csgaku

<p>CSGaku Site State Check is a lightweight plugin for reviewing basic WordPress site status from the admin area.</p>
<p>The plugin is designed for administrators and developers who want to check important maintenance and security-related signals on demand. It does not automatically repair, delete, or change site settings. It presents the current state so the site administrator can decide what to review next.</p>
<p>CSGaku Site State Check does not use external API communication or external vulnerability database lookups for its checks. It uses information available within the WordPress site and server environment.</p>
<p>The plugin can run on PHP 7.4 or later, but PHP 8.2 or later is recommended.</p>
<p>Design principles:</p>
<ul>
<li>No external API or external service communication for normal checks</li>
<li>No automatic repair</li>
<li>No automatic deletion</li>
<li>No automatic setting changes</li>
<li>No direct display of secret values or full file contents</li>
<li>Results organized by status and severity</li>
<li>Latest result, simple local history, and CSV export support</li>
</ul>
<p>Main checks include:</p>
<ul>
<li>PHP version</li>
<li>WordPress version</li>
<li>Site URL and home URL</li>
<li>SSL status</li>
<li>Sitemap</li>
<li>Debug settings</li>
<li>wp-config.php</li>
<li>.htaccess</li>
<li>index.php</li>
<li>wp-admin, wp-content, and wp-includes</li>
<li>Public access protection for debug.log</li>
<li>PHP execution prevention setting in uploads</li>
<li>wp-config.php structure and location</li>
<li>SALT constants</li>
<li>Administrator user count</li>
<li>Presence of the admin username</li>
<li>Older administrator accounts</li>
<li>Application passwords</li>
<li>Search engine visibility setting</li>
<li>XML-RPC status</li>
<li>Core, plugin, and theme update status</li>
<li>Inactive plugins</li>
<li>Unused theme candidates</li>
<li>444 and 555 permissions under wp-content</li>
<li>uploads/YYYY/.htaccess and uploads/YYYY/MM/.htaccess</li>
</ul>
<p>About obfuscation-related checks:</p>
<p>CSGaku Site State Check can review index.php for patterns that are sometimes associated with obfuscation, such as base64, eval, gzinflate, long Base64-like strings, hex escapes, and chr concatenation. If such patterns are found, they are shown as items to review. They are not treated as final proof of malicious code by themselves.</p>
<p>About permissions:</p>
<p>The plugin checks 444 and 555 permissions under wp-content. These permissions may be intentional in some environments, but they can also affect updates, deletion, and maintenance work. When such items are found under themes, the plugin can note that they may be intentional depending on the environment.</p>
<p>About uploads security:</p>
<p>The plugin checks whether uploads/.htaccess contains PHP execution prevention rules, and it also checks for .htaccess files under uploads year/month folders. If relevant .htaccess files are found in those locations, they are shown for review without displaying file contents.</p>
<p>About CSV export:</p>
<p>The latest result can be exported as CSV with a UTF-8 BOM for compatibility with spreadsheet applications. To reduce CSV formula injection risk, values starting with dangerous leading characters are escaped before export.</p>
<p>Important limitations:</p>
<ul>
<li>This plugin is a confirmation tool.</li>
<li>It does not provide malware cleanup.</li>
<li>It does not provide automatic remediation.</li>
<li>It does not provide complete vulnerability assessment.</li>
<li>It does not guarantee detection of all issues.</li>
<li>Final review and response should be handled by the site administrator.</li>
</ul>


CSGaku Site State Check

Checks key WordPress site status items from the admin area without external API communication or automatic changes.

rhj4

<p>RHJ4 Notifications and its sibling, RHJ4 Diagnostics solve problems that have plagued programmers for years: How to communicate with users in a clean, clear and visually consistent fashion regardless of where in the program the message originates.</p>
<p>A notification message can be sent from jQuery code in the browser or from PHP code in the server. Either type of message can be displayed immediately or queued for display after the next page turn.</p>
<p>Notifications appear as popup messages on the bottom right corner of the screen and can stay on the screen until the user clicks on them or they can disappear after five seconds.</p>
<p>Using this plugin, a message can be sent easily from a single line of PHP code:</p>
<pre><code>    rhj4_notification('Warning! Danger, Will Robinson!', NOTIFICATION_TYPE_WARNING);
</code></pre>
<p>The same messsage can be sent from jQuery code running in the browser:</p>
<pre><code>    jQuery.notification('Warning! Danger, Will Robinson!',
    jQuery.notification.type('warning'));
</code></pre>
<p>By default, notifications will disappear from the screen after five seconds; however, to make a notification “sticky”, add true as the third argument to either the PHP or jQuery functions:</p>
<pre><code>    jQuery.notification('Warning! Danger, Will Robinson!',
    jQuery.notification.type('warning'), true);
</code></pre>
<p>Notifications can be displayed immediately or queued in the wp_notifications table for display later. The wp_notifications table is created when the plugin is enabled. To “enable” this plugin, see Settings and click on the “Enable” checkbox.</p>
<p>RHJ4 Notifications supports 15 types of notifications</p>
<h3>Usage</h3>
<p>A notification consists of a:</p>
<ul>
<li><strong>Message</strong> – some text to be shown to the user.</li>
<li><strong>Notification Type</strong> – an integer in the range -1..13 that indicates the style of the notification.</li>
<li><strong>Sticky</strong> – a boolean that indicates whether the message should disappear after a few seconds or “stick” around.</li>
</ul>
<h3>Notification Types</h3>
<p>These constants are in the global name space:</p>
<ul>
<li>NOTIFICATION_TYPE_DIAGNOSTIC      = -1;</li>
<li>NOTIFICATION_TYPE_LOG             = 0;</li>
<li>NOTIFICATION_TYPE_SYSTEM          = 1;</li>
<li>NOTIFICATION_TYPE_ERROR           = 2;</li>
<li>NOTIFICATION_TYPE_WARNING         = 3;</li>
<li>NOTIFICATION_TYPE_CONFIRMATION    = 4;</li>
<li>NOTIFICATION_TYPE_MESSAGE         = 5;</li>
<li>NOTIFICATION_TYPE_TEST            = 6;</li>
<li>NOTIFICATION_TYPE_DATA            = 7;</li>
<li>NOTIFICATION_TYPE_COMMENT         = 8;</li>
<li>NOTIFICATION_TYPE_TIP             = 9;</li>
<li>NOTIFICATION_TYPE_REMINDER        = 10;</li>
<li>NOTIFICATION_TYPE_DATE            = 11;</li>
<li>NOTIFICATION_TYPE_VALIDATION      = 12;</li>
<li>NOTIFICATION_TYPE_TIMER           = 13;</li>
</ul>
<p>There are four different interfaces available in the Notifications plugin:</p>
<ul>
<li>Global Functions</li>
<li>Class Methods</li>
<li>jQuery plugin</li>
<li>Short Codes</li>
</ul>
<h3>PHP Global Functions</h3>
<h4>Generate a notification</h4>
<pre><code>rhj4_notification($message, $type = NOTIFICATION_TYPE_MESSAGE, $sticky = FALSE);
</code></pre>
<h3>PHP Class Methods</h3>
<h4>RHJ4Notifications::instance()</h4>
<p>Return an instance of this plugin. This usage allows code in multiple places to use the same instance without having to reinitialize the plugin every time.</p>
<p><em>Example:</em></p>
<pre><code>    $myInstance = RHJ4Notifications::instance()    
</code></pre>
<h4>init($args)</h4>
<p>Initialize plugin using any of the options defined in $args (see “options” for a list of supported options).</p>
<h4>kill()</h4>
<p>Kill the current instance.</p>
<h4>activate()</h4>
<p>Activate this plugin.</p>
<h4>deactivate()</h4>
<p>Deactivate this plugin.</p>
<h4>options ($options = null)</h4>
<p>Validate options and return valid array. The supported options are:</p>
<p>–<strong>enable</strong>: enable generation of diagnostic messages.</p>
<p>–<strong>log</strong> = {true|false}: enable log notifications</p>
<p>–<strong>system</strong> = {true|false}: enable system notifications</p>
<p>–<strong>error</strong> = {true|false}: enable error notifications</p>
<p>–<strong>warning</strong> = {true|false}: enable warning notifications</p>
<p>–<strong>confirmation</strong> = {true|false}: enable confirmation notifications</p>
<p>–<strong>message</strong> = {true|false}: enable message notifications</p>
<p>–<strong>test</strong> = {true|false}: enable test notifications</p>
<p>–<strong>data</strong> = {true|false}: enable data notifications</p>
<p>–<strong>comment</strong> = {true|false}: enable comment notifications</p>
<p>–<strong>tip</strong> = {true|false}: enable tip notifications</p>
<p>–<strong>reminder</strong> = {true|false}: enable reminder notifications</p>
<p>–<strong>date</strong> = {true|false}: enable date notifications</p>
<p>–<strong>validation</strong> = {true|false}: enable validation notifications</p>
<p>–<strong>timer</strong> = {true|false}: enable timer notifications</p>
<h4>set($options = NULL)</h4>
<p>Establish default options and save them in wp_options. See “options” for a list of supported options.</p>
<h4>reset()</h4>
<p>Reset options to their default values.</p>
<h4>enable()</h4>
<p>Enable this plugin. This function requires admin privileges and should only be called when setting up a site. It creates a database table (first deleting if if it exists) that stores queued notifications.</p>
<p>This function can be accessed from the settings panel or called directly in your code.</p>
<p>All notifications are stored (temporarily) in a common database table that is keyed by Session ID.</p>
<h4>save($message_text, $message_type = 1, $is_sticky = 0)</h4>
<p>Save a message for display on next page turn or explicit call from jQuery.</p>
<pre><code> @param int $message_type
 @param bool $is_sticky
 @param string $message_text
</code></pre>
<h4>delete_user_notifications ($user_id = null)</h4>
<p>Delete all notifications for $user_id.</p>
<h4>delete_session_notifications ()</h4>
<p>Remove all notifications for the current session.</p>
<h4>delete_all_notifications ()</h4>
<p>Clear notifications table of all pending notifications.</p>
<h4>user_queue_size()</h4>
<h4>list_user_notifications($delete = TRUE)</h4>
<p>Return list of all notifications pending for $user_id.</p>
<h4>session_queue_size()</h4>
<h4>list_session_notifications($delete = TRUE)</h4>
<p>Return a list of all pending notifications for the current session.</p>
<h4>list_all_notifications($delete = TRUE)</h4>
<p>Return a list of all notifications.</p>
<h3>jQuery Plugin API</h3>
<p>The jQuery code included in this plugin is implemented as a jQuery plugin with the class name of “jQuery.notification”.</p>
<p>The functions supported by this class are:</p>
<h4>notification(message, type, isSticky, pluginurl)</h4>
<p>–<strong>message</strong> (required) may be a string or an object.</p>
<p>If it is a string, the string is the notification text to be displayed.<br />
If it is an object, the object may contain properties corresponding to any of the options supported by the jQuery.options method.</p>
<p>_<strong>type</strong> (optional) indicates the notification type as either a string or an integer. If missing, type will use the current option.type value.</p>
<p>_<strong>isSticky</strong> (optional) indicates whether the notification is sticky. If missing, isSticky will use the value from msgType.</p>
<p>_<strong>pluginurl</strong> (optional) indicates the url to be called by this function to communicate with the server. If missing, the code will search for a hidden field named #hid_plugin_url.</p>
<p>Examples:</p>
<pre><code>    jQuery.notification('This is a notification',3,true);

    jQuery.notification({ notification: 'This is a notification', 
            type: "data", 
            sticky: true, 
            queue: false });
</code></pre>
<h4>defaults</h4>
<p>Returns an object containing the default values of all options used by this plugin:</p>
<pre><code>    version: version,   //  code version
    type: 'log',        //  default message type
    sticky: true,       //  if true, don't clear the message automatically
    queue: false,       //  If true, queue the message for later display
    class: '',          //  jGrowl class that styles this message
    clear: true,        //  Delete saved messages after showing them
    showOnConsole: true,//  Show a copy of the message on the console.log
    glue: 'after',      //  jGrowl property that controls order of displaying messages
    sleep:,             //  sleep in milliseconds before displaying message 
    closeTemplate:      //  image to use in close template
    header:             //  '<span class="icon"></span>',
    notification: ''    //  Message can be included with options
</code></pre>
<h4>sleep()</h4>
<p>Set notification sleep delay in milliseconds. This value will be remembered by all subsequent calls to $.Notification.</p>
<h4>option (key, value)</h4>
<p>Get/Set single option:</p>
<p>-version: (read only)<br />
-type: notification type (string or number)<br />
-sticky: boolean<br />
-queue: boolean – save messages in database until explicit request to drain queue<br />
-clear: boolean – clear queue</p>
<h4>save (message, code, sticky, handler)</h4>
<p>-message: the notification text</p>
<p>-code: notification type</p>
<p>-sticky: stick around for awhile or scram</p>
<p>-handler: (optional) custom function to handle displaying the notification.</p>
<h4>messageType (code)</h4>
<p>Returns array of messageType objects.</p>
<h4>type (type)</h4>
<p>Validate notification type value</p>
<h4>getSessionId()</h4>
<p>Get current session id.</p>
<h4>getPluginURL()</h4>
<p>Return URL of AJAX handler function.</p>
<h4>queue (handler)</h4>
<p>Return count of notifications awaiting delivery.</p>
<h4>show (clear)</h4>
<p>Show all messages in the queue. If clear===true, delete all messages just just retrieved.</p>
<h4>erase()</h4>
<p>Close any open notification messages on screen.</p>
<h4>clear()</h4>
<p>Delete all messages to the current session.</p>
<h4>showUser (userId)</h4>
<p>Notifications can be sent to a specific userId. The messages will be held until that user logs in.</p>
<h4>clearUser (userId)</h4>
<p>Delete all user notifications from database.</p>
<h3>Short Codes</h3>
<ul>
<li>
<p><em>enable=1,3,6</em> will enable notification types 1,3 and 6.</p>
</li>
<li>
<p><em>notify</em> message= type= sticky={true|false}</p>
</li>
<li>
<p><em>verbose</em> will cause actions to be echoed on the page.</p>
</li>
<li>
<p><em>demo</em> will display a demonstration of using the Notifications plugin.</p>
</li>
</ul>
<h3>SUPPORT</h3>
<p>I will attempt to answer your email as quickly as I can, but cannot promise immediate response.</p>
<p>I will entertain ideas for enhancements, especially if I hear the same request from multiple people.</p>
<p>Donations will encourage my support… and my thanks.</p>
<h3>CONSULTING</h3>
<p>I make my living by helping WordPress developers. If I can help you, please contact me.</p>
<p>Bob Jones</p>
<p><a href="mailto:bob@rhj4.com" rel="nofollow ugc">bob@rhj4.com</a></p>
<p><a href="http://bellinghamwordpressdevelopers.com/" rel="nofollow ugc">http://bellinghamwordpressdevelopers.com/</a></p>


RHJ4 Notifications

Generate many different types of popup notifications to users from PHP or jQuery with only a single line of code.

CSGaku Site State Check vs RHJ4 Notifications