 404 if ( $plugins_need_update > 0 ) { 405 $result['status'] = 'critical'; 406 407 $result['label'] = __( 'You have plugins waiting to be updated' ); 408 409 $result['description'] .= sprintf( 410 '<p>%s</p>', 411 sprintf( 412 /* translators: %d: The number of outdated plugins. */ 413 _n( 414 'Your site has %d plugin waiting to be updated.', 415 'Your site has %d plugins waiting to be updated.', 416 $plugins_need_update 417 ), 418 $plugins_need_update 419 ) 420 ); 421 422 $result['actions'] .= sprintf( 423 '<p><a href="%s">%s</a></p>', 424 esc_url( network_admin_url( 'plugins.php?plugin_status=upgrade' ) ), 425 __( 'Update your plugins' ) 426 ); 427 } else { 428 if ( 1 === $plugins_active ) { 429 $result['description'] .= sprintf( 430 '<p>%s</p>', 431 __( 'Your site has 1 active plugin, and it is up to date.' ) 432 ); 433 } elseif ( $plugins_active > 0 ) { 434 $result['description'] .= sprintf( 435 '<p>%s</p>', 436 sprintf( 437 /* translators: %d: The number of active plugins. */ 438 _n( 439 'Your site has %d active plugin, and it is up to date.', 440 'Your site has %d active plugins, and they are all up to date.', 441 $plugins_active 442 ), 443 $plugins_active 444 ) 445 ); 446 } else { 447 $result['description'] .= sprintf( 448 '<p>%s</p>', 449 __( 'Your site does not have any active plugins.' ) 450 ); 451 } 452 } 453 454 // Check if there are inactive plugins. 455 if ( $plugins_total > $plugins_active && ! is_multisite() ) { 456 $unused_plugins = $plugins_total - $plugins_active; 457 458 $result['status'] = 'recommended'; 459 460 $result['label'] = __( 'You should remove inactive plugins' ); 461 462 $result['description'] .= sprintf( 463 '<p>%s %s</p>', 464 sprintf( 465 /* translators: %d: The number of inactive plugins. */ 466 _n( 467 'Your site has %d inactive plugin.', 468 'Your site has %d inactive plugins.', 469 $unused_plugins 470 ), 471 $unused_plugins 472 ), 473 __( 'Inactive plugins are tempting targets for attackers. If you are not going to use a plugin, you should consider removing it.' ) 474 ); 475 476 $result['actions'] .= sprintf( 477 '<p><a href="%s">%s</a></p>', 478 esc_url( admin_url( 'plugins.php?plugin_status=inactive' ) ), 479 __( 'Manage inactive plugins' ) 480 ); 481 } 482 483 return $result; 484 } 485 486 /** 487 * Tests if themes are outdated, or unnecessary. 488 * 489 * Checks if your site has a default theme (to fall back on if there is a need), 490 * if your themes are up to date and, finally, encourages you to remove any themes 491 * that are not needed. 492 * 493 * @since 5.2.0 494 * 495 * @return array The test results. 496 */ 497 public function get_test_theme_version() { 498 $result = array( 499 'label' => __( 'Your themes are all up to date' ), 500 'status' => 'good', 501 'badge' => array( 502 'label' => __( 'Security' ), 503 'color' => 'blue', 504 ), 505 'description' => sprintf( 506 '<p>%s</p>', 507 __( 'Themes add your site’s look and feel. It’s important to keep them up to date, to stay consistent with your brand and keep your site secure.' ) 508 ), 509 'actions' => sprintf( 510 '<p><a href="%s">%s</a></p>', 511 esc_url( admin_url( 'themes.php' ) ), 512 __( 'Manage your themes' ) 513 ), 514 'test' => 'theme_version', 515 ); 516 517 $theme_updates = get_theme_updates(); 518 519 $themes_total = 0; 520 $themes_need_updates = 0; 521 $themes_inactive = 0; 522 523 // This value is changed during processing to determine how many themes are considered a reasonable amount. 524 $allowed_theme_count = 1; 525 526 $has_default_theme = false; 527 $has_unused_themes = false; 528 $show_unused_themes = true; 529 $using_default_theme = false; 530 531 // Populate a list of all themes available in the install. 532 $all_themes = wp_get_themes(); 533 $active_theme = wp_get_theme(); 534 535 // If WP_DEFAULT_THEME doesn't exist, fall back to the latest core default theme. 536 $default_theme = wp_get_theme( WP_DEFAULT_THEME ); 537 if ( ! $default_theme->exists() ) { 538 $default_theme = WP_Theme::get_core_default_theme(); 539 } 540 541 if ( $default_theme ) { 542 $has_default_theme = true; 543 544 if ( 545 $active_theme->get_stylesheet() === $default_theme->get_stylesheet() 546 || 547 is_child_theme() && $active_theme->get_template() === $default_theme->get_template() 548 ) { 549 $using_default_theme = true; 550 } 551 } 552 553 foreach ( $all_themes as $theme_slug => $theme ) { 554 ++$themes_total; 555 556 if ( array_key_exists( $theme_slug, $theme_updates ) ) { 557 ++$themes_need_updates; 558 } 559 } 560 561 // If this is a child theme, increase the allowed theme count by one, to account for the parent. 562 if ( is_child_theme() ) { 563 ++$allowed_theme_count; 564 } 565 566 // If there's a default theme installed and not in use, we count that as allowed as well. 567 if ( $has_default_theme && ! $using_default_theme ) { 568 ++$allowed_theme_count; 569 } 570 571 if ( $themes_total > $allowed_theme_count ) { 572 $has_unused_themes = true; 573 $themes_inactive = ( $themes_total - $allowed_theme_count ); 574 } 575 576 // Check if any themes need to be updated. 577 if ( $themes_need_updates > 0 ) { 578 $result['status'] = 'critical'; 579 580 $result['label'] = __( 'You have themes waiting to be updated' ); 581 582 $result['description'] .= sprintf( 583 '<p>%s</p>', 584 sprintf( 585 /* translators: %d: The number of outdated themes. */ 586 _n( 587 'Your site has %d theme waiting to be updated.', 588 'Your site has %d themes waiting to be updated.', 589 $themes_need_updates 590 ), 591 $themes_need_updates 592 ) 593 ); 594 } else { 595 // Give positive feedback about the site being good about keeping things up to date. 596 if ( 1 === $themes_total ) { 597 $result['description'] .= sprintf( 598 '<p>%s</p>', 599 __( 'Your site has 1 installed theme, and it is up to date.' ) 600 ); 601 } elseif ( $themes_total > 0 ) { 602 $result['description'] .= sprintf( 603 '<p>%s</p>', 604 sprintf( 605 /* translators: %d: The number of themes. */ 606 _n( 607 'Your site has %d installed theme, and it is up to date.', 608 'Your site has %d installed themes, and they are all up to date.', 609 $themes_total 610 ), 611 $themes_total 612 ) 613 ); 614 } else { 615 $result['description'] .= sprintf( 616 '<p>%s</p>', 617 __( 'Your site does not have any installed themes.' ) 618 ); 619 } 620 } 621 622 if ( $has_unused_themes && $show_unused_themes && ! is_multisite() ) { 623 624 // This is a child theme, so we want to be a bit more explicit in our messages. 625 if ( $active_theme->parent() ) { 626 // Recommend removing inactive themes, except a default theme, your current one, and the parent theme. 627 $result['status'] = 'recommended'; 628 629 $result['label'] = __( 'You should remove inactive themes' ); 630 631 if ( $using_default_theme ) { 632 $result['description'] .= sprintf( 633 '<p>%s %s</p>', 634 sprintf( 635 /* translators: %d: The number of inactive themes. */ 636 _n( 637 'Your site has %d inactive theme.', 638 'Your site has %d inactive themes.', 639 $themes_inactive 640 ), 641 $themes_inactive 642 ), 643 sprintf( 644 /* translators: 1: The currently active theme. 2: The active theme's parent theme. */ 645 __( 'To enhance your site’s security, you should consider removing any themes you are not using. You should keep your active theme, %1$s, and %2$s, its parent theme.' ), 646 $active_theme->name, 647 $active_theme->parent()->name 648 ) 649 ); 650 } else { 651 $result['description'] .= sprintf( 652 '<p>%s %s</p>', 653 sprintf( 654 /* translators: %d: The number of inactive themes. */ 655 _n( 656 'Your site has %d inactive theme.', 657 'Your site has %d inactive themes.', 658 $themes_inactive 659 ), 660 $themes_inactive 661 ), 662 sprintf( 663 /* translators: 1: The default theme for WordPress. 2: The currently active theme. 3: The active theme's parent theme. */ 664 __( 'To enhance your site’s security, you should consider removing any themes you are not using. You should keep %1$s, the default WordPress theme, %2$s, your active theme, and %3$s, its parent theme.' ), 665 $default_theme ? $default_theme->name : WP_DEFAULT_THEME, 666 $active_theme->name, 667 $active_theme->parent()->name 668 ) 669 ); 670 } 671 } else { 672 // Recommend removing all inactive themes. 673 $result['status'] = 'recommended'; 674 675 $result['label'] = __( 'You should remove inactive themes' ); 676 677 if ( $using_default_theme ) { 678 $result['description'] .= sprintf( 679 '<p>%s %s</p>', 680 sprintf( 681 /* translators: 1: The amount of inactive themes. 2: The currently active theme. */ 682 _n( 683 'Your site has %1$d inactive theme, other than %2$s, your active theme.', 684 'Your site has %1$d inactive themes, other than %2$s, your active theme.', 685 $themes_inactive 686 ), 687 $themes_inactive, 688 $active_theme->name 689 ), 690 __( 'You should consider removing any unused themes to enhance your site’s security.' ) 691 ); 692 } else { 693 $result['description'] .= sprintf( 694 '<p>%s %s</p>', 695 sprintf( 696 /* translators: 1: The amount of inactive themes. 2: The default theme for WordPress. 3: The currently active theme. */ 697 _n( 698 'Your site has %1$d inactive theme, other than %2$s, the default WordPress theme, and %3$s, your active theme.', 699 'Your site has %1$d inactive themes, other than %2$s, the default WordPress theme, and %3$s, your active theme.', 700 $themes_inactive 701 ), 702 $themes_inactive, 703 $default_theme ? $default_theme->name : WP_DEFAULT_THEME, 704 $active_theme->name 705 ), 706 __( 'You should consider removing any unused themes to enhance your site’s security.' ) 707 ); 708 } 709 } 710 } 711 712 // If no default Twenty* theme exists. 713 if ( ! $has_default_theme ) { 714 $result['status'] = 'recommended'; 715 716 $result['label'] = __( 'Have a default theme available' ); 717 718 $result['description'] .= sprintf( 719 '<p>%s</p>', 720 __( 'Your site does not have any default theme. Default themes are used by WordPress automatically if anything is wrong with your chosen theme.' ) 721 ); 722 } 723 724 return $result; 725 } 726 727 /** 728 * Tests if the supplied PHP version is supported. 729 * 730 * @since 5.2.0 731 * 732 * @return array The test results. 733 */ 734 public function get_test_php_version() { 735 $response = wp_check_php_version(); 736 737 $result = array( 738 'label' => sprintf( 739 /* translators: %s: The server PHP version. */ 740 __( 'Your site is running PHP %s' ), 741 PHP_VERSION 742 ), 743 'status' => 'good', 744 'badge' => array( 745 'label' => __( 'Performance' ), 746 'color' => 'blue', 747 ), 748 'description' => sprintf( 749 '<p>%s</p>', 750 __( 'PHP is one of the programming languages used to build WordPress. Newer versions of PHP receive regular security updates and may increase your site’s performance.' ) 751 ), 752 'actions' => sprintf( 753 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 754 esc_url( wp_get_update_php_url() ), 755 __( 'Learn more about updating PHP' ), 756 /* translators: Hidden accessibility text. */ 757 __( '(opens in a new tab)' ) 758 ), 759 'test' => 'php_version', 760 ); 761 762 if ( ! $response ) { 763 $result['label'] = sprintf( 764 /* translators: %s: The server PHP version. */ 765 __( 'Unable to determine the status of the current PHP version (%s)' ), 766 PHP_VERSION 767 ); 768 $result['status'] = 'recommended'; 769 $result['description'] = '<p><em>' . sprintf( 770 /* translators: %s is the URL to the Serve Happy docs page. */ 771 __( 'Unable to access the WordPress.org API for <a href="%s">Serve Happy</a>.' ), 772 'https://codex.wordpress.org/WordPress.org_API#Serve_Happy' 773 ) . '</em></p>' . $result['description']; 774 return $result; 775 } 776 777 $result['description'] .= '<p>' . sprintf( 778 /* translators: %s: The minimum recommended PHP version. */ 779 __( 'The minimum recommended version of PHP is %s.' ), 780 $response['recommended_version'] 781 ) . '</p>'; 782 783 // PHP is up to date. 784 if ( version_compare( PHP_VERSION, $response['recommended_version'], '>=' ) ) { 785 $result['label'] = sprintf( 786 /* translators: %s: The server PHP version. */ 787 __( 'Your site is running a recommended version of PHP (%s)' ), 788 PHP_VERSION 789 ); 790 $result['status'] = 'good'; 791 792 return $result; 793 } 794 795 // The PHP version is older than the recommended version, but still receiving active support. 796 if ( $response['is_supported'] ) { 797 $result['label'] = sprintf( 798 /* translators: %s: The server PHP version. */ 799 __( 'Your site is running on an older version of PHP (%s)' ), 800 PHP_VERSION 801 ); 802 $result['status'] = 'recommended'; 803 804 return $result; 805 } 806 807 /* 808 * The PHP version is still receiving security fixes, but is lower than 809 * the expected minimum version that will be required by WordPress in the near future. 810 */ 811 if ( $response['is_secure'] && $response['is_lower_than_future_minimum'] ) { 812 // The `is_secure` array key name doesn't actually imply this is a secure version of PHP. It only means it receives security updates. 813 814 $result['label'] = sprintf( 815 /* translators: %s: The server PHP version. */ 816 __( 'Your site is running on an outdated version of PHP (%s), which soon will not be supported by WordPress.' ), 817 PHP_VERSION 818 ); 819 820 $result['status'] = 'critical'; 821 $result['badge']['label'] = __( 'Requirements' ); 822 823 return $result; 824 } 825 826 // The PHP version is only receiving security fixes. 827 if ( $response['is_secure'] ) { 828 $result['label'] = sprintf( 829 /* translators: %s: The server PHP version. */ 830 __( 'Your site is running on an older version of PHP (%s), which should be updated' ), 831 PHP_VERSION 832 ); 833 $result['status'] = 'recommended'; 834 835 return $result; 836 } 837 838 // No more security updates for the PHP version, and lower than the expected minimum version required by WordPress. 839 if ( $response['is_lower_than_future_minimum'] ) { 840 $message = sprintf( 841 /* translators: %s: The server PHP version. */ 842 __( 'Your site is running on an outdated version of PHP (%s), which does not receive security updates and soon will not be supported by WordPress.' ), 843 PHP_VERSION 844 ); 845 } else { 846 // No more security updates for the PHP version, must be updated. 847 $message = sprintf( 848 /* translators: %s: The server PHP version. */ 849 __( 'Your site is running on an outdated version of PHP (%s), which does not receive security updates. It should be updated.' ), 850 PHP_VERSION 851 ); 852 } 853 854 $result['label'] = $message; 855 $result['status'] = 'critical'; 856 857 $result['badge']['label'] = __( 'Security' ); 858 859 return $result; 860 } 861 862 /** 863 * Checks if the passed extension or function are available. 864 * 865 * Make the check for available PHP modules into a simple boolean operator for a cleaner test runner. 866 * 867 * @since 5.2.0 868 * @since 5.3.0 The `$constant_name` and `$class_name` parameters were added. 869 * 870 * @param string $extension_name Optional. The extension name to test. Default null. 871 * @param string $function_name Optional. The function name to test. Default null. 872 * @param string $constant_name Optional. The constant name to test for. Default null. 873 * @param string $class_name Optional. The class name to test for. Default null. 874 * @return bool Whether or not the extension and function are available. 875 */ 876 private function test_php_extension_availability( $extension_name = null, $function_name = null, $constant_name = null, $class_name = null ) { 877 // If no extension or function is passed, claim to fail testing, as we have nothing to test against. 878 if ( ! $extension_name && ! $function_name && ! $constant_name && ! $class_name ) { 879 return false; 880 } 881 882 if ( $extension_name && ! extension_loaded( $extension_name ) ) { 883 return false; 884 } 885 886 if ( $function_name && ! function_exists( $function_name ) ) { 887 return false; 888 } 889 890 if ( $constant_name && ! defined( $constant_name ) ) { 891 return false; 892 } 893 894 if ( $class_name && ! class_exists( $class_name ) ) { 895 return false; 896 } 897 898 return true; 899 } 900 901 /** 902 * Tests if required PHP modules are installed on the host. 903 * 904 * This test builds on the recommendations made by the WordPress Hosting Team 905 * as seen at https://make.wordpress.org/hosting/handbook/handbook/server-environment/#php-extensions 906 * 907 * @since 5.2.0 908 * 909 * @return array 910 */ 911 public function get_test_php_extensions() { 912 $result = array( 913 'label' => __( 'Required and recommended modules are installed' ), 914 'status' => 'good', 915 'badge' => array( 916 'label' => __( 'Performance' ), 917 'color' => 'blue', 918 ), 919 'description' => sprintf( 920 '<p>%s</p><p>%s</p>', 921 __( 'PHP modules perform most of the tasks on the server that make your site run. Any changes to these must be made by your server administrator.' ), 922 sprintf( 923 /* translators: 1: Link to the hosting group page about recommended PHP modules. 2: Additional link attributes. 3: Accessibility text. */ 924 __( 'The WordPress Hosting Team maintains a list of those modules, both recommended and required, in <a href="%1$s" %2$s>the team handbook%3$s</a>.' ), 925 /* translators: Localized team handbook, if one exists. */ 926 esc_url( __( 'https://make.wordpress.org/hosting/handbook/handbook/server-environment/#php-extensions' ) ), 927 'target="_blank"', 928 sprintf( 929 '<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span>', 930 /* translators: Hidden accessibility text. */ 931 __( '(opens in a new tab)' ) 932 ) 933 ) 934 ), 935 'actions' => '', 936 'test' => 'php_extensions', 937 ); 938 939 $modules = array( 940 'curl' => array( 941 'function' => 'curl_version', 942 'required' => false, 943 ), 944 'dom' => array( 945 'class' => 'DOMNode', 946 'required' => false, 947 ), 948 'exif' => array( 949 'function' => 'exif_read_data', 950 'required' => false, 951 ), 952 'fileinfo' => array( 953 'function' => 'finfo_file', 954 'required' => false, 955 ), 956 'hash' => array( 957 'function' => 'hash', 958 'required' => true, 959 ), 960 'imagick' => array( 961 'extension' => 'imagick', 962 'required' => false, 963 ), 964 'json' => array( 965 'function' => 'json_last_error', 966 'required' => true, 967 ), 968 'mbstring' => array( 969 'function' => 'mb_check_encoding', 970 'required' => false, 971 ), 972 'mysqli' => array( 973 'function' => 'mysqli_connect', 974 'required' => false, 975 ), 976 // Sodium was introduced in PHP 7.2, but the extension may not be enabled. 977 'libsodium' => array( 978 'constant' => 'SODIUM_LIBRARY_VERSION', 979 'required' => false, 980 'php_bundled_version' => '7.2.0', 981 ), 982 'openssl' => array( 983 'function' => 'openssl_encrypt', 984 'required' => false, 985 ), 986 'pcre' => array( 987 'function' => 'preg_match', 988 'required' => false, 989 ), 990 'mod_xml' => array( 991 'extension' => 'libxml', 992 'required' => false, 993 ), 994 'zip' => array( 995 'class' => 'ZipArchive', 996 'required' => false, 997 ), 998 'filter' => array( 999 'function' => 'filter_list', 1000 'required' => false, 1001 ), 1002 'gd' => array( 1003 'extension' => 'gd', 1004 'required' => false, 1005 'fallback_for' => 'imagick', 1006 ), 1007 'iconv' => array( 1008 'function' => 'iconv', 1009 'required' => false, 1010 ), 1011 'intl' => array( 1012 'extension' => 'intl', 1013 'required' => false, 1014 ), 1015 'mcrypt' => array( 1016 'extension' => 'mcrypt', 1017 'required' => false, 1018 'fallback_for' => 'libsodium', 1019 ), 1020 'simplexml' => array( 1021 'extension' => 'simplexml', 1022 'required' => false, 1023 'fallback_for' => 'mod_xml', 1024 ), 1025 'xmlreader' => array( 1026 'extension' => 'xmlreader', 1027 'required' => false, 1028 'fallback_for' => 'mod_xml', 1029 ), 1030 'zlib' => array( 1031 'extension' => 'zlib', 1032 'required' => false, 1033 'fallback_for' => 'zip', 1034 ), 1035 ); 1036 1037 /** 1038 * Filters the array representing all the modules we wish to test for. 1039 * 1040 * @since 5.2.0 1041 * @since 5.3.0 The `$constant` and `$class` parameters were added. 1042 * 1043 * @param array $modules { 1044 * An associative array of modules to test for. 1045 * 1046 * @type array ...$0 { 1047 * An associative array of module properties used during testing. 1048 * One of either `$function` or `$extension` must be provided, or they will fail by default. 1049 * 1050 * @type string $function Optional. A function name to test for the existence of. 1051 * @type string $extension Optional. An extension to check if is loaded in PHP. 1052 * @type string $constant Optional. A constant name to check for to verify an extension exists. 1053 * @type string $class Optional. A class name to check for to verify an extension exists. 1054 * @type bool $required Is this a required feature or not. 1055 * @type string $fallback_for Optional. The module this module replaces as a fallback. 1056 * } 1057 * } 1058 */ 1059 $modules = apply_filters( 'site_status_test_php_modules', $modules ); 1060 1061 $failures = array(); 1062 1063 foreach ( $modules as $library => $module ) { 1064 $extension_name = $module['extension'] ?? null; 1065 $function_name = $module['function'] ?? null; 1066 $constant_name = $module['constant'] ?? null; 1067 $class_name = $module['class'] ?? null; 1068 1069 // If this module is a fallback for another function, check if that other function passed. 1070 if ( isset( $module['fallback_for'] ) ) { 1071 /* 1072 * If that other function has a failure, mark this module as required for usual operations. 1073 * If that other function hasn't failed, skip this test as it's only a fallback. 1074 */ 1075 if ( isset( $failures[ $module['fallback_for'] ] ) ) { 1076 $module['required'] = true; 1077 } else { 1078 continue; 1079 } 1080 } 1081 1082 if ( ! $this->test_php_extension_availability( $extension_name, $function_name, $constant_name, $class_name ) 1083 && ( ! isset( $module['php_bundled_version'] ) 1084 || version_compare( PHP_VERSION, $module['php_bundled_version'], '<' ) ) 1085 ) { 1086 if ( $module['required'] ) { 1087 $result['status'] = 'critical'; 1088 1089 $class = 'error'; 1090 /* translators: Hidden accessibility text. */ 1091 $screen_reader = __( 'Error' ); 1092 $message = sprintf( 1093 /* translators: %s: The module name. */ 1094 __( 'The required module, %s, is not installed, or has been disabled.' ), 1095 $library 1096 ); 1097 } else { 1098 $class = 'warning'; 1099 /* translators: Hidden accessibility text. */ 1100 $screen_reader = __( 'Warning' ); 1101 $message = sprintf( 1102 /* translators: %s: The module name. */ 1103 __( 'The optional module, %s, is not installed, or has been disabled.' ), 1104 $library 1105 ); 1106 } 1107 1108 if ( ! $module['required'] && 'good' === $result['status'] ) { 1109 $result['status'] = 'recommended'; 1110 } 1111 1112 $failures[ $library ] = "<span class='dashicons $class' aria-hidden='true'></span><span class='screen-reader-text'>$screen_reader</span> $message"; 1113 } 1114 } 1115 1116 if ( ! empty( $failures ) ) { 1117 $output = '<ul>'; 1118 1119 foreach ( $failures as $failure ) { 1120 $output .= sprintf( 1121 '<li>%s</li>', 1122 $failure 1123 ); 1124 } 1125 1126 $output .= '</ul>'; 1127 } 1128 1129 if ( 'good' !== $result['status'] ) { 1130 if ( 'recommended' === $result['status'] ) { 1131 $result['label'] = __( 'One or more recommended modules are missing' ); 1132 } 1133 if ( 'critical' === $result['status'] ) { 1134 $result['label'] = __( 'One or more required modules are missing' ); 1135 } 1136 1137 $result['description'] .= $output; 1138 } 1139 1140 return $result; 1141 } 1142 1143 /** 1144 * Tests if the PHP default timezone is set to UTC. 1145 * 1146 * @since 5.3.1 1147 * 1148 * @return array The test results. 1149 */ 1150 public function get_test_php_default_timezone() { 1151 $result = array( 1152 'label' => __( 'PHP default timezone is valid' ), 1153 'status' => 'good', 1154 'badge' => array( 1155 'label' => __( 'Performance' ), 1156 'color' => 'blue', 1157 ), 1158 'description' => sprintf( 1159 '<p>%s</p>', 1160 __( 'PHP default timezone was configured by WordPress on loading. This is necessary for correct calculations of dates and times.' ) 1161 ), 1162 'actions' => '', 1163 'test' => 'php_default_timezone', 1164 ); 1165 1166 if ( 'UTC' !== date_default_timezone_get() ) { 1167 $result['status'] = 'critical'; 1168 1169 $result['label'] = __( 'PHP default timezone is invalid' ); 1170 1171 $result['description'] = sprintf( 1172 '<p>%s</p>', 1173 sprintf( 1174 /* translators: %s: date_default_timezone_set() */ 1175 __( 'PHP default timezone was changed after WordPress loading by a %s function call. This interferes with correct calculations of dates and times.' ), 1176 '<code>date_default_timezone_set()</code>' 1177 ) 1178 ); 1179 } 1180 1181 return $result; 1182 } 1183 1184 /** 1185 * Tests if there's an active PHP session that can affect loopback requests. 1186 * 1187 * @since 5.5.0 1188 * 1189 * @return array The test results. 1190 */ 1191 public function get_test_php_sessions() { 1192 $result = array( 1193 'label' => __( 'No PHP sessions detected' ), 1194 'status' => 'good', 1195 'badge' => array( 1196 'label' => __( 'Performance' ), 1197 'color' => 'blue', 1198 ), 1199 'description' => sprintf( 1200 '<p>%s</p>', 1201 sprintf( 1202 /* translators: 1: session_start(), 2: session_write_close() */ 1203 __( 'PHP sessions created by a %1$s function call may interfere with REST API and loopback requests. An active session should be closed by %2$s before making any HTTP requests.' ), 1204 '<code>session_start()</code>', 1205 '<code>session_write_close()</code>' 1206 ) 1207 ), 1208 'test' => 'php_sessions', 1209 ); 1210 1211 if ( function_exists( 'session_status' ) && PHP_SESSION_ACTIVE === session_status() ) { 1212 $result['status'] = 'critical'; 1213 1214 $result['label'] = __( 'An active PHP session was detected' ); 1215 1216 $result['description'] = sprintf( 1217 '<p>%s</p>', 1218 sprintf( 1219 /* translators: 1: session_start(), 2: session_write_close() */ 1220 __( 'A PHP session was created by a %1$s function call. This interferes with REST API and loopback requests. The session should be closed by %2$s before making any HTTP requests.' ), 1221 '<code>session_start()</code>', 1222 '<code>session_write_close()</code>' 1223 ) 1224 ); 1225 } 1226 1227 return $result; 1228 } 1229 1230 /** 1231 * Tests if the SQL server is up to date. 1232 * 1233 * @since 5.2.0 1234 * 1235 * @return array The test results. 1236 */ 1237 public function get_test_sql_server() { 1238 if ( ! $this->mysql_server_version ) { 1239 $this->prepare_sql_data(); 1240 } 1241 1242 $result = array( 1243 'label' => __( 'SQL server is up to date' ), 1244 'status' => 'good', 1245 'badge' => array( 1246 'label' => __( 'Performance' ), 1247 'color' => 'blue', 1248 ), 1249 'description' => sprintf( 1250 '<p>%s</p>', 1251 __( 'The SQL server is a required piece of software for the database WordPress uses to store all your site’s content and settings.' ) 1252 ), 1253 'actions' => sprintf( 1254 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 1255 /* translators: Localized version of WordPress requirements if one exists. */ 1256 esc_url( __( 'https://wordpress.org/about/requirements/' ) ), 1257 __( 'Learn more about what WordPress requires to run.' ), 1258 /* translators: Hidden accessibility text. */ 1259 __( '(opens in a new tab)' ) 1260 ), 1261 'test' => 'sql_server', 1262 ); 1263 1264 $db_dropin = file_exists( WP_CONTENT_DIR . '/db.php' ); 1265 1266 if ( ! $this->is_recommended_mysql_version ) { 1267 $result['status'] = 'recommended'; 1268 1269 $result['label'] = __( 'Outdated SQL server' ); 1270 1271 $result['description'] .= sprintf( 1272 '<p>%s</p>', 1273 sprintf( 1274 /* translators: 1: The database engine in use (MySQL or MariaDB). 2: Database server recommended version number. */ 1275 __( 'For optimal performance and security reasons, you should consider running %1$s version %2$s or higher. Contact your web hosting company to correct this.' ), 1276 ( $this->is_mariadb ? 'MariaDB' : 'MySQL' ), 1277 $this->mysql_recommended_version 1278 ) 1279 ); 1280 } 1281 1282 if ( ! $this->is_acceptable_mysql_version ) { 1283 $result['status'] = 'critical'; 1284 1285 $result['label'] = __( 'Severely outdated SQL server' ); 1286 $result['badge']['label'] = __( 'Security' ); 1287 1288 $result['description'] .= sprintf( 1289 '<p>%s</p>', 1290 sprintf( 1291 /* translators: 1: The database engine in use (MySQL or MariaDB). 2: Database server minimum version number. */ 1292 __( 'WordPress requires %1$s version %2$s or higher. Contact your web hosting company to correct this.' ), 1293 ( $this->is_mariadb ? 'MariaDB' : 'MySQL' ), 1294 $this->mysql_required_version 1295 ) 1296 ); 1297 } 1298 1299 if ( $db_dropin ) { 1300 $result['description'] .= sprintf( 1301 '<p>%s</p>', 1302 wp_kses( 1303 sprintf( 1304 /* translators: 1: The name of the drop-in. 2: The name of the database engine. */ 1305 __( 'You are using a %1$s drop-in which might mean that a %2$s database is not being used.' ), 1306 '<code>wp-content/db.php</code>', 1307 ( $this->is_mariadb ? 'MariaDB' : 'MySQL' ) 1308 ), 1309 array( 1310 'code' => true, 1311 ) 1312 ) 1313 ); 1314 } 1315 1316 return $result; 1317 } 1318 1319 /** 1320 * Tests if the site can communicate with WordPress.org. 1321 * 1322 * @since 5.2.0 1323 * 1324 * @return array The test results. 1325 */ 1326 public function get_test_dotorg_communication() { 1327 $result = array( 1328 'label' => __( 'Can communicate with WordPress.org' ), 1329 'status' => '', 1330 'badge' => array( 1331 'label' => __( 'Security' ), 1332 'color' => 'blue', 1333 ), 1334 'description' => sprintf( 1335 '<p>%s</p>', 1336 __( 'Communicating with the WordPress servers is used to check for new versions, and to both install and update WordPress core, themes or plugins.' ) 1337 ), 1338 'actions' => '', 1339 'test' => 'dotorg_communication', 1340 ); 1341 1342 $wp_dotorg = wp_remote_get( 1343 'https://api.wordpress.org', 1344 array( 1345 'timeout' => 10, 1346 ) 1347 ); 1348 if ( ! is_wp_error( $wp_dotorg ) ) { 1349 $result['status'] = 'good'; 1350 } else { 1351 $result['status'] = 'critical'; 1352 1353 $result['label'] = __( 'Could not reach WordPress.org' ); 1354 1355 $result['description'] .= sprintf( 1356 '<p>%s</p>', 1357 sprintf( 1358 '<span class="dashicons error" aria-hidden="true"></span><span class="screen-reader-text">%s</span> %s', 1359 /* translators: Hidden accessibility text. */ 1360 __( 'Error' ), 1361 sprintf( 1362 /* translators: 1: The IP address WordPress.org resolves to. 2: The error returned by the lookup. */ 1363 __( 'Your site is unable to reach WordPress.org at %1$s, and returned the error: %2$s' ), 1364 gethostbyname( 'api.wordpress.org' ), 1365 $wp_dotorg->get_error_message() 1366 ) 1367 ) 1368 ); 1369 1370 $result['actions'] = sprintf( 1371 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 1372 /* translators: Localized Support reference. */ 1373 esc_url( __( 'https://wordpress.org/support/forums/' ) ), 1374 __( 'Get help resolving this issue.' ), 1375 /* translators: Hidden accessibility text. */ 1376 __( '(opens in a new tab)' ) 1377 ); 1378 } 1379 1380 return $result; 1381 } 1382 1383 /** 1384 * Tests if debug information is enabled. 1385 * 1386 * When WP_DEBUG is enabled, errors and information may be disclosed to site visitors, 1387 * or logged to a publicly accessible file. 1388 * 1389 * Debugging is also frequently left enabled after looking for errors on a site, 1390 * as site owners do not understand the implications of this. 1391 * 1392 * @since 5.2.0 1393 * 1394 * @return array The test results. 1395 */ 1396 public function get_test_is_in_debug_mode() { 1397 $result = array( 1398 'label' => __( 'Your site is not set to output debug information' ), 1399 'status' => 'good', 1400 'badge' => array( 1401 'label' => __( 'Security' ), 1402 'color' => 'blue', 1403 ), 1404 'description' => sprintf( 1405 '<p>%s</p>', 1406 __( 'Debug mode is often enabled to gather more details about an error or site failure, but may contain sensitive information which should not be available on a publicly available website.' ) 1407 ), 1408 'actions' => sprintf( 1409 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 1410 /* translators: Documentation explaining debugging in WordPress. */ 1411 esc_url( __( 'https://developer.wordpress.org/advanced-administration/debug/debug-wordpress/' ) ), 1412 __( 'Learn more about debugging in WordPress.' ), 1413 /* translators: Hidden accessibility text. */ 1414 __( '(opens in a new tab)' ) 1415 ), 1416 'test' => 'is_in_debug_mode', 1417 ); 1418 1419 if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) { 1420 if ( defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) { 1421 $result['label'] = __( 'Your site is set to log errors to a potentially public file' ); 1422 1423 $result['status'] = str_starts_with( ini_get( 'error_log' ), ABSPATH ) ? 'critical' : 'recommended'; 1424 1425 $result['description'] .= sprintf( 1426 '<p>%s</p>', 1427 sprintf( 1428 /* translators: %s: WP_DEBUG_LOG */ 1429 __( 'The value, %s, has been added to this website’s configuration file. This means any errors on the site will be written to a file which is potentially available to all users.' ), 1430 '<code>WP_DEBUG_LOG</code>' 1431 ) 1432 ); 1433 } 1434 1435 if ( defined( 'WP_DEBUG_DISPLAY' ) && WP_DEBUG_DISPLAY ) { 1436 $result['label'] = __( 'Your site is set to display errors to site visitors' ); 1437 1438 $result['status'] = 'critical'; 1439 1440 // On development environments, set the status to recommended. 1441 if ( $this->is_development_environment() ) { 1442 $result['status'] = 'recommended'; 1443 } 1444 1445 $result['description'] .= sprintf( 1446 '<p>%s</p>', 1447 sprintf( 1448 /* translators: 1: WP_DEBUG_DISPLAY, 2: WP_DEBUG */ 1449 __( 'The value, %1$s, has either been enabled by %2$s or added to your configuration file. This will make errors display on the front end of your site.' ), 1450 '<code>WP_DEBUG_DISPLAY</code>', 1451 '<code>WP_DEBUG</code>' 1452 ) 1453 ); 1454 } 1455 } 1456 1457 return $result; 1458 } 1459 1460 /** 1461 * Tests if the site is serving content over HTTPS. 1462 * 1463 * Many sites have varying degrees of HTTPS support, the most common of which is sites that have it 1464 * enabled, but only if you visit the right site address. 1465 * 1466 * @since 5.2.0 1467 * @since 5.7.0 Updated to rely on {@see wp_is_using_https()} and {@see wp_is_https_supported()}. 1468 * 1469 * @return array The test results. 1470 */ 1471 public function get_test_https_status() { 1472 /* 1473 * Check HTTPS detection results. 1474 */ 1475 $errors = wp_get_https_detection_errors(); 1476 1477 $default_update_url = wp_get_default_update_https_url(); 1478 1479 $result = array( 1480 'label' => __( 'Your website is using an active HTTPS connection' ), 1481 'status' => 'good', 1482 'badge' => array( 1483 'label' => __( 'Security' ), 1484 'color' => 'blue', 1485 ), 1486 'description' => sprintf( 1487 '<p>%s</p>', 1488 __( 'An HTTPS connection is a more secure way of browsing the web. Many services now have HTTPS as a requirement. HTTPS allows you to take advantage of new features that can increase site speed, improve search rankings, and gain the trust of your visitors by helping to protect their online privacy.' ) 1489 ), 1490 'actions' => sprintf( 1491 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 1492 esc_url( $default_update_url ), 1493 __( 'Learn more about why you should use HTTPS' ), 1494 /* translators: Hidden accessibility text. */ 1495 __( '(opens in a new tab)' ) 1496 ), 1497 'test' => 'https_status', 1498 ); 1499 1500 if ( ! wp_is_using_https() ) { 1501 /* 1502 * If the website is not using HTTPS, provide more information 1503 * about whether it is supported and how it can be enabled. 1504 */ 1505 $result['status'] = 'recommended'; 1506 $result['label'] = __( 'Your website does not use HTTPS' ); 1507 1508 if ( wp_is_site_url_using_https() ) { 1509 if ( is_ssl() ) { 1510 $result['description'] = sprintf( 1511 '<p>%s</p>', 1512 sprintf( 1513 /* translators: %s: URL to Settings > General > Site Address. */ 1514 __( 'You are accessing this website using HTTPS, but your <a href="%s">Site Address</a> is not set up to use HTTPS by default.' ), 1515 esc_url( admin_url( 'options-general.php' ) . '#home' ) 1516 ) 1517 ); 1518 } else { 1519 $result['description'] = sprintf( 1520 '<p>%s</p>', 1521 sprintf( 1522 /* translators: %s: URL to Settings > General > Site Address. */ 1523 __( 'Your <a href="%s">Site Address</a> is not set up to use HTTPS.' ), 1524 esc_url( admin_url( 'options-general.php' ) . '#home' ) 1525 ) 1526 ); 1527 } 1528 } else { 1529 if ( is_ssl() ) { 1530 $result['description'] = sprintf( 1531 '<p>%s</p>', 1532 sprintf( 1533 /* translators: 1: URL to Settings > General > WordPress Address, 2: URL to Settings > General > Site Address. */ 1534 __( 'You are accessing this website using HTTPS, but your <a href="%1$s">WordPress Address</a> and <a href="%2$s">Site Address</a> are not set up to use HTTPS by default.' ), 1535 esc_url( admin_url( 'options-general.php' ) . '#siteurl' ), 1536 esc_url( admin_url( 'options-general.php' ) . '#home' ) 1537 ) 1538 ); 1539 } else { 1540 $result['description'] = sprintf( 1541 '<p>%s</p>', 1542 sprintf( 1543 /* translators: 1: URL to Settings > General > WordPress Address, 2: URL to Settings > General > Site Address. */ 1544 __( 'Your <a href="%1$s">WordPress Address</a> and <a href="%2$s">Site Address</a> are not set up to use HTTPS.' ), 1545 esc_url( admin_url( 'options-general.php' ) . '#siteurl' ), 1546 esc_url( admin_url( 'options-general.php' ) . '#home' ) 1547 ) 1548 ); 1549 } 1550 } 1551 1552 if ( wp_is_https_supported() ) { 1553 $result['description'] .= sprintf( 1554 '<p>%s</p>', 1555 __( 'HTTPS is already supported for your website.' ) 1556 ); 1557 1558 if ( defined( 'WP_HOME' ) || defined( 'WP_SITEURL' ) ) { 1559 $result['description'] .= sprintf( 1560 '<p>%s</p>', 1561 sprintf( 1562 /* translators: 1: wp-config.php, 2: WP_HOME, 3: WP_SITEURL */ 1563 __( 'However, your WordPress Address is currently controlled by a PHP constant and therefore cannot be updated. You need to edit your %1$s and remove or update the definitions of %2$s and %3$s.' ), 1564 '<code>wp-config.php</code>', 1565 '<code>WP_HOME</code>', 1566 '<code>WP_SITEURL</code>' 1567 ) 1568 ); 1569 } elseif ( current_user_can( 'update_https' ) ) { 1570 $default_direct_update_url = add_query_arg( 'action', 'update_https', wp_nonce_url( admin_url( 'site-health.php' ), 'wp_update_https' ) ); 1571 $direct_update_url = wp_get_direct_update_https_url(); 1572 1573 if ( ! empty( $direct_update_url ) ) { 1574 $result['actions'] = sprintf( 1575 '<p class="button-container"><a class="button button-primary" href="%1$s" target="_blank">%2$s<span class="screen-reader-text"> %3$s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 1576 esc_url( $direct_update_url ), 1577 __( 'Update your site to use HTTPS' ), 1578 /* translators: Hidden accessibility text. */ 1579 __( '(opens in a new tab)' ) 1580 ); 1581 } else { 1582 $result['actions'] = sprintf( 1583 '<p class="button-container"><a class="button button-primary" href="%1$s">%2$s</a></p>', 1584 esc_url( $default_direct_update_url ), 1585 __( 'Update your site to use HTTPS' ) 1586 ); 1587 } 1588 } 1589 } else { 1590 // If host-specific "Update HTTPS" URL is provided, include a link. 1591 $update_url = wp_get_update_https_url(); 1592 if ( $update_url !== $default_update_url ) { 1593 $result['description'] .= sprintf( 1594 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 1595 esc_url( $update_url ), 1596 __( 'Talk to your web host about supporting HTTPS for your website.' ), 1597 /* translators: Hidden accessibility text. */ 1598 __( '(opens in a new tab)' ) 1599 ); 1600 } else { 1601 $result['description'] .= sprintf( 1602 '<p>%s</p>', 1603 __( 'Talk to your web host about supporting HTTPS for your website.' ) 1604 ); 1605 } 1606 } 1607 } 1608 1609 return $result; 1610 } 1611 1612 /** 1613 * Checks if the HTTP API can handle SSL/TLS requests. 1614 * 1615 * @since 5.2.0 1616 * 1617 * @return array The test result. 1618 */ 1619 public function get_test_ssl_support() { 1620 $result = array( 1621 'label' => '', 1622 'status' => '', 1623 'badge' => array( 1624 'label' => __( 'Security' ), 1625 'color' => 'blue', 1626 ), 1627 'description' => sprintf( 1628 '<p>%s</p>', 1629 __( 'Securely communicating between servers are needed for transactions such as fetching files, conducting sales on store sites, and much more.' ) 1630 ), 1631 'actions' => '', 1632 'test' => 'ssl_support', 1633 ); 1634 1635 $supports_https = wp_http_supports( array( 'ssl' ) ); 1636 1637 if ( $supports_https ) { 1638 $result['status'] = 'good'; 1639 1640 $result['label'] = __( 'Your site can communicate securely with other services' ); 1641 } else { 1642 $result['status'] = 'critical'; 1643 1644 $result['label'] = __( 'Your site is unable to communicate securely with other services' ); 1645 1646 $result['description'] .= sprintf( 1647 '<p>%s</p>', 1648 __( 'Talk to your web host about OpenSSL support for PHP.' ) 1649 ); 1650 } 1651 1652 return $result; 1653 } 1654 1655 /** 1656 * Tests if scheduled events run as intended. 1657 * 1658 * If scheduled events are not running, this may indicate something with WP_Cron is not working 1659 * as intended, or that there are orphaned events hanging around from older code. 1660 * 1661 * @since 5.2.0 1662 * 1663 * @return array The test results. 1664 */ 1665 public function get_test_scheduled_events() { 1666 $result = array( 1667 'label' => __( 'Scheduled events are running' ), 1668 'status' => 'good', 1669 'badge' => array( 1670 'label' => __( 'Performance' ), 1671 'color' => 'blue', 1672 ), 1673 'description' => sprintf( 1674 '<p>%s</p>', 1675 __( 'Scheduled events are what periodically looks for updates to plugins, themes and WordPress itself. It is also what makes sure scheduled posts are published on time. It may also be used by various plugins to make sure that planned actions are executed.' ) 1676 ), 1677 'actions' => '', 1678 'test' => 'scheduled_events', 1679 ); 1680 1681 $this->wp_schedule_test_init(); 1682 1683 if ( is_wp_error( $this->has_missed_cron() ) ) { 1684 $result['status'] = 'critical'; 1685 1686 $result['label'] = __( 'It was not possible to check your scheduled events' ); 1687 1688 $result['description'] = sprintf( 1689 '<p>%s</p>', 1690 sprintf( 1691 /* translators: %s: The error message returned while from the cron scheduler. */ 1692 __( 'While trying to test your site’s scheduled events, the following error was returned: %s' ), 1693 $this->has_missed_cron()->get_error_message() 1694 ) 1695 ); 1696 } elseif ( $this->has_missed_cron() ) { 1697 $result['status'] = 'recommended'; 1698 1699 $result['label'] = __( 'A scheduled event has failed' ); 1700 1701 $result['description'] = sprintf( 1702 '<p>%s</p>', 1703 sprintf( 1704 /* translators: %s: The name of the failed cron event. */ 1705 __( 'The scheduled event, %s, failed to run. Your site still works, but this may indicate that scheduling posts or automated updates may not work as intended.' ), 1706 $this->last_missed_cron 1707 ) 1708 ); 1709 } elseif ( $this->has_late_cron() ) { 1710 $result['status'] = 'recommended'; 1711 1712 $result['label'] = __( 'A scheduled event is late' ); 1713 1714 $result['description'] = sprintf( 1715 '<p>%s</p>', 1716 sprintf( 1717 /* translators: %s: The name of the late cron event. */ 1718 __( 'The scheduled event, %s, is late to run. Your site still works, but this may indicate that scheduling posts or automated updates may not work as intended.' ), 1719 $this->last_late_cron 1720 ) 1721 ); 1722 } 1723 1724 return $result; 1725 } 1726 1727 /** 1728 * Tests if WordPress can run automated background updates. 1729 * 1730 * Background updates in WordPress are primarily used for minor releases and security updates. 1731 * It's important to either have these working, or be aware that they are intentionally disabled 1732 * for whatever reason. 1733 * 1734 * @since 5.2.0 1735 * 1736 * @return array The test results. 1737 */ 1738 public function get_test_background_updates() { 1739 $result = array( 1740 'label' => __( 'Background updates are working' ), 1741 'status' => 'good', 1742 'badge' => array( 1743 'label' => __( 'Security' ), 1744 'color' => 'blue', 1745 ), 1746 'description' => sprintf( 1747 '<p>%s</p>', 1748 __( 'Background updates ensure that WordPress can auto-update if a security update is released for the version you are currently using.' ) 1749 ), 1750 'actions' => '', 1751 'test' => 'background_updates', 1752 ); 1753 1754 if ( ! class_exists( 'WP_Site_Health_Auto_Updates' ) ) { 1755 require_once ABSPATH . 'wp-admin/includes/class-wp-site-health-auto-updates.php'; 1756 } 1757 1758 /* 1759 * Run the auto-update tests in a separate class, 1760 * as there are many considerations to be made. 1761 */ 1762 $automatic_updates = new WP_Site_Health_Auto_Updates(); 1763 $tests = $automatic_updates->run_tests(); 1764 1765 $output = '<ul>'; 1766 1767 foreach ( $tests as $test ) { 1768 /* translators: Hidden accessibility text. */ 1769 $severity_string = __( 'Passed' ); 1770 1771 if ( 'fail' === $test->severity ) { 1772 $result['label'] = __( 'Background updates are not working as expected' ); 1773 1774 $result['status'] = 'critical'; 1775 1776 /* translators: Hidden accessibility text. */ 1777 $severity_string = __( 'Error' ); 1778 } 1779 1780 if ( 'warning' === $test->severity && 'good' === $result['status'] ) { 1781 $result['label'] = __( 'Background updates may not be working properly' ); 1782 1783 $result['status'] = 'recommended'; 1784 1785 /* translators: Hidden accessibility text. */ 1786 $severity_string = __( 'Warning' ); 1787 } 1788 1789 $output .= sprintf( 1790 '<li><span class="dashicons %s"><span class="screen-reader-text">%s</span></span> %s</li>', 1791 esc_attr( $test->severity ), 1792 $severity_string, 1793 $test->description 1794 ); 1795 } 1796 1797 $output .= '</ul>'; 1798 1799 if ( 'good' !== $result['status'] ) { 1800 $result['description'] .= $output; 1801 } 1802 1803 return $result; 1804 } 1805 1806 /** 1807 * Tests if plugin and theme auto-updates appear to be configured correctly. 1808 * 1809 * @since 5.5.0 1810 * 1811 * @return array The test results. 1812 */ 1813 public function get_test_plugin_theme_auto_updates() { 1814 $result = array( 1815 'label' => __( 'Plugin and theme auto-updates appear to be configured correctly' ), 1816 'status' => 'good', 1817 'badge' => array( 1818 'label' => __( 'Security' ), 1819 'color' => 'blue', 1820 ), 1821 'description' => sprintf( 1822 '<p>%s</p>', 1823 __( 'Plugin and theme auto-updates ensure that the latest versions are always installed.' ) 1824 ), 1825 'actions' => '', 1826 'test' => 'plugin_theme_auto_updates', 1827 ); 1828 1829 $check_plugin_theme_updates = $this->detect_plugin_theme_auto_update_issues(); 1830 1831 $result['status'] = $check_plugin_theme_updates->status; 1832 1833 if ( 'good' !== $result['status'] ) { 1834 $result['label'] = __( 'Your site may have problems auto-updating plugins and themes' ); 1835 1836 $result['description'] .= sprintf( 1837 '<p>%s</p>', 1838 $check_plugin_theme_updates->message 1839 ); 1840 } 1841 1842 return $result; 1843 } 1844 1845 /** 1846 * Tests available disk space for updates. 1847 * 1848 * @since 6.3.0 1849 * 1850 * @return array The test results. 1851 */ 1852 public function get_test_available_updates_disk_space() { 1853 $available_space = function_exists( 'disk_free_space' ) ? @disk_free_space( WP_CONTENT_DIR ) : false; 1854 1855 $result = array( 1856 'label' => __( 'Disk space available to safely perform updates' ), 1857 'status' => 'good', 1858 'badge' => array( 1859 'label' => __( 'Security' ), 1860 'color' => 'blue', 1861 ), 1862 'description' => sprintf( 1863 /* translators: %s: Available disk space in MB or GB. */ 1864 '<p>' . __( '%s available disk space was detected, update routines can be performed safely.' ) . '</p>', 1865 size_format( $available_space ) 1866 ), 1867 'actions' => '', 1868 'test' => 'available_updates_disk_space', 1869 ); 1870 1871 if ( false === $available_space ) { 1872 $result['description'] = __( 'Could not determine available disk space for updates.' ); 1873 $result['status'] = 'recommended'; 1874 } elseif ( $available_space < 20 * MB_IN_BYTES ) { 1875 $result['description'] = sprintf( 1876 /* translators: %s: Available disk space in MB or GB. */ 1877 __( 'Available disk space is critically low, less than %s available. Proceed with caution, updates may fail.' ), 1878 size_format( 20 * MB_IN_BYTES ) 1879 ); 1880 $result['status'] = 'critical'; 1881 } elseif ( $available_space < 100 * MB_IN_BYTES ) { 1882 $result['description'] = sprintf( 1883 /* translators: %s: Available disk space in MB or GB. */ 1884 __( 'Available disk space is low, less than %s available.' ), 1885 size_format( 100 * MB_IN_BYTES ) 1886 ); 1887 $result['status'] = 'recommended'; 1888 } 1889 1890 return $result; 1891 } 1892 1893 /** 1894 * Tests if registration is open to everyone and the default role is privileged. 1895 * 1896 * @since 7.0.0 1897 * 1898 * @return array The test results. 1899 */ 1900 public function get_test_insecure_registration() { 1901 $users_can_register = get_option( 'users_can_register' ); 1902 $default_role = get_option( 'default_role' ); 1903 1904 $result = array( 1905 'label' => __( 'Open Registration with privileged default role' ), 1906 'status' => 'good', 1907 'badge' => array( 1908 'label' => __( 'Security' ), 1909 'color' => 'blue', 1910 ), 1911 'description' => '<p>' . __( 'The combination of open registration setting and the default user role may lead to security issues.' ) . '</p>', 1912 'actions' => '', 1913 'test' => 'insecure_registration', 1914 ); 1915 1916 if ( $users_can_register && in_array( $default_role, array( 'editor', 'administrator' ), true ) ) { 1917 $result['description'] = __( 'Registration is open to anyone, and the default role is set to a privileged role.' ); 1918 $result['status'] = 'critical'; 1919 $result['actions'] = sprintf( 1920 '<p><a href="%s">%s</a></p>', 1921 esc_url( admin_url( 'options-general.php' ) ), 1922 __( 'Change these settings' ) 1923 ); 1924 } 1925 1926 return $result; 1927 } 1928 1929 /** 1930 * Tests if plugin and theme temporary backup directories are writable or can be created. 1931 * 1932 * @since 6.3.0 1933 * 1934 * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass. 1935 * 1936 * @return array The test results. 1937 */ 1938 public function get_test_update_temp_backup_writable() { 1939 global $wp_filesystem; 1940 1941 $result = array( 1942 'label' => __( 'Plugin and theme temporary backup directory is writable' ), 1943 'status' => 'good', 1944 'badge' => array( 1945 'label' => __( 'Security' ), 1946 'color' => 'blue', 1947 ), 1948 'description' => sprintf( 1949 /* translators: %s: wp-content/upgrade-temp-backup */ 1950 '<p>' . __( 'The %s directory used to improve the stability of plugin and theme updates is writable.' ) . '</p>', 1951 '<code>wp-content/upgrade-temp-backup</code>' 1952 ), 1953 'actions' => '', 1954 'test' => 'update_temp_backup_writable', 1955 ); 1956 1957 if ( ! function_exists( 'WP_Filesystem' ) ) { 1958 require_once ABSPATH . 'wp-admin/includes/file.php'; 1959 } 1960 1961 ob_start(); 1962 $credentials = request_filesystem_credentials( '' ); 1963 ob_end_clean(); 1964 1965 if ( false === $credentials || ! WP_Filesystem( $credentials ) ) { 1966 $result['status'] = 'recommended'; 1967 $result['label'] = __( 'Could not access filesystem' ); 1968 $result['description'] = __( 'Unable to connect to the filesystem. Please confirm your credentials.' ); 1969 return $result; 1970 } 1971 1972 $wp_content = $wp_filesystem->wp_content_dir(); 1973 1974 if ( ! $wp_content ) { 1975 $result['status'] = 'critical'; 1976 $result['label'] = __( 'Unable to locate WordPress content directory' ); 1977 $result['description'] = sprintf( 1978 /* translators: %s: wp-content */ 1979 '<p>' . __( 'The %s directory cannot be located.' ) . '</p>', 1980 '<code>wp-content</code>' 1981 ); 1982 return $result; 1983 } 1984 1985 $upgrade_dir_exists = $wp_filesystem->is_dir( "$wp_content/upgrade" ); 1986 $upgrade_dir_is_writable = $wp_filesystem->is_writable( "$wp_content/upgrade" ); 1987 $backup_dir_exists = $wp_filesystem->is_dir( "$wp_content/upgrade-temp-backup" ); 1988 $backup_dir_is_writable = $wp_filesystem->is_writable( "$wp_content/upgrade-temp-backup" ); 1989 1990 $plugins_dir_exists = $wp_filesystem->is_dir( "$wp_content/upgrade-temp-backup/plugins" ); 1991 $plugins_dir_is_writable = $wp_filesystem->is_writable( "$wp_content/upgrade-temp-backup/plugins" ); 1992 $themes_dir_exists = $wp_filesystem->is_dir( "$wp_content/upgrade-temp-backup/themes" ); 1993 $themes_dir_is_writable = $wp_filesystem->is_writable( "$wp_content/upgrade-temp-backup/themes" ); 1994 1995 if ( $plugins_dir_exists && ! $plugins_dir_is_writable && $themes_dir_exists && ! $themes_dir_is_writable ) { 1996 $result['status'] = 'critical'; 1997 $result['label'] = __( 'Plugin and theme temporary backup directories exist but are not writable' ); 1998 $result['description'] = sprintf( 1999 /* translators: 1: wp-content/upgrade-temp-backup/plugins, 2: wp-content/upgrade-temp-backup/themes. */ 2000 '<p>' . __( 'The %1$s and %2$s directories exist but are not writable. These directories are used to improve the stability of plugin updates. Please make sure the server has write permissions to these directories.' ) . '</p>', 2001 '<code>wp-content/upgrade-temp-backup/plugins</code>', 2002 '<code>wp-content/upgrade-temp-backup/themes</code>' 2003 ); 2004 return $result; 2005 } 2006 2007 if ( $plugins_dir_exists && ! $plugins_dir_is_writable ) { 2008 $result['status'] = 'critical'; 2009 $result['label'] = __( 'Plugin temporary backup directory exists but is not writable' ); 2010 $result['description'] = sprintf( 2011 /* translators: %s: wp-content/upgrade-temp-backup/plugins */ 2012 '<p>' . __( 'The %s directory exists but is not writable. This directory is used to improve the stability of plugin updates. Please make sure the server has write permissions to this directory.' ) . '</p>', 2013 '<code>wp-content/upgrade-temp-backup/plugins</code>' 2014 ); 2015 return $result; 2016 } 2017 2018 if ( $themes_dir_exists && ! $themes_dir_is_writable ) { 2019 $result['status'] = 'critical'; 2020 $result['label'] = __( 'Theme temporary backup directory exists but is not writable' ); 2021 $result['description'] = sprintf( 2022 /* translators: %s: wp-content/upgrade-temp-backup/themes */ 2023 '<p>' . __( 'The %s directory exists but is not writable. This directory is used to improve the stability of theme updates. Please make sure the server has write permissions to this directory.' ) . '</p>', 2024 '<code>wp-content/upgrade-temp-backup/themes</code>' 2025 ); 2026 return $result; 2027 } 2028 2029 if ( ( ! $plugins_dir_exists || ! $themes_dir_exists ) && $backup_dir_exists && ! $backup_dir_is_writable ) { 2030 $result['status'] = 'critical'; 2031 $result['label'] = __( 'The temporary backup directory exists but is not writable' ); 2032 $result['description'] = sprintf( 2033 /* translators: %s: wp-content/upgrade-temp-backup */ 2034 '<p>' . __( 'The %s directory exists but is not writable. This directory is used to improve the stability of plugin and theme updates. Please make sure the server has write permissions to this directory.' ) . '</p>', 2035 '<code>wp-content/upgrade-temp-backup</code>' 2036 ); 2037 return $result; 2038 } 2039 2040 if ( ! $backup_dir_exists && $upgrade_dir_exists && ! $upgrade_dir_is_writable ) { 2041 $result['status'] = 'critical'; 2042 $result['label'] = __( 'The upgrade directory exists but is not writable' ); 2043 $result['description'] = sprintf( 2044 /* translators: %s: wp-content/upgrade */ 2045 '<p>' . __( 'The %s directory exists but is not writable. This directory is used for plugin and theme updates. Please make sure the server has write permissions to this directory.' ) . '</p>', 2046 '<code>wp-content/upgrade</code>' 2047 ); 2048 return $result; 2049 } 2050 2051 if ( ! $upgrade_dir_exists && ! $wp_filesystem->is_writable( $wp_content ) ) { 2052 $result['status'] = 'critical'; 2053 $result['label'] = __( 'The upgrade directory cannot be created' ); 2054 $result['description'] = sprintf( 2055 /* translators: 1: wp-content/upgrade, 2: wp-content. */ 2056 '<p>' . __( 'The %1$s directory does not exist, and the server does not have write permissions in %2$s to create it. This directory is used for plugin and theme updates. Please make sure the server has write permissions in %2$s.' ) . '</p>', 2057 '<code>wp-content/upgrade</code>', 2058 '<code>wp-content</code>' 2059 ); 2060 return $result; 2061 } 2062 2063 return $result; 2064 } 2065 2066 /** 2067 * Tests if loopbacks work as expected. 2068 * 2069 * A loopback is when WordPress queries itself, for example to start a new WP_Cron instance, 2070 * or when editing a plugin or theme. This has shown itself to be a recurring issue, 2071 * as code can very easily break this interaction. 2072 * 2073 * @since 5.2.0 2074 * 2075 * @return array The test results. 2076 */ 2077 public function get_test_loopback_requests() { 2078 $result = array( 2079 'label' => __( 'Your site can perform loopback requests' ), 2080 'status' => 'good', 2081 'badge' => array( 2082 'label' => __( 'Performance' ), 2083 'color' => 'blue', 2084 ), 2085 'description' => sprintf( 2086 '<p>%s</p>', 2087 __( 'Loopback requests are used to run scheduled events, and are also used by the built-in editors for themes and plugins to verify code stability.' ) 2088 ), 2089 'actions' => '', 2090 'test' => 'loopback_requests', 2091 ); 2092 2093 $check_loopback = $this->can_perform_loopback(); 2094 2095 $result['status'] = $check_loopback->status; 2096 2097 if ( 'good' !== $result['status'] ) { 2098 $result['label'] = __( 'Your site could not complete a loopback request' ); 2099 2100 $result['description'] .= sprintf( 2101 '<p>%s</p>', 2102 $check_loopback->message 2103 ); 2104 } 2105 2106 return $result; 2107 } 2108 2109 /** 2110 * Tests if HTTP requests are blocked. 2111 * 2112 * It's possible to block all outgoing communication (with the possibility of allowing certain 2113 * hosts) via the HTTP API. This may create problems for users as many features are running as 2114 * services these days. 2115 * 2116 * @since 5.2.0 2117 * 2118 * @return array The test results. 2119 */ 2120 public function get_test_http_requests() { 2121 $result = array( 2122 'label' => __( 'HTTP requests seem to be working as expected' ), 2123 'status' => 'good', 2124 'badge' => array( 2125 'label' => __( 'Performance' ), 2126 'color' => 'blue', 2127 ), 2128 'description' => sprintf( 2129 '<p>%s</p>', 2130 __( 'It is possible for site maintainers to block all, or some, communication to other sites and services. If set up incorrectly, this may prevent plugins and themes from working as intended.' ) 2131 ), 2132 'actions' => '', 2133 'test' => 'http_requests', 2134 ); 2135 2136 $blocked = false; 2137 $hosts = array(); 2138 2139 if ( defined( 'WP_HTTP_BLOCK_EXTERNAL' ) && WP_HTTP_BLOCK_EXTERNAL ) { 2140 $blocked = true; 2141 } 2142 2143 if ( defined( 'WP_ACCESSIBLE_HOSTS' ) ) { 2144 $hosts = explode( ',', WP_ACCESSIBLE_HOSTS ); 2145 } 2146 2147 if ( $blocked && 0 === count( $hosts ) ) { 2148 $result['status'] = 'critical'; 2149 2150 $result['label'] = __( 'HTTP requests are blocked' ); 2151 2152 $result['description'] .= sprintf( 2153 '<p>%s</p>', 2154 sprintf( 2155 /* translators: %s: Name of the constant used. */ 2156 __( 'HTTP requests have been blocked by the %s constant, with no allowed hosts.' ), 2157 '<code>WP_HTTP_BLOCK_EXTERNAL</code>' 2158 ) 2159 ); 2160 } 2161 2162 if ( $blocked && 0 < count( $hosts ) ) { 2163 $result['status'] = 'recommended'; 2164 2165 $result['label'] = __( 'HTTP requests are partially blocked' ); 2166 2167 $result['description'] .= sprintf( 2168 '<p>%s</p>', 2169 sprintf( 2170 /* translators: 1: Name of the constant used. 2: List of allowed hostnames. */ 2171 __( 'HTTP requests have been blocked by the %1$s constant, with some allowed hosts: %2$s.' ), 2172 '<code>WP_HTTP_BLOCK_EXTERNAL</code>', 2173 implode( ',', $hosts ) 2174 ) 2175 ); 2176 } 2177 2178 return $result; 2179 } 2180 2181 /** 2182 * Tests if the REST API is accessible. 2183 * 2184 * Various security measures may block the REST API from working, or it may have been disabled in general. 2185 * This is required for the new block editor to work, so we explicitly test for this. 2186 * 2187 * @since 5.2.0 2188 * 2189 * @return array The test results. 2190 */ 2191 public function get_test_rest_availability() { 2192 $result = array( 2193 'label' => __( 'The REST API is available' ), 2194 'status' => 'good', 2195 'badge' => array( 2196 'label' => __( 'Performance' ), 2197 'color' => 'blue', 2198 ), 2199 'description' => sprintf( 2200 '<p>%s</p>', 2201 __( 'The REST API is one way that WordPress and other applications communicate with the server. For example, the block editor screen relies on the REST API to display and save your posts and pages.' ) 2202 ), 2203 'actions' => '', 2204 'test' => 'rest_availability', 2205 ); 2206 2207 $cookies = wp_unslash( $_COOKIE ); 2208 $timeout = 10; // 10 seconds. 2209 $headers = array( 2210 'Cache-Control' => 'no-cache', 2211 'X-WP-Nonce' => wp_create_nonce( 'wp_rest' ), 2212 ); 2213 // Include Basic auth in loopback requests. 2214 if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) { 2215 $headers['Authorization'] = 'Basic ' . base64_encode( wp_unslash( $_SERVER['PHP_AUTH_USER'] ) . ':' . wp_unslash( $_SERVER['PHP_AUTH_PW'] ) ); 2216 } 2217 2218 $url = rest_url( 'wp/v2/types/post' ); 2219 2220 // The context for this is editing with the new block editor. 2221 $url = add_query_arg( 2222 array( 2223 'context' => 'edit', 2224 ), 2225 $url 2226 ); 2227 2228 /** This filter is documented in wp-includes/class-wp-http-streams.php */ 2229 $sslverify = apply_filters( 'https_local_ssl_verify', false, $url ); 2230 2231 $r = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) ); 2232 2233 if ( is_wp_error( $r ) ) { 2234 $result['status'] = 'critical'; 2235 2236 $result['label'] = __( 'The REST API encountered an error' ); 2237 2238 $result['description'] .= sprintf( 2239 '<p>%s</p><p>%s<br>%s</p>', 2240 __( 'When testing the REST API, an error was encountered:' ), 2241 sprintf( 2242 // translators: %s: The REST API URL. 2243 __( 'REST API Endpoint: %s' ), 2244 $url 2245 ), 2246 sprintf( 2247 // translators: 1: The WordPress error code. 2: The WordPress error message. 2248 __( 'REST API Response: (%1$s) %2$s' ), 2249 $r->get_error_code(), 2250 $r->get_error_message() 2251 ) 2252 ); 2253 } elseif ( 200 !== wp_remote_retrieve_response_code( $r ) ) { 2254 $result['status'] = 'recommended'; 2255 2256 $result['label'] = __( 'The REST API encountered an unexpected result' ); 2257 2258 $result['description'] .= sprintf( 2259 '<p>%s</p><p>%s<br>%s</p>', 2260 __( 'When testing the REST API, an unexpected result was returned:' ), 2261 sprintf( 2262 // translators: %s: The REST API URL. 2263 __( 'REST API Endpoint: %s' ), 2264 $url 2265 ), 2266 sprintf( 2267 // translators: 1: The WordPress error code. 2: The HTTP status code error message. 2268 __( 'REST API Response: (%1$s) %2$s' ), 2269 wp_remote_retrieve_response_code( $r ), 2270 wp_remote_retrieve_response_message( $r ) 2271 ) 2272 ); 2273 } else { 2274 $json = json_decode( wp_remote_retrieve_body( $r ), true ); 2275 2276 if ( false !== $json && ! isset( $json['capabilities'] ) ) { 2277 $result['status'] = 'recommended'; 2278 2279 $result['label'] = __( 'The REST API did not behave correctly' ); 2280 2281 $result['description'] .= sprintf( 2282 '<p>%s</p>', 2283 sprintf( 2284 /* translators: %s: The name of the query parameter being tested. */ 2285 __( 'The REST API did not process the %s query parameter correctly.' ), 2286 '<code>context</code>' 2287 ) 2288 ); 2289 } 2290 } 2291 2292 return $result; 2293 } 2294 2295 /** 2296 * Tests if 'file_uploads' directive in PHP.ini is turned off. 2297 * 2298 * @since 5.5.0 2299 * 2300 * @return array The test results. 2301 */ 2302 public function get_test_file_uploads() { 2303 $result = array( 2304 'label' => __( 'Files can be uploaded' ), 2305 'status' => 'good', 2306 'badge' => array( 2307 'label' => __( 'Performance' ), 2308 'color' => 'blue', 2309 ), 2310 'description' => sprintf( 2311 '<p>%s</p>', 2312 sprintf( 2313 /* translators: 1: file_uploads, 2: php.ini */ 2314 __( 'The %1$s directive in %2$s determines if uploading files is allowed on your site.' ), 2315 '<code>file_uploads</code>', 2316 '<code>php.ini</code>' 2317 ) 2318 ), 2319 'actions' => '', 2320 'test' => 'file_uploads', 2321 ); 2322 2323 if ( empty( ini_get( 'file_uploads' ) ) ) { 2324 $result['status'] = 'critical'; 2325 $result['description'] .= sprintf( 2326 '<p>%s</p>', 2327 sprintf( 2328 /* translators: 1: file_uploads, 2: 0 */ 2329 __( '%1$s is set to %2$s. You won\'t be able to upload files on your site.' ), 2330 '<code>file_uploads</code>', 2331 '<code>0</code>' 2332 ) 2333 ); 2334 return $result; 2335 } 2336 2337 $post_max_size = ini_get( 'post_max_size' ); 2338 $upload_max_filesize = ini_get( 'upload_max_filesize' ); 2339 2340 if ( wp_convert_hr_to_bytes( $post_max_size ) < wp_convert_hr_to_bytes( $upload_max_filesize ) ) { 2341 $result['label'] = sprintf( 2342 /* translators: 1: post_max_size, 2: upload_max_filesize */ 2343 __( 'The "%1$s" value is smaller than "%2$s"' ), 2344 'post_max_size', 2345 'upload_max_filesize' 2346 ); 2347 $result['status'] = 'recommended'; 2348 2349 if ( 0 === wp_convert_hr_to_bytes( $post_max_size ) ) { 2350 $result['description'] = sprintf( 2351 '<p>%s</p>', 2352 sprintf( 2353 /* translators: 1: post_max_size, 2: upload_max_filesize */ 2354 __( 'The setting for %1$s is currently configured as 0, this could cause some problems when trying to upload files through plugin or theme features that rely on various upload methods. It is recommended to configure this setting to a fixed value, ideally matching the value of %2$s, as some upload methods read the value 0 as either unlimited, or disabled.' ), 2355 '<code>post_max_size</code>', 2356 '<code>upload_max_filesize</code>' 2357 ) 2358 ); 2359 } else { 2360 $result['description'] = sprintf( 2361 '<p>%s</p>', 2362 sprintf( 2363 /* translators: 1: post_max_size, 2: upload_max_filesize */ 2364 __( 'The setting for %1$s is smaller than %2$s, this could cause some problems when trying to upload files.' ), 2365 '<code>post_max_size</code>', 2366 '<code>upload_max_filesize</code>' 2367 ) 2368 ); 2369 } 2370 2371 return $result; 2372 } 2373 2374 return $result; 2375 } 2376 2377 /** 2378 * Tests if the Authorization header has the expected values. 2379 * 2380 * @since 5.6.0 2381 * 2382 * @return array 2383 */ 2384 public function get_test_authorization_header() { 2385 $result = array( 2386 'label' => __( 'The Authorization header is working as expected' ), 2387 'status' => 'good', 2388 'badge' => array( 2389 'label' => __( 'Security' ), 2390 'color' => 'blue', 2391 ), 2392 'description' => sprintf( 2393 '<p>%s</p>', 2394 __( 'The Authorization header is used by third-party applications you have approved for this site. Without this header, those apps cannot connect to your site.' ) 2395 ), 2396 'actions' => '', 2397 'test' => 'authorization_header', 2398 ); 2399 2400 if ( ! isset( $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ) ) { 2401 $result['label'] = __( 'The authorization header is missing' ); 2402 } elseif ( 'user' !== $_SERVER['PHP_AUTH_USER'] || 'pwd' !== $_SERVER['PHP_AUTH_PW'] ) { 2403 $result['label'] = __( 'The authorization header is invalid' ); 2404 } else { 2405 return $result; 2406 } 2407 2408 $result['status'] = 'recommended'; 2409 $result['description'] .= sprintf( 2410 '<p>%s</p>', 2411 __( 'If you are still seeing this warning after having tried the actions below, you may need to contact your hosting provider for further assistance.' ) 2412 ); 2413 2414 if ( ! function_exists( 'got_mod_rewrite' ) ) { 2415 require_once ABSPATH . 'wp-admin/includes/misc.php'; 2416 } 2417 2418 if ( got_mod_rewrite() ) { 2419 $result['actions'] .= sprintf( 2420 '<p><a href="%s">%s</a></p>', 2421 esc_url( admin_url( 'options-permalink.php' ) ), 2422 __( 'Flush permalinks' ) 2423 ); 2424 } else { 2425 $result['actions'] .= sprintf( 2426 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 2427 __( 'https://developer.wordpress.org/rest-api/frequently-asked-questions/#why-is-authentication-not-working' ), 2428 __( 'Learn how to configure the Authorization header.' ), 2429 /* translators: Hidden accessibility text. */ 2430 __( '(opens in a new tab)' ) 2431 ); 2432 } 2433 2434 return $result; 2435 } 2436 2437 /** 2438 * Tests if a full page cache is available. 2439 * 2440 * @since 6.1.0 2441 * 2442 * @return array The test result. 2443 */ 2444 public function get_test_page_cache() { 2445 $description = '<p>' . __( 'Page cache enhances the speed and performance of your site by saving and serving static pages instead of calling for a page every time a user visits.' ) . '</p>'; 2446 $description .= '<p>' . __( 'Page cache is detected by looking for an active page cache plugin as well as making three requests to the homepage and looking for one or more of the following HTTP client caching response headers:' ) . '</p>'; 2447 $description .= '<code>' . implode( '</code>, <code>', array_keys( $this->get_page_cache_headers() ) ) . '.</code>'; 2448 2449 $result = array( 2450 'badge' => array( 2451 'label' => __( 'Performance' ), 2452 'color' => 'blue', 2453 ), 2454 'description' => wp_kses_post( $description ), 2455 'test' => 'page_cache', 2456 'status' => 'good', 2457 'label' => '', 2458 'actions' => sprintf( 2459 '<p><a href="%1$s" target="_blank" rel="noreferrer">%2$s<span class="screen-reader-text"> %3$s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 2460 __( 'https://developer.wordpress.org/advanced-administration/performance/optimization/#caching' ), 2461 __( 'Learn more about page cache' ), 2462 /* translators: Hidden accessibility text. */ 2463 __( '(opens in a new tab)' ) 2464 ), 2465 ); 2466 2467 $page_cache_detail = $this->get_page_cache_detail(); 2468 2469 if ( is_wp_error( $page_cache_detail ) ) { 2470 $result['label'] = __( 'Unable to detect the presence of page cache' ); 2471 $result['status'] = 'recommended'; 2472 $error_info = sprintf( 2473 /* translators: 1: Error message, 2: Error code. */ 2474 __( 'Unable to detect page cache due to possible loopback request problem. Please verify that the loopback request test is passing. Error: %1$s (Code: %2$s)' ), 2475 $page_cache_detail->get_error_message(), 2476 $page_cache_detail->get_error_code() 2477 ); 2478 $result['description'] = wp_kses_post( "<p>$error_info</p>" ) . $result['description']; 2479 return $result; 2480 } 2481 2482 $result['status'] = $page_cache_detail['status']; 2483 2484 switch ( $page_cache_detail['status'] ) { 2485 case 'recommended': 2486 $result['label'] = __( 'Page cache is not detected but the server response time is OK' ); 2487 break; 2488 case 'good': 2489 $result['label'] = __( 'Page cache is detected and the server response time is good' ); 2490 break; 2491 default: 2492 if ( empty( $page_cache_detail['headers'] ) && ! $page_cache_detail['advanced_cache_present'] ) { 2493 $result['label'] = __( 'Page cache is not detected and the server response time is slow' ); 2494 } else { 2495 $result['label'] = __( 'Page cache is detected but the server response time is still slow' ); 2496 } 2497 } 2498 2499 $page_cache_test_summary = array(); 2500 2501 if ( empty( $page_cache_detail['response_time'] ) ) { 2502 $page_cache_test_summary[] = '<span class="dashicons dashicons-dismiss" aria-hidden="true"></span> ' . __( 'Server response time could not be determined. Verify that loopback requests are working.' ); 2503 } else { 2504 2505 $threshold = $this->get_good_response_time_threshold(); 2506 if ( $page_cache_detail['response_time'] < $threshold ) { 2507 $page_cache_test_summary[] = '<span class="dashicons dashicons-yes-alt" aria-hidden="true"></span> ' . sprintf( 2508 /* translators: 1: The response time in milliseconds, 2: The recommended threshold in milliseconds. */ 2509 __( 'Median server response time was %1$s milliseconds. This is less than the recommended %2$s milliseconds threshold.' ), 2510 number_format_i18n( $page_cache_detail['response_time'] ), 2511 number_format_i18n( $threshold ) 2512 ); 2513 } else { 2514 $page_cache_test_summary[] = '<span class="dashicons dashicons-warning" aria-hidden="true"></span> ' . sprintf( 2515 /* translators: 1: The response time in milliseconds, 2: The recommended threshold in milliseconds. */ 2516 __( 'Median server response time was %1$s milliseconds. It should be less than the recommended %2$s milliseconds threshold.' ), 2517 number_format_i18n( $page_cache_detail['response_time'] ), 2518 number_format_i18n( $threshold ) 2519 ); 2520 } 2521 2522 if ( empty( $page_cache_detail['headers'] ) ) { 2523 $page_cache_test_summary[] = '<span class="dashicons dashicons-warning" aria-hidden="true"></span> ' . __( 'No client caching response headers were detected.' ); 2524 } else { 2525 $headers_summary = '<span class="dashicons dashicons-yes-alt" aria-hidden="true"></span>'; 2526 $headers_summary .= ' ' . sprintf( 2527 /* translators: %d: Number of caching headers. */ 2528 _n( 2529 'There was %d client caching response header detected:', 2530 'There were %d client caching response headers detected:', 2531 count( $page_cache_detail['headers'] ) 2532 ), 2533 count( $page_cache_detail['headers'] ) 2534 ); 2535 $headers_summary .= ' <code>' . implode( '</code>, <code>', $page_cache_detail['headers'] ) . '</code>.'; 2536 $page_cache_test_summary[] = $headers_summary; 2537 } 2538 } 2539 2540 if ( $page_cache_detail['advanced_cache_present'] ) { 2541 $page_cache_test_summary[] = '<span class="dashicons dashicons-yes-alt" aria-hidden="true"></span> ' . __( 'A page cache plugin was detected.' ); 2542 } elseif ( ! ( is_array( $page_cache_detail ) && ! empty( $page_cache_detail['headers'] ) ) ) { 2543 // Note: This message is not shown if client caching response headers were present since an external caching layer may be employed. 2544 $page_cache_test_summary[] = '<span class="dashicons dashicons-warning" aria-hidden="true"></span> ' . __( 'A page cache plugin was not detected.' ); 2545 } 2546 2547 $result['description'] .= '<ul><li>' . implode( '</li><li>', $page_cache_test_summary ) . '</li></ul>'; 2548 return $result; 2549 } 2550 2551 /** 2552 * Tests if the site uses persistent object cache and recommends to use it if not. 2553 * 2554 * @since 6.1.0 2555 * 2556 * @return array The test result. 2557 */ 2558 public function get_test_persistent_object_cache() { 2559 /** 2560 * Filters the action URL for the persistent object cache health check. 2561 * 2562 * @since 6.1.0 2563 * 2564 * @param string $action_url Learn more link for persistent object cache health check. 2565 */ 2566 $action_url = apply_filters( 2567 'site_status_persistent_object_cache_url', 2568 /* translators: Localized Support reference. */ 2569 __( 'https://developer.wordpress.org/advanced-administration/performance/optimization/#object-caching' ) 2570 ); 2571 2572 $result = array( 2573 'test' => 'persistent_object_cache', 2574 'status' => 'good', 2575 'badge' => array( 2576 'label' => __( 'Performance' ), 2577 'color' => 'blue', 2578 ), 2579 'label' => __( 'A persistent object cache is being used' ), 2580 'description' => sprintf( 2581 '<p>%s</p>', 2582 __( 'A persistent object cache makes your site’s database more efficient, resulting in faster load times because WordPress can retrieve your site’s content and settings much more quickly.' ) 2583 ), 2584 'actions' => sprintf( 2585 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 2586 esc_url( $action_url ), 2587 __( 'Learn more about persistent object caching.' ), 2588 /* translators: Hidden accessibility text. */ 2589 __( '(opens in a new tab)' ) 2590 ), 2591 ); 2592 2593 if ( wp_using_ext_object_cache() ) { 2594 return $result; 2595 } 2596 2597 if ( ! $this->should_suggest_persistent_object_cache() ) { 2598 $result['label'] = __( 'A persistent object cache is not required' ); 2599 2600 return $result; 2601 } 2602 2603 $available_services = $this->available_object_cache_services(); 2604 2605 $notes = __( 'Your hosting provider can tell you if a persistent object cache can be enabled on your site.' ); 2606 2607 if ( ! empty( $available_services ) ) { 2608 $notes .= ' ' . sprintf( 2609 /* translators: Available object caching services. */ 2610 __( 'Your host appears to support the following object caching services: %s.' ), 2611 implode( ', ', $available_services ) 2612 ); 2613 } 2614 2615 /** 2616 * Filters the second paragraph of the health check's description 2617 * when suggesting the use of a persistent object cache. 2618 * 2619 * Hosts may want to replace the notes to recommend their preferred object caching solution. 2620 * 2621 * Plugin authors may want to append notes (not replace) on why object caching is recommended for their plugin. 2622 * 2623 * @since 6.1.0 2624 * 2625 * @param string $notes The notes appended to the health check description. 2626 * @param string[] $available_services The list of available persistent object cache services. 2627 */ 2628 $notes = apply_filters( 'site_status_persistent_object_cache_notes', $notes, $available_services ); 2629 2630 $result['status'] = 'recommended'; 2631 $result['label'] = __( 'You should use a persistent object cache' ); 2632 $result['description'] .= sprintf( 2633 '<p>%s</p>', 2634 wp_kses( 2635 $notes, 2636 array( 2637 'a' => array( 'href' => true ), 2638 'code' => true, 2639 'em' => true, 2640 'strong' => true, 2641 ) 2642 ) 2643 ); 2644 2645 return $result; 2646 } 2647 2648 /** 2649 * Calculates total amount of autoloaded data. 2650 * 2651 * @since 6.6.0 2652 * 2653 * @return int Autoloaded data in bytes. 2654 */ 2655 public function get_autoloaded_options_size() { 2656 $alloptions = wp_load_alloptions(); 2657 2658 $total_length = 0; 2659 2660 foreach ( $alloptions as $option_value ) { 2661 if ( is_array( $option_value ) || is_object( $option_value ) ) { 2662 $option_value = maybe_serialize( $option_value ); 2663 } 2664 $total_length += strlen( (string) $option_value ); 2665 } 2666 2667 return $total_length; 2668 } 2669 2670 /** 2671 * Tests the number of autoloaded options. 2672 * 2673 * @since 6.6.0 2674 * 2675 * @return array The test results. 2676 */ 2677 public function get_test_autoloaded_options() { 2678 $autoloaded_options_size = $this->get_autoloaded_options_size(); 2679 $autoloaded_options_count = count( wp_load_alloptions() ); 2680 2681 $base_description = __( 'Autoloaded options are configuration settings for plugins and themes that are automatically loaded with every page load in WordPress. Having too many autoloaded options can slow down your site.' ); 2682 2683 $result = array( 2684 'label' => __( 'Autoloaded options are acceptable' ), 2685 'status' => 'good', 2686 'badge' => array( 2687 'label' => __( 'Performance' ), 2688 'color' => 'blue', 2689 ), 2690 'description' => sprintf( 2691 /* translators: 1: Number of autoloaded options, 2: Autoloaded options size. */ 2692 '<p>' . esc_html( $base_description ) . ' ' . __( 'Your site has %1$s autoloaded options (size: %2$s) in the options table, which is acceptable.' ) . '</p>', 2693 $autoloaded_options_count, 2694 size_format( $autoloaded_options_size ) 2695 ), 2696 'actions' => '', 2697 'test' => 'autoloaded_options', 2698 ); 2699 2700 /** 2701 * Filters max bytes threshold to trigger warning in Site Health. 2702 * 2703 * @since 6.6.0 2704 * 2705 * @param int $limit Autoloaded options threshold size. Default 800000. 2706 */ 2707 $limit = apply_filters( 'site_status_autoloaded_options_size_limit', 800000 ); 2708 2709 if ( $autoloaded_options_size < $limit ) { 2710 return $result; 2711 } 2712 2713 $result['status'] = 'critical'; 2714 $result['label'] = __( 'Autoloaded options could affect performance' ); 2715 $result['description'] = sprintf( 2716 /* translators: 1: Number of autoloaded options, 2: Autoloaded options size. */ 2717 '<p>' . esc_html( $base_description ) . ' ' . __( 'Your site has %1$s autoloaded options (size: %2$s) in the options table, which could cause your site to be slow. You can review the options being autoloaded in your database and remove any options that are no longer needed by your site.' ) . '</p>', 2718 $autoloaded_options_count, 2719 size_format( $autoloaded_options_size ) 2720 ); 2721 2722 /** 2723 * Filters description to be shown on Site Health warning when threshold is met. 2724 * 2725 * @since 6.6.0 2726 * 2727 * @param string $description Description message when autoloaded options bigger than threshold. 2728 */ 2729 $result['description'] = apply_filters( 'site_status_autoloaded_options_limit_description', $result['description'] ); 2730 2731 $result['actions'] = sprintf( 2732 /* translators: 1: HelpHub URL, 2: Link description. */ 2733 '<p><a target="_blank" href="%1$s">%2$s</a></p>', 2734 esc_url( __( 'https://developer.wordpress.org/advanced-administration/performance/optimization/#autoloaded-options' ) ), 2735 __( 'More info about optimizing autoloaded options' ) 2736 ); 2737 2738 /** 2739 * Filters actionable information to tackle the problem. It can be a link to an external guide. 2740 * 2741 * @since 6.6.0 2742 * 2743 * @param string $actions Call to Action to be used to point to the right direction to solve the issue. 2744 */ 2745 $result['actions'] = apply_filters( 'site_status_autoloaded_options_action_to_perform', $result['actions'] ); 2746 return $result; 2747 } 2748 2749 /** 2750 * Tests whether search engine indexing is enabled. 2751 * 2752 * Surfaces as “good” if `blog_public === 1`, or “recommended” if `blog_public === 0`. 2753 * 2754 * @since 6.9.0 2755 * 2756 * @return array The test results. 2757 */ 2758 public function get_test_search_engine_visibility() { 2759 $result = array( 2760 'label' => __( 'Search engine indexing is enabled.' ), 2761 'status' => 'good', 2762 'badge' => array( 2763 'label' => __( 'Privacy' ), 2764 'color' => 'blue', 2765 ), 2766 'description' => sprintf( 2767 '<p>%s</p>', 2768 __( 'Search engines can crawl and index your site. No action needed.' ) 2769 ), 2770 'actions' => sprintf( 2771 '<p><a href="%1$s">%2$s</a></p>', 2772 esc_url( admin_url( 'options-reading.php#blog_public' ) ), 2773 __( 'Review your visibility settings' ) 2774 ), 2775 'test' => 'search_engine_visibility', 2776 ); 2777 2778 // If indexing is discouraged, flip to “recommended”: 2779 if ( ! get_option( 'blog_public' ) ) { 2780 $result['status'] = 'recommended'; 2781 $result['label'] = __( 'Search engines are discouraged from indexing this site.' ); 2782 $result['badge']['color'] = 'blue'; 2783 $result['description'] = sprintf( 2784 '<p>%s</p>', 2785 __( 'Your site is hidden from search engines. Consider enabling indexing if this is a public site.' ) 2786 ); 2787 } 2788 2789 return $result; 2790 } 2791 2792 /** 2793 * Tests if opcode cache is enabled and available. 2794 * 2795 * @since 7.0.0 2796 * 2797 * @return array<string, string|array<string, string>> The test result. 2798 */ 2799 public function get_test_opcode_cache(): array { 2800 $opcode_cache_enabled = false; 2801 if ( function_exists( 'opcache_get_status' ) ) { 2802 $status = @opcache_get_status( false ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- Warning emitted in failure case. 2803 if ( $status && true === $status['opcache_enabled'] ) { 2804 $opcode_cache_enabled = true; 2805 } 2806 } 2807 2808 $result = array( 2809 'label' => __( 'Opcode cache is enabled' ), 2810 'status' => 'good', 2811 'badge' => array( 2812 'label' => __( 'Performance' ), 2813 'color' => 'blue', 2814 ), 2815 'description' => sprintf( 2816 '<p>%s</p>', 2817 __( 'Opcode cache improves PHP performance by storing precompiled script bytecode in memory, reducing the need for PHP to load and parse scripts on each request.' ) 2818 ), 2819 'actions' => sprintf( 2820 '<p><a href="%s" target="_blank">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>', 2821 esc_url( 'https://www.php.net/manual/en/book.opcache.php' ), 2822 __( 'Learn more about OPcache.' ), 2823 /* translators: Hidden accessibility text. */ 2824 __( '(opens in a new tab)' ) 2825 ), 2826 'test' => 'opcode_cache', 2827 ); 2828 2829 if ( ! $opcode_cache_enabled ) { 2830 $result['status'] = 'recommended'; 2831 $result['label'] = __( 'Opcode cache is not enabled' ); 2832 $result['description'] .= '<p>' . __( 'Enabling this cache can significantly improve the performance of your site.' ) . '</p>'; 2833 } 2834 2835 return $result; 2836 } 2837 2838 /** 2839 * Returns a set of tests that belong to the site status page. 2840 * 2841 * Each site status test is defined here, they may be `direct` tests, that run on page load, or `async` tests 2842 * which will run later down the line via JavaScript calls to improve page performance and hopefully also user 2843 * experiences. 2844 * 2845 * @since 5.2.0 2846 * @since 5.6.0 Added support for `has_rest` and `permissions`. 2847 * 2848 * @return array The list of tests to run. 2849 */ 2850 public static function get_tests() { 2851 $tests = array( 2852 'direct' => array( 2853 'wordpress_version' => array( 2854 'label' => __( 'WordPress Version' ), 2855 'test' => 'wordpress_version', 2856 ), 2857 'plugin_version' => array( 2858 'label' => __( 'Plugin Versions' ), 2859 'test' => 'plugin_version', 2860 ), 2861 'theme_version' => array( 2862 'label' => __( 'Theme Versions' ), 2863 'test' => 'theme_version', 2864 ), 2865 'php_version' => array( 2866 'label' => __( 'PHP Version' ), 2867 'test' => 'php_version', 2868 ), 2869 'php_extensions' => array( 2870 'label' => __( 'PHP Extensions' ), 2871 'test' => 'php_extensions', 2872 ), 2873 'php_default_timezone' => array( 2874 'label' => __( 'PHP Default Timezone' ), 2875 'test' => 'php_default_timezone', 2876 ), 2877 'php_sessions' => array( 2878 'label' => __( 'PHP Sessions' ), 2879 'test' => 'php_sessions', 2880 ), 2881 'sql_server' => array( 2882 'label' => __( 'Database Server version' ), 2883 'test' => 'sql_server', 2884 ), 2885 'ssl_support' => array( 2886 'label' => __( 'Secure communication' ), 2887 'test' => 'ssl_support', 2888 ), 2889 'scheduled_events' => array( 2890 'label' => __( 'Scheduled events' ), 2891 'test' => 'scheduled_events', 2892 ), 2893 'http_requests' => array( 2894 'label' => __( 'HTTP Requests' ), 2895 'test' => 'http_requests', 2896 ), 2897 'rest_availability' => array( 2898 'label' => __( 'REST API availability' ), 2899 'test' => 'rest_availability', 2900 'skip_cron' => true, 2901 ), 2902 'debug_enabled' => array( 2903 'label' => __( 'Debugging enabled' ), 2904 'test' => 'is_in_debug_mode', 2905 ), 2906 'file_uploads' => array( 2907 'label' => __( 'File uploads' ), 2908 'test' => 'file_uploads', 2909 ), 2910 'plugin_theme_auto_updates' => array( 2911 'label' => __( 'Plugin and theme auto-updates' ), 2912 'test' => 'plugin_theme_auto_updates', 2913 ), 2914 'update_temp_backup_writable' => array( 2915 'label' => __( 'Plugin and theme temporary backup directory access' ), 2916 'test' => 'update_temp_backup_writable', 2917 ), 2918 'available_updates_disk_space' => array( 2919 'label' => __( 'Available disk space' ), 2920 'test' => 'available_updates_disk_space', 2921 ), 2922 'autoloaded_options' => array( 2923 'label' => __( 'Autoloaded options' ), 2924 'test' => 'autoloaded_options', 2925 ), 2926 'insecure_registration' => array( 2927 'label' => __( 'Open Registration with privileged default role' ), 2928 'test' => 'insecure_registration', 2929 ), 2930 'search_engine_visibility' => array( 2931 'label' => __( 'Search Engine Visibility' ), 2932 'test' => 'search_engine_visibility', 2933 ), 2934 'opcode_cache' => array( 2935 'label' => __( 'Opcode cache' ), 2936 'test' => 'opcode_cache', 2937 ), 2938 ), 2939 'async' => array( 2940 'dotorg_communication' => array( 2941 'label' => __( 'Communication with WordPress.org' ), 2942 'test' => rest_url( 'wp-site-health/v1/tests/dotorg-communication' ), 2943 'has_rest' => true, 2944 'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_dotorg_communication' ), 2945 ), 2946 'background_updates' => array( 2947 'label' => __( 'Background updates' ), 2948 'test' => rest_url( 'wp-site-health/v1/tests/background-updates' ), 2949 'has_rest' => true, 2950 'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_background_updates' ), 2951 ), 2952 'loopback_requests' => array( 2953 'label' => __( 'Loopback request' ), 2954 'test' => rest_url( 'wp-site-health/v1/tests/loopback-requests' ), 2955 'has_rest' => true, 2956 'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_loopback_requests' ), 2957 ), 2958 'https_status' => array( 2959 'label' => __( 'HTTPS status' ), 2960 'test' => rest_url( 'wp-site-health/v1/tests/https-status' ), 2961 'has_rest' => true, 2962 'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_https_status' ), 2963 ), 2964 ), 2965 ); 2966 2967 // Conditionally include Authorization header test if the site isn't protected by Basic Auth. 2968 if ( ! wp_is_site_protected_by_basic_auth() ) { 2969 $tests['async']['authorization_header'] = array( 2970 'label' => __( 'Authorization header' ), 2971 'test' => rest_url( 'wp-site-health/v1/tests/authorization-header' ), 2972 'has_rest' => true, 2973 'headers' => array( 'Authorization' => 'Basic ' . base64_encode( 'user:pwd' ) ), 2974 'skip_cron' => true, 2975 ); 2976 } 2977 2978 // Only check for caches in production environments. 2979 if ( 'production' === wp_get_environment_type() ) { 2980 $tests['async']['page_cache'] = array( 2981 'label' => __( 'Page cache' ), 2982 'test' => rest_url( 'wp-site-health/v1/tests/page-cache' ), 2983 'has_rest' => true, 2984 'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_page_cache' ), 2985 ); 2986 2987 $tests['direct']['persistent_object_cache'] = array( 2988 'label' => __( 'Persistent object cache' ), 2989 'test' => 'persistent_object_cache', 2990 ); 2991 } 2992 2993 /** 2994 * Filters which site status tests are run on a site. 2995 * 2996 * The site health is determined by a set of tests based on best practices from 2997 * both the WordPress Hosting Team and web standards in general. 2998 * 2999 * Some sites may not have the same requirements, for example the automatic update 3000 * checks may be handled by a host, and are therefore disabled in core. 3001 * Or maybe you want to introduce a new test, is caching enabled/disabled/stale for example. 3002 * 3003 * Tests may be added either as direct, or asynchronous ones. Any test that may require some time 3004 * to complete should run asynchronously, to avoid extended loading periods within wp-admin. 3005 * 3006 * @since 5.2.0 3007 * @since 5.6.0 Added the `async_direct_test` array key for asynchronous tests. 3008 * Added the `skip_cron` array key for all tests. 3009 * 3010 * @param array[] $tests { 3011 * An associative array of direct and asynchronous tests. 3012 * 3013 * @type array[] $direct { 3014 * An array of direct tests. 3015 * 3016 * @type array ...$identifier { 3017 * `$identifier` should be a unique identifier for the test. Plugins and themes are encouraged to 3018 * prefix test identifiers with their slug to avoid collisions between tests. 3019 * 3020 * @type string $label The friendly label to identify the test. 3021 * @type callable $test The callback function that runs the test and returns its result. 3022 * @type bool $skip_cron Whether to skip this test when running as cron. 3023 * } 3024 * } 3025 * @type array[] $async { 3026 * An array of asynchronous tests. 3027 * 3028 * @type array ...$identifier { 3029 * `$identifier` should be a unique identifier for the test. Plugins and themes are encouraged to 3030 * prefix test identifiers with their slug to avoid collisions between tests. 3031 * 3032 * @type string $label The friendly label to identify the test. 3033 * @type string $test An admin-ajax.php action to be called to perform the test, or 3034 * if `$has_rest` is true, a URL to a REST API endpoint to perform 3035 * the test. 3036 * @type bool $has_rest Whether the `$test` property points to a REST API endpoint. 3037 * @type bool $skip_cron Whether to skip this test when running as cron. 3038 * @type callable $async_direct_test A manner of directly calling the test marked as asynchronous, 3039 * as the scheduled event can not authenticate, and endpoints 3040 * may require authentication. 3041 * } 3042 * } 3043 * } 3044 */ 3045 $tests = apply_filters( 'site_status_tests', $tests ); 3046 3047 // Ensure that the filtered tests contain the required array keys. 3048 $tests = array_merge( 3049 array( 3050 'direct' => array(), 3051 'async' => array(), 3052 ), 3053 $tests 3054 ); 3055 3056 return $tests; 3057 } 3058 3059 /** 3060 * Adds a class to the body HTML tag. 3061 * 3062 * Filters the body class string for admin pages and adds our own class for easier styling. 3063 * 3064 * @since 5.2.0 3065 * 3066 * @param string $body_class The body class string. 3067 * @return string The modified body class string. 3068 */ 3069 public function admin_body_class( $body_class ) { 3070 $screen = get_current_screen(); 3071 if ( 'site-health' !== $screen->id ) { 3072 return $body_class; 3073 } 3074 3075 $body_class .= ' site-health'; 3076 3077 return $body_class; 3078 } 3079 3080 /** 3081 * Initiates the WP_Cron schedule test cases. 3082 * 3083 * @since 5.2.0 3084 */ 3085 private function wp_schedule_test_init() { 3086 $this->schedules = wp_get_schedules(); 3087 $this->get_cron_tasks(); 3088 } 3089 3090 /** 3091 * Populates the list of cron events and store them to a class-wide variable. 3092 * 3093 * @since 5.2.0 3094 */ 3095 private function get_cron_tasks() { 3096 $cron_tasks = _get_cron_array(); 3097 3098 if ( empty( $cron_tasks ) ) { 3099 $this->crons = new WP_Error( 'no_tasks', __( 'No scheduled events exist on this site.' ) ); 3100 return; 3101 } 3102 3103 $this->crons = array(); 3104 3105 foreach ( $cron_tasks as $time => $cron ) { 3106 foreach ( $cron as $hook => $dings ) { 3107 foreach ( $dings as $sig => $data ) { 3108 3109 $this->crons[ "$hook-$sig-$time" ] = (object) array( 3110 'hook' => $hook, 3111 'time' => $time, 3112 'sig' => $sig, 3113 'args' => $data['args'], 3114 'schedule' => $data['schedule'], 3115 'interval' => $data['interval'] ?? null, 3116 ); 3117 3118 } 3119 } 3120 } 3121 } 3122 3123 /** 3124 * Checks if any scheduled tasks have been missed. 3125 * 3126 * Returns a boolean value of `true` if a scheduled task has been missed and ends processing. 3127 * 3128 * If the list of crons is an instance of WP_Error, returns the instance instead of a boolean value. 3129 * 3130 * @since 5.2.0 3131 * 3132 * @return bool|WP_Error True if a cron was missed, false if not. WP_Error if the cron is set to that. 3133 */ 3134 public function has_missed_cron() { 3135 if ( is_wp_error( $this->crons ) ) { 3136 return $this->crons; 3137 } 3138 3139 foreach ( $this->crons as $id => $cron ) { 3140 if ( ( $cron->time - time() ) < $this->timeout_missed_cron ) { 3141 $this->last_missed_cron = $cron->hook; 3142 return true; 3143 } 3144 } 3145 3146 return false; 3147 } 3148 3149 /** 3150 * Checks if any scheduled tasks are late. 3151 * 3152 * Returns a boolean value of `true` if a scheduled task is late and ends processing. 3153 * 3154 * If the list of crons is an instance of WP_Error, returns the instance instead of a boolean value. 3155 * 3156 * @since 5.3.0 3157 * 3158 * @return bool|WP_Error True if a cron is late, false if not. WP_Error if the cron is set to that. 3159 */ 3160 public function has_late_cron() { 3161 if ( is_wp_error( $this->crons ) ) { 3162 return $this->crons; 3163 } 3164 3165 foreach ( $this->crons as $id => $cron ) { 3166 $cron_offset = $cron->time - time(); 3167 if ( 3168 $cron_offset >= $this->timeout_missed_cron && 3169 $cron_offset < $this->timeout_late_cron 3170 ) { 3171 $this->last_late_cron = $cron->hook; 3172 return true; 3173 } 3174 } 3175 3176 return false; 3177 } 3178 3179 /** 3180 * Checks for potential issues with plugin and theme auto-updates. 3181 * 3182 * Though there is no way to 100% determine if plugin and theme auto-updates are configured 3183 * correctly, a few educated guesses could be made to flag any conditions that would 3184 * potentially cause unexpected behaviors. 3185 * 3186 * @since 5.5.0 3187 * 3188 * @return object The test results. 3189 */ 3190 public function detect_plugin_theme_auto_update_issues() { 3191 $mock_plugin = (object) array( 3192 'id' => 'w.org/plugins/a-fake-plugin', 3193 'slug' => 'a-fake-plugin', 3194 'plugin' => 'a-fake-plugin/a-fake-plugin.php', 3195 'new_version' => '9.9', 3196 'url' => 'https://wordpress.org/plugins/a-fake-plugin/', 3197 'package' => 'https://downloads.wordpress.org/plugin/a-fake-plugin.9.9.zip', 3198 'icons' => array( 3199 '2x' => 'https://ps.w.org/a-fake-plugin/assets/icon-256x256.png', 3200 '1x' => 'https://ps.w.org/a-fake-plugin/assets/icon-128x128.png', 3201 ), 3202 'banners' => array( 3203 '2x' => 'https://ps.w.org/a-fake-plugin/assets/banner-1544x500.png', 3204 '1x' => 'https://ps.w.org/a-fake-plugin/assets/banner-772x250.png', 3205 ), 3206 'banners_rtl' => array(), 3207 'tested' => '5.5.0', 3208 'requires_php' => '5.6.20', 3209 'compatibility' => new stdClass(), 3210 ); 3211 3212 $mock_theme = (object) array( 3213 'theme' => 'a-fake-theme', 3214 'new_version' => '9.9', 3215 'url' => 'https://wordpress.org/themes/a-fake-theme/', 3216 'package' => 'https://downloads.wordpress.org/theme/a-fake-theme.9.9.zip', 3217 'requires' => '5.0.0', 3218 'requires_php' => '5.6.20', 3219 ); 3220 3221 $test_plugins_enabled = wp_is_auto_update_forced_for_item( 'plugin', true, $mock_plugin ); 3222 $test_themes_enabled = wp_is_auto_update_forced_for_item( 'theme', true, $mock_theme ); 3223 3224 $ui_enabled_for_plugins = wp_is_auto_update_enabled_for_type( 'plugin' ); 3225 $ui_enabled_for_themes = wp_is_auto_update_enabled_for_type( 'theme' ); 3226 $plugin_filter_present = has_filter( 'auto_update_plugin' ); 3227 $theme_filter_present = has_filter( 'auto_update_theme' ); 3228 3229 if ( ( ! $test_plugins_enabled && $ui_enabled_for_plugins ) 3230 || ( ! $test_themes_enabled && $ui_enabled_for_themes ) 3231 ) { 3232 return (object) array( 3233 'status' => 'critical', 3234 'message' => __( 'Auto-updates for plugins and/or themes appear to be disabled, but settings are still set to be displayed. This could cause auto-updates to not work as expected.' ), 3235 ); 3236 } 3237 3238 if ( ( ! $test_plugins_enabled && $plugin_filter_present ) 3239 && ( ! $test_themes_enabled && $theme_filter_present ) 3240 ) { 3241 return (object) array( 3242 'status' => 'recommended', 3243 'message' => __( 'Auto-updates for plugins and themes appear to be disabled. This will prevent your site from receiving new versions automatically when available.' ), 3244 ); 3245 } elseif ( ! $test_plugins_enabled && $plugin_filter_present ) { 3246 return (object) array( 3247 'status' => 'recommended', 3248 'message' => __( 'Auto-updates for plugins appear to be disabled. This will prevent your site from receiving new versions automatically when available.' ), 3249 ); 3250 } elseif ( ! $test_themes_enabled && $theme_filter_present ) { 3251 return (object) array( 3252 'status' => 'recommended', 3253 'message' => __( 'Auto-updates for themes appear to be disabled. This will prevent your site from receiving new versions automatically when available.' ), 3254 ); 3255 } 3256 3257 return (object) array( 3258 'status' => 'good', 3259 'message' => __( 'There appear to be no issues with plugin and theme auto-updates.' ), 3260 ); 3261 } 3262 3263 /** 3264 * Runs a loopback test on the site. 3265 * 3266 * Loopbacks are what WordPress uses to communicate with itself to start up WP_Cron, scheduled posts, 3267 * make sure plugin or theme edits don't cause site failures and similar. 3268 * 3269 * @since 5.2.0 3270 * 3271 * @return object The test results. 3272 */ 3273 public function can_perform_loopback() { 3274 $body = array( 'site-health' => 'loopback-test' ); 3275 $cookies = wp_unslash( $_COOKIE ); 3276 $timeout = 10; // 10 seconds. 3277 $headers = array( 3278 'Cache-Control' => 'no-cache', 3279 ); 3280 3281 // Include Basic auth in loopback requests. 3282 if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) { 3283 $headers['Authorization'] = 'Basic ' . base64_encode( wp_unslash( $_SERVER['PHP_AUTH_USER'] ) . ':' . wp_unslash( $_SERVER['PHP_AUTH_PW'] ) ); 3284 } 3285 3286 $url = site_url( 'wp-cron.php' ); 3287 3288 /** This filter is documented in wp-includes/class-wp-http-streams.php */ 3289 $sslverify = apply_filters( 'https_local_ssl_verify', false, $url ); 3290 3291 /* 3292 * A post request is used for the wp-cron.php loopback test to cause the file 3293 * to finish early without triggering cron jobs. This has two benefits: 3294 * - cron jobs are not triggered a second time on the site health page, 3295 * - the loopback request finishes sooner providing a quicker result. 3296 * 3297 * Using a POST request causes the loopback to differ slightly to the standard 3298 * GET request WordPress uses for wp-cron.php loopback requests but is close 3299 * enough. See https://core.trac.wordpress.org/ticket/52547 3300 */ 3301 $r = wp_remote_post( $url, compact( 'body', 'cookies', 'headers', 'timeout', 'sslverify' ) ); 3302 3303 if ( is_wp_error( $r ) ) { 3304 return (object) array( 3305 'status' => 'critical', 3306 'message' => sprintf( 3307 '%s<br>%s', 3308 __( 'The loopback request to your site failed, this means features relying on them are not currently working as expected.' ), 3309 sprintf( 3310 /* translators: 1: The WordPress error message. 2: The WordPress error code. */ 3311 __( 'Error: %1$s (%2$s)' ), 3312 $r->get_error_message(), 3313 $r->get_error_code() 3314 ) 3315 ), 3316 ); 3317 } 3318 3319 if ( 200 !== wp_remote_retrieve_response_code( $r ) ) { 3320 return (object) array( 3321 'status' => 'recommended', 3322 'message' => sprintf( 3323 /* translators: %d: The HTTP response code returned. */ 3324 __( 'The loopback request returned an unexpected http status code, %d, it was not possible to determine if this will prevent features from working as expected.' ), 3325 wp_remote_retrieve_response_code( $r ) 3326 ), 3327 ); 3328 } 3329 3330 return (object) array( 3331 'status' => 'good', 3332 'message' => __( 'The loopback request to your site completed successfully.' ), 3333 ); 3334 } 3335 3336 /** 3337 * Creates a weekly cron event, if one does not already exist. 3338 * 3339 * @since 5.4.0 3340 */ 3341 public function maybe_create_scheduled_event() { 3342 if ( ! wp_next_scheduled( 'wp_site_health_scheduled_check' ) && ! wp_installing() ) { 3343 wp_schedule_event( time() + DAY_IN_SECONDS, 'weekly', 'wp_site_health_scheduled_check' ); 3344 } 3345 } 3346 3347 /** 3348 * Runs the scheduled event to check and update the latest site health status for the website. 3349 * 3350 * @since 5.4.0 3351 */ 3352 public function wp_cron_scheduled_check() { 3353 // Bootstrap wp-admin, as WP_Cron doesn't do this for us. 3354 require_once trailingslashit( ABSPATH ) . 'wp-admin/includes/admin.php'; 3355 3356 $tests = WP_Site_Health::get_tests(); 3357 3358 $results = array(); 3359 3360 $site_status = array( 3361 'good' => 0, 3362 'recommended' => 0, 3363 'critical' => 0, 3364 ); 3365 3366 // Don't run https test on development environments. 3367 if ( $this->is_development_environment() ) { 3368 unset( $tests['async']['https_status'] ); 3369 } 3370 3371 foreach ( $tests['direct'] as $test ) { 3372 if ( ! empty( $test['skip_cron'] ) ) { 3373 continue; 3374 } 3375 3376 if ( is_string( $test['test'] ) ) { 3377 $test_function = sprintf( 3378 'get_test_%s', 3379 $test['test'] 3380 ); 3381 3382 if ( method_exists( $this, $test_function ) && is_callable( array( $this, $test_function ) ) ) { 3383 $results[] = $this->perform_test( array( $this, $test_function ) ); 3384 continue; 3385 } 3386 } 3387 3388 if ( is_callable( $test['test'] ) ) { 3389 $results[] = $this->perform_test( $test['test'] ); 3390 } 3391 } 3392 3393 foreach ( $tests['async'] as $test ) { 3394 if ( ! empty( $test['skip_cron'] ) ) { 3395 continue; 3396 } 3397 3398 // Local endpoints may require authentication, so asynchronous tests can pass a direct test runner as well. 3399 if ( ! empty( $test['async_direct_test'] ) && is_callable( $test['async_direct_test'] ) ) { 3400 // This test is callable, do so and continue to the next asynchronous check. 3401 $results[] = $this->perform_test( $test['async_direct_test'] ); 3402 continue; 3403 } 3404 3405 if ( is_string( $test['test'] ) ) { 3406 // Check if this test has a REST API endpoint. 3407 if ( isset( $test['has_rest'] ) && $test['has_rest'] ) { 3408 $result_fetch = wp_remote_get( 3409 $test['test'], 3410 array( 3411 'body' => array( 3412 '_wpnonce' => wp_create_nonce( 'wp_rest' ), 3413 ), 3414 ) 3415 ); 3416 } else { 3417 $result_fetch = wp_remote_post( 3418 admin_url( 'admin-ajax.php' ), 3419 array( 3420 'body' => array( 3421 'action' => $test['test'], 3422 '_wpnonce' => wp_create_nonce( 'health-check-site-status' ), 3423 ), 3424 ) 3425 ); 3426 } 3427 3428 if ( ! is_wp_error( $result_fetch ) && 200 === wp_remote_retrieve_response_code( $result_fetch ) ) { 3429 $result = json_decode( wp_remote_retrieve_body( $result_fetch ), true ); 3430 } else { 3431 $result = false; 3432 } 3433 3434 if ( is_array( $result ) ) { 3435 $results[] = $result; 3436 } else { 3437 $results[] = array( 3438 'status' => 'recommended', 3439 'label' => __( 'A test is unavailable' ), 3440 ); 3441 } 3442 } 3443 } 3444 3445 foreach ( $results as $result ) { 3446 if ( 'critical' === $result['status'] ) { 3447 ++$site_status['critical']; 3448 } elseif ( 'recommended' === $result['status'] ) { 3449 ++$site_status['recommended']; 3450 } else { 3451 ++$site_status['good']; 3452 } 3453 } 3454 3455 set_transient( 'health-check-site-status-result', wp_json_encode( $site_status ) ); 3456 } 3457 3458 /** 3459 * Checks if the current environment type is set to 'development' or 'local'. 3460 * 3461 * @since 5.6.0 3462 * 3463 * @return bool True if it is a development environment, false if not. 3464 */ 3465 public function is_development_environment() { 3466 return in_array( wp_get_environment_type(), array( 'development', 'local' ), true ); 3467 } 3468 3469 /** 3470 * Returns a mapping from response headers to an optional callback to verify if page cache is enabled or not. 3471 * 3472 * @since 6.1.0 3473 * 3474 * @return array<string, ?callable> Mapping of page caching headers and their (optional) verification callbacks. 3475 * A null value means a simple existence check is used for the header. 3476 */ 3477 public function get_page_cache_headers(): array { 3478 3479 $cache_hit_callback = static function ( $header_value ) { 3480 return 1 === preg_match( '/(^| |,)HIT(,| |$)/i', $header_value ); 3481 }; 3482 3483 $cache_headers = array( 3484 // Standard HTTP caching headers. 3485 'cache-control' => static function ( $header_value ) { 3486 return (bool) preg_match( '/max-age=[1-9]/', $header_value ); 3487 }, 3488 'expires' => static function ( $header_value ) { 3489 return strtotime( $header_value ) > time(); 3490 }, 3491 'age' => static function ( $header_value ) { 3492 return is_numeric( $header_value ) && $header_value > 0; 3493 }, 3494 'last-modified' => null, 3495 'etag' => null, 3496 'via' => null, 3497 3498 /** 3499 * Custom caching headers. 3500 * 3501 * These do not seem to be actually used by any caching layers. There were first introduced in a Site Health 3502 * test in the AMP plugin. They were copied into the Performance Lab plugin's Site Health test before they 3503 * were merged into core. 3504 * 3505 * @link https://github.com/ampproject/amp-wp/pull/6849 3506 * @link https://github.com/WordPress/performance/pull/263 3507 * @link https://core.trac.wordpress.org/changeset/54043 3508 */ 3509 'x-cache-enabled' => static function ( $header_value ) { 3510 return ( 'true' === strtolower( $header_value ) ); 3511 }, 3512 'x-cache-disabled' => static function ( $header_value ) { 3513 return ( 'on' !== strtolower( $header_value ) ); 3514 }, 3515 3516 /** 3517 * CloudFlare. 3518 * 3519 * @link https://developers.cloudflare.com/cache/concepts/cache-responses/ 3520 */ 3521 'cf-cache-status' => $cache_hit_callback, 3522 3523 /** 3524 * Fastly. 3525 * 3526 * @link https://www.fastly.com/documentation/reference/http/http-headers/X-Cache/ 3527 */ 3528 'x-cache' => $cache_hit_callback, 3529 3530 /** 3531 * LightSpeed. 3532 * 3533 * @link https://docs.litespeedtech.com/lscache/devguide/controls/#x-litespeed-cache 3534 */ 3535 'x-litespeed-cache' => $cache_hit_callback, 3536 3537 /** 3538 * OpenResty srcache-nginx-module. 3539 * 3540 * The `x-srcache-store-status` header indicates if the response was stored in the cache. 3541 * Valid values include `STORE` and `BYPASS`. 3542 * 3543 * The `x-srcache-fetch-status` header indicates if the response was fetched from the cache. 3544 * Valid values include `HIT`, `MISS`, and `BYPASS`. 3545 * 3546 * @link https://github.com/openresty/srcache-nginx-module 3547 */ 3548 'x-srcache-store-status' => static function ( $header_value ) { 3549 return 'store' === strtolower( $header_value ); 3550 }, 3551 'x-srcache-fetch-status' => $cache_hit_callback, 3552 3553 /** 3554 * Nginx. 3555 * 3556 * @link https://blog.nginx.org/blog/nginx-caching-guide 3557 * @link https://www.inmotionhosting.com/support/website/nginx-cache-management/ 3558 */ 3559 'x-cache-status' => $cache_hit_callback, 3560 'x-proxy-cache' => $cache_hit_callback, 3561 3562 /** 3563 * Varnish Cache. 3564 * 3565 * A header with a single number indicates it was not cached. If there are two numbers (or more), then this 3566 * indicates the response was cached. 3567 * 3568 * @link https://vinyl-cache.org/docs/2.1/faq/http.html 3569 * @link https://www.fastly.com/documentation/reference/http/http-headers/X-Varnish/ 3570 * @link https://www.linuxjournal.com/content/speed-your-web-site-varnish 3571 */ 3572 'x-varnish' => static function ( $header_value ) { 3573 return 1 === preg_match( '/^\d+ \d+/', $header_value ); 3574 }, 3575 ); 3576 3577 /** 3578 * Filters the list of cache headers supported by core. 3579 * 3580 * This list indicates how each of the specified headers will be checked to indicate if a page cache is enabled 3581 * or not. WordPress checks for each of the headers in the returned array. If the callback is provided, it will 3582 * be passed the value for the corresponding header and return a boolean value indicating if the header suggests 3583 * that a cache is active. If the value is `null` for the header, then WordPress will assume that a cache is 3584 * active if the header is present, regardless of its value. 3585 * 3586 * @since 6.1.0 3587 * 3588 * @param array<string, ?callable> $cache_headers Mapping from cache-related HTTP headers to whether they 3589 * indicate if a page cache is enabled for the site. `null` 3590 * indicates caching in the presence of the header; a callback is 3591 * provided the header’s value and should return `true` if it 3592 * implies that a cache is active. 3593 */ 3594 return (array) apply_filters( 'site_status_page_cache_supported_cache_headers', $cache_headers ); 3595 } 3596 3597 /** 3598 * Checks if site has page cache enabled or not. 3599 * 3600 * @since 6.1.0 3601 * 3602 * @return WP_Error|array { 3603 * Page cache detection details or else error information. 3604 * 3605 * @type bool $advanced_cache_present Whether a page cache plugin is present. 3606 * @type array[] $page_caching_response_headers Sets of client caching headers for the responses. 3607 * @type float[] $response_timing Response timings. 3608 * } 3609 */ 3610 private function check_for_page_caching() { 3611 3612 /** This filter is documented in wp-includes/class-wp-http-streams.php */ 3613 $sslverify = apply_filters( 'https_local_ssl_verify', false, home_url( '/' ) ); 3614 3615 $headers = array(); 3616 3617 /* 3618 * Include basic auth in loopback requests. Note that this will only pass along basic auth when user is 3619 * initiating the test. If a site requires basic auth, the test will fail when it runs in WP Cron as part of 3620 * wp_site_health_scheduled_check. This logic is copied from WP_Site_Health::can_perform_loopback(). 3621 */ 3622 if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) { 3623 $headers['Authorization'] = 'Basic ' . base64_encode( wp_unslash( $_SERVER['PHP_AUTH_USER'] ) . ':' . wp_unslash( $_SERVER['PHP_AUTH_PW'] ) ); 3624 } 3625 3626 $caching_headers = $this->get_page_cache_headers(); 3627 $page_caching_response_headers = array(); 3628 $response_timing = array(); 3629 3630 for ( $i = 1; $i <= 3; $i++ ) { 3631 $start_time = microtime( true ); 3632 $http_response = wp_remote_get( home_url( '/' ), compact( 'sslverify', 'headers' ) ); 3633 $end_time = microtime( true ); 3634 3635 if ( is_wp_error( $http_response ) ) { 3636 return $http_response; 3637 } 3638 if ( wp_remote_retrieve_response_code( $http_response ) !== 200 ) { 3639 return new WP_Error( 3640 'http_' . wp_remote_retrieve_response_code( $http_response ), 3641 wp_remote_retrieve_response_message( $http_response ) 3642 ); 3643 } 3644 3645 $response_headers = array(); 3646 3647 foreach ( $caching_headers as $header => $callback ) { 3648 $header_values = wp_remote_retrieve_header( $http_response, $header ); 3649 if ( empty( $header_values ) ) { 3650 continue; 3651 } 3652 $header_values = (array) $header_values; 3653 if ( empty( $callback ) || ( is_callable( $callback ) && count( array_filter( $header_values, $callback ) ) > 0 ) ) { 3654 $response_headers[ $header ] = $header_values; 3655 } 3656 } 3657 3658 $page_caching_response_headers[] = $response_headers; 3659 $response_timing[] = ( $end_time - $start_time ) * 1000; 3660 } 3661 3662 return array( 3663 'advanced_cache_present' => ( 3664 file_exists( WP_CONTENT_DIR . '/advanced-cache.php' ) 3665 && 3666 ( defined( 'WP_CACHE' ) && WP_CACHE ) 3667 && 3668 /** This filter is documented in wp-settings.php */ 3669 apply_filters( 'enable_loading_advanced_cache_dropin', true ) 3670 ), 3671 'page_caching_response_headers' => $page_caching_response_headers, 3672 'response_timing' => $response_timing, 3673 ); 3674 } 3675 3676 /** 3677 * Gets page cache details. 3678 * 3679 * @since 6.1.0 3680 * 3681 * @return WP_Error|array { 3682 * Page cache detail or else a WP_Error if unable to determine. 3683 * 3684 * @type string $status Page cache status. Good, Recommended or Critical. 3685 * @type bool $advanced_cache_present Whether page cache plugin is available or not. 3686 * @type string[] $headers Client caching response headers detected. 3687 * @type float $response_time Response time of site. 3688 * } 3689 */ 3690 private function get_page_cache_detail() { 3691 $page_cache_detail = $this->check_for_page_caching(); 3692 if ( is_wp_error( $page_cache_detail ) ) { 3693 return $page_cache_detail; 3694 } 3695 3696 // Use the median server response time. 3697 $response_timings = $page_cache_detail['response_timing']; 3698 rsort( $response_timings ); 3699 $page_speed = $response_timings[ floor( count( $response_timings ) / 2 ) ]; 3700 3701 // Obtain unique set of all client caching response headers. 3702 $headers = array(); 3703 foreach ( $page_cache_detail['page_caching_response_headers'] as $page_caching_response_headers ) { 3704 $headers = array_merge( $headers, array_keys( $page_caching_response_headers ) ); 3705 } 3706 $headers = array_unique( $headers ); 3707 3708 // Page cache is detected if there are response headers or a page cache plugin is present. 3709 $has_page_caching = ( count( $headers ) > 0 || $page_cache_detail['advanced_cache_present'] ); 3710 3711 if ( $page_speed && $page_speed < $this->get_good_response_time_threshold() ) { 3712 $result = $has_page_caching ? 'good' : 'recommended'; 3713 } else { 3714 $result = 'critical'; 3715 } 3716 3717 return array( 3718 'status' => $result, 3719 'advanced_cache_present' => $page_cache_detail['advanced_cache_present'], 3720 'headers' => $headers, 3721 'response_time' => $page_speed, 3722 ); 3723 } 3724 3725 /** 3726 * Gets the threshold below which a response time is considered good. 3727 * 3728 * @since 6.1.0 3729 * 3730 * @return int Threshold in milliseconds. 3731 */ 3732 private function get_good_response_time_threshold() { 3733 /** 3734 * Filters the threshold below which a response time is considered good. 3735 * 3736 * The default is based on https://web.dev/time-to-first-byte/. 3737 * 3738 * @since 6.1.0 3739 * 3740 * @param int $threshold Threshold in milliseconds. Default 600. 3741 */ 3742 return (int) apply_filters( 'site_status_good_response_time_threshold', 600 ); 3743 } 3744 3745 /** 3746 * Determines whether to suggest using a persistent object cache. 3747 * 3748 * @since 6.1.0 3749 * 3750 * @global wpdb $wpdb WordPress database abstraction object. 3751 * 3752 * @return bool Whether to suggest using a persistent object cache. 3753 */ 3754 public function should_suggest_persistent_object_cache() { 3755 global $wpdb; 3756 3757 /** 3758 * Filters whether to suggest use of a persistent object cache and bypass default threshold checks. 3759 * 3760 * Using this filter allows to override the default logic, effectively short-circuiting the method. 3761 * 3762 * @since 6.1.0 3763 * 3764 * @param bool|null $suggest Boolean to short-circuit, for whether to suggest using a persistent object cache. 3765 * Default null. 3766 */ 3767 $short_circuit = apply_filters( 'site_status_should_suggest_persistent_object_cache', null ); 3768 if ( is_bool( $short_circuit ) ) { 3769 return $short_circuit; 3770 } 3771 3772 if ( is_multisite() ) { 3773 return true; 3774 } 3775 3776 /** 3777 * Filters the thresholds used to determine whether to suggest the use of a persistent object cache. 3778 * 3779 * @since 6.1.0 3780 * 3781 * @param int[] $thresholds The list of threshold numbers keyed by threshold name. 3782 */ 3783 $thresholds = apply_filters( 3784 'site_status_persistent_object_cache_thresholds', 3785 array( 3786 'alloptions_count' => 500, 3787 'alloptions_bytes' => 100000, 3788 'comments_count' => 1000, 3789 'options_count' => 1000, 3790 'posts_count' => 1000, 3791 'terms_count' => 1000, 3792 'users_count' => 1000, 3793 ) 3794 ); 3795 3796 $alloptions = wp_load_alloptions(); 3797 3798 if ( $thresholds['alloptions_count'] < count( $alloptions ) ) { 3799 return true; 3800 } 3801 3802 if ( $thresholds['alloptions_bytes'] < strlen( serialize( $alloptions ) ) ) { 3803 return true; 3804 } 3805 3806 $table_names = implode( "','", array( $wpdb->comments, $wpdb->options, $wpdb->posts, $wpdb->terms, $wpdb->users ) ); 3807 3808 // With InnoDB the `TABLE_ROWS` are estimates, which are accurate enough and faster to retrieve than individual `COUNT()` queries. 3809 $results = $wpdb->get_results( 3810 $wpdb->prepare( 3811 // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- This query cannot use interpolation. 3812 "SELECT TABLE_NAME AS 'table', TABLE_ROWS AS 'rows', SUM(data_length + index_length) as 'bytes' FROM information_schema.TABLES WHERE TABLE_SCHEMA = %s AND TABLE_NAME IN ('$table_names') GROUP BY TABLE_NAME;", 3813 DB_NAME 3814 ), 3815 OBJECT_K 3816 ); 3817 3818 $threshold_map = array( 3819 'comments_count' => $wpdb->comments, 3820 'options_count' => $wpdb->options, 3821 'posts_count' => $wpdb->posts, 3822 'terms_count' => $wpdb->terms, 3823 'users_count' => $wpdb->users, 3824 ); 3825 3826 return array_any( $threshold_map, fn( $table, $threshold ) => $thresholds[ $threshold ] <= $results[ $table ]->rows ); 3827 } 3828 3829 /** 3830 * Returns a list of available persistent object cache services. 3831 * 3832 * @since 6.1.0 3833 * 3834 * @return string[] The list of available persistent object cache services. 3835 */ 3836 private function available_object_cache_services() { 3837 $extensions = array_map( 3838 'extension_loaded', 3839 array( 3840 'APCu' => 'apcu', 3841 'Redis' => 'redis', 3842 'Relay' => 'relay', 3843 'Memcache' => 'memcache', 3844 'Memcached' => 'memcached', 3845 ) 3846 ); 3847 3848 $services = array_keys( array_filter( $extensions ) ); 3849 3850 /** 3851 * Filters the persistent object cache services available to the user. 3852 * 3853 * This can be useful to hide or add services not included in the defaults. 3854 * 3855 * @since 6.1.0 3856 * 3857 * @param string[] $services The list of available persistent object cache services. 3858 */ 3859 return apply_filters( 'site_status_available_object_cache_services', $services ); 3860 } 3861 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
| Generated : Fri Sep 4 08:20:24 2026 | Cross-referenced by PHPXref |