Really Simple SSL plugin, or its Server component, does not seem to be fully active/available. Cannot perform all validation checks.
.htaccess file is missing. If you have just set up WordPress or changed permalink settings, this might be temporary. Really Simple SSL may require it for some features.'];
} else if ($htaccess_content === false ) {
echo 'Could not read the .htaccess file at ' . esc_html( rsssl_hv_get_htaccess_path() ) . '. Please check file existence and permissions.
' . esc_html(basename($wp_content_dir)) . ' appears to be writable by the web server.'];
} else {
$messages[] = ['type' => 'error', 'text' => 'WP_CONTENT_DIR NOT Writable: The directory ' . esc_html(basename($wp_content_dir)) . ' is NOT writable. This will prevent RSSSL from creating necessary files.'];
$errors++;
}
$rsssl_firewall_error_option = get_site_option( 'rsssl_firewall_error' );
if ($rsssl_firewall_error_option) {
$messages[] = ['type' => 'warning', 'text' => 'RSSSL Firewall Error Option: Detected rsssl_firewall_error option value: ' . esc_html( var_export($rsssl_firewall_error_option, true) ) . '.'];
$warnings++;
} else {
$messages[] = ['type' => 'info', 'text' => 'RSSSL Firewall Error Option: No rsssl_firewall_error option detected or option is false.'];
}
// 1. HTTPS Redirect Rules
$ssl_enabled = rsssl_get_option( 'ssl_enabled' );
$redirect_method = rsssl_get_option( 'redirect' );
$has_specific_redirect_block = $htaccess_content ? (preg_match( '/#BEGIN Really Simple SSL Redirect.*?#END Really Simple SSL Redirect/is', $htaccess_content ) || preg_match( '/#BEGIN Really Simple Security Redirect.*?#END Really Simple Security Redirect/is', $htaccess_content )) : false;
$has_generic_rsssl_block = $htaccess_content ? preg_match( '/#Begin Really Simple Security.*?#End Really Simple Security/is', $htaccess_content ) : false;
$redirect_rules_present_in_generic_block = false;
if ($htaccess_content && $has_generic_rsssl_block && !$has_specific_redirect_block) {
if (preg_match( '/#Begin Really Simple Security.*?RewriteCond\s+%\{HTTPS\}\s+!=on.*?RewriteRule\s+\^\(\.\*\)\$\s+https:\/\/%\{HTTP_HOST\}\/\$1\s+\[R=301,L\].*?#End Really Simple Security/is', $htaccess_content)) {
$redirect_rules_present_in_generic_block = true;
}
}
if ( $ssl_enabled && $redirect_method === 'htaccess' ) {
if ( !$htaccess_content ) {
$messages[] = ['type' => 'error', 'text' => 'HTTPS Redirect: Setting is "htaccess redirect", but the .htaccess file is missing or unreadable.'];
$errors++;
} elseif ( ! $has_specific_redirect_block && ! $redirect_rules_present_in_generic_block ) {
$messages[] = ['type' => 'error', 'text' => 'HTTPS Redirect: Setting is "htaccess redirect", but no definitive Really Simple SSL redirect rules were found within a dedicated or generic RSSSL block in .htaccess.'];
$errors++;
} elseif ($redirect_rules_present_in_generic_block && !$has_specific_redirect_block) {
$messages[] = ['type' => 'success', 'text' => 'HTTPS Redirect: Setting is "htaccess redirect" and redirect rules appear to be present within a generic "#Begin/End Really Simple Security" block.'];
} else {
$messages[] = ['type' => 'success', 'text' => 'HTTPS Redirect: Setting is "htaccess redirect" and a specific redirect block is present.'];
}
} elseif ( $htaccess_content && ($has_specific_redirect_block || $redirect_rules_present_in_generic_block) && ( ! $ssl_enabled || $redirect_method !== 'htaccess' ) ) {
$messages[] = ['type' => 'warning', 'text' => 'HTTPS Redirect: Really Simple SSL redirect rules found in .htaccess, but SSL is not enabled for htaccess redirection in settings.'];
$warnings++;
} else {
$messages[] = ['type' => 'info', 'text' => 'HTTPS Redirect: No .htaccess redirect rules expected or found based on current settings.'];
}
// 2. Firewall / Advanced Headers
$firewall_setting_enabled = rsssl_get_option( 'enable_firewall' );
$messages[] = ['type' => 'info', 'text' => 'Firewall Setting: enable_firewall is currently ' . ($firewall_setting_enabled ? 'ON' : 'OFF') . '.'];
if ($adv_headers_exists) {
$messages[] = ['type' => 'success', 'text' => 'Firewall File Check: advanced-headers.php FOUND in ' . esc_html(basename($wp_content_dir)) . '.'];
} else {
$messages[] = ['type' => ($firewall_setting_enabled ? 'error' : 'info'), 'text' => 'Firewall File Check: advanced-headers.php is MISSING from ' . esc_html(basename($wp_content_dir)) . '.' . ($firewall_setting_enabled ? ' This is critical for firewall operation.' : '')];
if ($firewall_setting_enabled) $errors++;
}
if ($firewall_php_exists) {
$messages[] = ['type' => 'success', 'text' => 'Firewall File Check: firewall.php (ruleset) FOUND in ' . esc_html(basename($wp_content_dir)) . '.'];
} else {
$messages[] = ['type' => ($firewall_setting_enabled ? 'warning' : 'info'), 'text' => 'Firewall File Check: firewall.php (ruleset) is MISSING from ' . esc_html(basename($wp_content_dir)) . '.' . ($firewall_setting_enabled ? ' This file contains core firewall rules and is needed if advanced-headers.php loads it.' : '')];
if ($firewall_setting_enabled) $warnings++; // Warning because advanced-headers.php is the primary loader
}
$auto_prepend_config_option = get_option( 'rsssl_auto_prepend_config');
$messages[] = ['type' => 'info', 'text' => 'Firewall Config (Option): Detected rsssl_auto_prepend_config option value: ' . esc_html( var_export($auto_prepend_config_option, true) ) . ''];
$live_server_prepend_config = 'N/A';
if (function_exists('RSSSL') && isset(RSSSL()->server) && method_exists(RSSSL()->server, 'auto_prepend_config')) {
$live_server_prepend_config = RSSSL()->server->auto_prepend_config();
}
$messages[] = ['type' => 'info', 'text' => 'Firewall Config (Live Detection): RSSSL()->server->auto_prepend_config() returns: ' . esc_html( var_export($live_server_prepend_config, true) ) . ''];
$effective_prepend_config = ($live_server_prepend_config !== 'N/A') ? $live_server_prepend_config : $auto_prepend_config_option;
$is_effective_prepend_config_active = !empty($effective_prepend_config) && $effective_prepend_config !== 'disabled' && $effective_prepend_config !== false;
$has_auto_prepend_block = $htaccess_content ? preg_match( '/#Begin Really Simple Auto Prepend File.*?#End Really Simple Auto Prepend File/is', $htaccess_content ) : false;
if ( $firewall_setting_enabled ) {
if ( $adv_headers_exists ) { // Only check .htaccess prepend if advanced-headers.php exists
if ( $is_effective_prepend_config_active && $effective_prepend_config !== 'nginx' && $effective_prepend_config !== 'iis' ) { // Nginx/IIS don't use .htaccess for this
if ( !$htaccess_content ) {
$messages[] = ['type' => 'error', 'text' => 'Firewall/Headers (Auto Prepend): Firewall is configured for auto_prepend (Effective: ' . esc_html($effective_prepend_config) . '), but .htaccess is missing/unreadable.'];
$errors++;
} elseif ( !$has_auto_prepend_block ) {
$messages[] = ['type' => 'error', 'text' => 'Firewall/Headers (Auto Prepend): Firewall is configured for auto_prepend (Effective: ' . esc_html($effective_prepend_config) . '), but the "Really Simple Auto Prepend File" block is MISSING in .htaccess.'];
$errors++;
} else {
$auto_prepend_block_content = '';
if ($htaccess_content && preg_match('/(#Begin Really Simple Auto Prepend File.*?#End Really Simple Auto Prepend File)/is', $htaccess_content, $block_matches)){
$auto_prepend_block_content = $block_matches[1];
}
$expected_directive_pattern = '/php_value\s+auto_prepend_file\s+' . preg_quote($advanced_headers_file_path, '/') . '/i';
if ( preg_match($expected_directive_pattern, $auto_prepend_block_content) ) {
$messages[] = ['type' => 'success', 'text' => 'Firewall/Headers (Auto Prepend): Firewall is configured for auto_prepend (Effective: ' . esc_html($effective_prepend_config) . '), and the .htaccess block correctly references ' . esc_html($advanced_headers_file_path) . '.'];
// Check for .user.ini protection rules
$user_ini_filename = ini_get('user_ini.filename');
if ( !empty($user_ini_filename) && $user_ini_filename !== false ) {
// As per firewall-manager.php: sprintf( '' . esc_html($user_ini_filename) . ' within the auto prepend block.'];
} else {
$messages[] = ['type' => 'error', 'text' => 'Firewall/Headers (.user.ini Protection): Expected protection rules for ' . esc_html($user_ini_filename) . ' are MISSING within the auto prepend block.'];
$errors++;
}
} else {
// Check if .user.ini rules are absent when not expected
// A bit generic to catch if *any* such block is there when not expected.
$any_files_block_pattern = '/' . esc_html(stripslashes($file_name_match[1])) . ')';
}
$messages[] = ['type' => 'warning', 'text' => 'Firewall/Headers (.user.ini Protection): No user_ini.filename is active on this server, but .user.ini protection-like rules were unexpectedly found in the auto prepend block' . $file_match_output . '.'];
$warnings++;
} else {
$messages[] = ['type' => 'info', 'text' => 'Firewall/Headers (.user.ini Protection): No user_ini.filename is active on this server, and no unexpected .user.ini protection rules found in the auto prepend block.'];
}
}
} else {
$messages[] = ['type' => 'error', 'text' => 'Firewall/Headers (Auto Prepend): Firewall is configured for auto_prepend (Effective: ' . esc_html($effective_prepend_config) . '), the .htaccess block exists, but it does NOT correctly reference ' . esc_html($advanced_headers_file_path) . ' (looking for full path).'];
$errors++;
}
}
} elseif ($is_effective_prepend_config_active && ($effective_prepend_config === 'nginx' || $effective_prepend_config === 'iis')) {
$messages[] = ['type' => 'info', 'text' => 'Firewall/Headers (Auto Prepend): Server detected as ' . esc_html($effective_prepend_config) . '. RSSSL relies on manual server configuration for auto_prepend_file, not .htaccess, for this server type.'];
} elseif ($firewall_setting_enabled) { // if firewall on, but effective config is not active for prepend
$messages[] = ['type' => 'warning', 'text' => 'Firewall/Headers: Firewall is ON and advanced-headers.php exists, but RSSSL is not effectively configured to activate auto_prepend_file (Effective config: ' . esc_html(var_export($effective_prepend_config, true)) . '). Firewall rules may not be loading via this method.'];
$warnings++;
}
} // end if $adv_headers_exists (for .htaccess checks)
} else { // Firewall setting is OFF
if ($htaccess_content && $has_auto_prepend_block) {
$messages[] = ['type' => 'warning', 'text' => 'Firewall/Headers (Auto Prepend): Firewall setting is OFF, but an "Auto Prepend File" block was found in .htaccess. Consider removing it.'];
$warnings++;
}
// No need to warn about leftover advanced-headers.php or firewall.php if main setting is off, already covered by initial file checks if they are missing when ON.
$messages[] = ['type' => 'info', 'text' => 'Firewall/Headers: Firewall setting is OFF. Related .htaccess block status checked.'];
}
// 3. Let's Encrypt ACME Challenge
$lets_encrypt_allowed = false;
if (function_exists('rsssl_letsencrypt_generation_allowed')) {
$lets_encrypt_allowed = rsssl_letsencrypt_generation_allowed(true);
}
$has_le_block = $htaccess_content ? preg_match( '/#BEGIN Really Simple Security LETS ENCRYPT.*?#END Really Simple Security LETS ENCRYPT/is', $htaccess_content ) : false;
if ($lets_encrypt_allowed) {
if (!$htaccess_content) {
$messages[] = ['type' => 'warning', 'text' => 'Let\'s Encrypt: Let\'s Encrypt is configured, but .htaccess file is missing/unreadable. ACME challenge rules cannot be verified.'];
$warnings++;
} elseif (!$has_le_block) {
$messages[] = ['type' => 'warning', 'text' => 'Let\'s Encrypt: Let\'s Encrypt seems to be configured, but the ACME challenge rule block was not found in .htaccess. This might be okay if validation is handled differently or not currently needed.'];
$warnings++;
} else {
$messages[] = ['type' => 'success', 'text' => 'Let\'s Encrypt: Let\'s Encrypt is configured and the ACME challenge rule block is present.'];
}
} elseif ($htaccess_content && $has_le_block && !$lets_encrypt_allowed) {
$messages[] = ['type' => 'warning', 'text' => 'Let\'s Encrypt: ACME challenge rule block found in .htaccess, but Let\'s Encrypt does not seem to be active or require it.'];
$warnings++;
} else {
$messages[] = ['type' => 'info', 'text' => 'Let\'s Encrypt: No Let\'s Encrypt ACME challenge rules expected or found based on current settings.'];
}
// 4. Standard WordPress Rules
$has_wp_begin_marker = $htaccess_content ? preg_match( '/^# BEGIN WordPress/im', $htaccess_content ) : false;
$has_wp_end_marker = $htaccess_content ? preg_match( '/^# END WordPress/im', $htaccess_content ) : false;
$wp_block_content = '';
$found_wp_rules = [
'RewriteRule ^index\\.php$ - [L]' => false,
'RewriteCond %{REQUEST_FILENAME} !-f' => false,
'RewriteCond %{REQUEST_FILENAME} !-d' => false,
'RewriteRule \\s*.*?index\\.php [L]' => false,
];
$rule_keys = array_keys($found_wp_rules);
if ( $has_wp_begin_marker && $has_wp_end_marker ) {
if ( $htaccess_content && preg_match( '/(^# BEGIN WordPress.*?^# END WordPress)/ims', $htaccess_content, $matches ) ) {
$wp_block_content = $matches[1];
foreach ( $rule_keys as $rule_pattern_key ) {
$pattern_to_match = str_replace('\\.', '.', $rule_pattern_key);
if ( preg_match( '/' . $pattern_to_match . '/i', $wp_block_content ) ) {
$found_wp_rules[$rule_pattern_key] = true;
}
}
}
$all_core_rules_found = !in_array(false, $found_wp_rules, true);
if ($all_core_rules_found) {
$messages[] = ['type' => 'success', 'text' => 'WordPress Core Rules: Standard WordPress .htaccess block found with essential permalink rules.'];
} else {
$missing_rules_text = 'Missing or modified: ';
$missing_count = 0;
foreach($found_wp_rules as $rule => $is_found) {
if (!$is_found) {
$missing_rules_text .= ($missing_count > 0 ? ', ' : '') . '' . esc_html($rule) . '';
$missing_count++;
}
}
$messages[] = ['type' => 'warning', 'text' => 'WordPress Core Rules: Standard WordPress .htaccess block found, but some essential permalink rules appear to be missing or modified. ' . $missing_rules_text . '. This could affect permalinks.'];
$warnings++;
}
} elseif ($htaccess_content && ($has_wp_begin_marker && ! $has_wp_end_marker) ) {
$messages[] = ['type' => 'error', 'text' => 'WordPress Core Rules: Found # BEGIN WordPress marker but no matching # END WordPress. .htaccess file may be corrupted.'];
$errors++;
} elseif ($htaccess_content && (!$has_wp_begin_marker && $has_wp_end_marker) ) {
$messages[] = ['type' => 'error', 'text' => 'WordPress Core Rules: Found # END WordPress marker but no matching # BEGIN WordPress. .htaccess file may be corrupted.'];
$errors++;
} elseif ($htaccess_content) {
$messages[] = ['type' => 'error', 'text' => 'WordPress Core Rules: Standard WordPress .htaccess block (# BEGIN WordPress ... # END WordPress) is missing. Permalinks may not function correctly.'];
$errors++;
} else if (!$htaccess_content && ($has_wp_begin_marker || $has_wp_end_marker) ) {
$messages[] = ['type' => 'error', 'text' => 'WordPress Core Rules: .htaccess is unreadable/missing, but WordPress markers might be expected. Permalinks likely not working.'];
$errors++;
}
// 5. Check for Duplicate RSSSL Blocks
if ($htaccess_content) {
$rsssl_htaccess_markers = [
'auto_prepend' => ["#Begin Really Simple Auto Prepend File", "#End Really Simple Auto Prepend File"],
'lets_encrypt' => ["#BEGIN Really Simple Security LETS ENCRYPT", "#END Really Simple Security LETS ENCRYPT"],
'redirect' => ["#Begin Really Simple Redirect", "#End Really Simple Redirect"],
'old_redirect' => ["#Begin Really Simple SSL", "#End Really Simple SSL"],
'security' => ["#Begin Really Simple Security", "#End Really Simple Security"],
];
$found_duplicate_blocks = false;
$duplicate_block_details = [];
foreach ($rsssl_htaccess_markers as $block_type => $markers) {
$start_marker = preg_quote($markers[0], '/');
$end_marker = preg_quote($markers[1], '/');
$pattern = '/' . $start_marker . '.*?' . $end_marker . '/is';
$count = preg_match_all($pattern, $htaccess_content, $matches);
if ($count > 1) {
$found_duplicate_blocks = true;
$duplicate_block_details[] = 'Type "' . esc_html($block_type) . '" (markers: ' . esc_html($markers[0]) . ' ... ' . esc_html($markers[1]) . ') found ' . $count . ' times.';
}
}
if ($found_duplicate_blocks) {
$messages[] = ['type' => 'error', 'text' => 'Duplicate .htaccess Blocks: Multiple instances of RSSSL configuration blocks were found:Found ' . esc_html($errors) . ' critical ' . _n('discrepancy', 'discrepancies', $errors, 'rsssl-hv') . '.
'; } if ($warnings > 0) { echo 'Found ' . esc_html($warnings) . ' potential ' . _n('issue', 'issues', $warnings, 'rsssl-hv') . ' or inactive rules.
'; } if ($errors === 0 && $warnings === 0 && !empty($htaccess_content)) { echo 'All checked .htaccess rules and file components appear consistent with settings and WordPress standards.
'; } elseif (empty($htaccess_content) && $errors === 0 && $warnings === 0) { echo '.htaccess file is currently missing or unreadable. Some features may not be active.
'; } echo 'Note: This validator checks common rules and file presence. For complex setups or specific header rules, manual verification might still be needed. This MU plugin does not make any changes.
'; echo '