<?php
/**
 * Screens anonymous comments: bots and attack payloads are spam, and the sender is blocked.
 *
 * The firewall inspects every comment POST, but it deliberately does not run its content
 * rules over the comment TEXT (CSDT_Firewall::CONTENT_PARAMS): this is a security blog, and a
 * reader pasting a script element or a UNION SELECT into a comment is a reader. So until this
 * class a payload in a comment was never recorded anywhere, and nothing screened comments at
 * all beyond WordPress core's kses and its fifteen-second flood check.
 *
 * Two questions, one answer:
 *
 *   1. IS THIS A PERSON? A hidden field no human can see (a honeypot), a comment posted
 *      within seconds of the page being served, and more than RATE_LIMIT comments from one
 *      address in RATE_WINDOW.
 *
 *   2. DOES THE TEXT CARRY A PAYLOAD? The firewall's content rules, run over the text with
 *      the prose exemption lifted (CSDT_Firewall::evaluate_text()).
 *
 * Either one marks the comment spam and counts as an ATTACK, `comment_attack`, whose
 * auto-block threshold is one: the first bad comment blocks the address, and the block sends
 * the usual Telegram alert. The site owner's decision on 2026-10-01, replacing the first
 * design, which held payload comments for moderation and never counted them, on the theory
 * that a reader quoting a payload is not attacking. The trade is stated in the panel: a
 * reader pasting a live payload into a comment is blocked like an attacker.
 *
 * Never makes a verdict LOOSER: a comment already in the trash stays there.
 *
 * ── Scope ──
 *
 * Users at or above the firewall's skip capability (edit_posts by default) are never
 * screened, for the same reason the firewall skips them: they write about attacks.
 *
 * ── Page caching ──
 *
 * The honeypot and the timestamp are rendered into the comment form, which a page cache
 * serves to every visitor. Both are designed for that: the honeypot is static, and a cached
 * timestamp is only ever OLDER than the real page load, so the too-fast check can only err
 * towards letting a comment through. There is deliberately no maximum age, which a cached
 * page would fail.
 *
 * A form that is not rendered by comment_form() carries neither field, and their absence
 * is never held against it. That keeps custom and AMP comment forms working, at the cost of
 * a bot posting straight to wp-comments-post.php skipping the first two checks; the rate
 * cap and the payload check still apply to it.
 *
 * @package CloudScale_Cyber_DevTools
 * @since   1.10.954
 */

defined( 'ABSPATH' ) || exit;

class CSDT_Comment_Guard {

	/** Whether the guard is active. Default ON, see the Explain modal for why. */
	const OPTION_ENABLED = 'csdt_comment_guard';

	/**
	 * The honeypot field.
	 *
	 * Named like a field a spam bot wants to fill (a second website), and never shown to
	 * a person: moved off-screen, hidden from assistive technology and out of the tab order.
	 */
	const HONEYPOT_FIELD = 'csdt_cg_homepage';

	/**
	 * Whether a comment WITHOUT the guard's fields is spam.
	 *
	 * Default OFF, and opt-in only: a theme that builds its own comment form, or an AMP
	 * template, never carries the fields, and turning this on sends every comment from such
	 * a form to Spam. What it buys is the one bot the default misses, one that posts straight
	 * to wp-comments-post.php without ever loading the form. Never counted towards a block,
	 * because a site that switched it on with a custom form would otherwise block its readers.
	 */
	const OPTION_REQUIRE_FIELDS = 'csdt_comment_guard_require_fields';

	/**
	 * Whether block markup in a comment is ENFORCED (spam plus a comment_attack signal).
	 *
	 * Default OFF: the match is recorded in the firewall log as `logged` and nothing else
	 * happens to the comment or the sender. The owner's rule (2026-10-01): a new signal only
	 * reports until the site's admin turns it on.
	 */
	const OPTION_ENFORCE_BLOCK_MARKUP = 'csdt_comment_guard_enforce_block_markup';

	/**
	 * Whether a comment the guard judges an ATTACK is refused (HTTP 403) instead of stored.
	 *
	 * Default OFF: such comments are stored as Spam, which a moderator can review and rescue.
	 * Turned on, a flood of flagged comments never reaches wp_comments at all. Comments that
	 * are spam without being an attack (the opt-in "require the form" check) are still stored.
	 */
	const OPTION_REFUSE_FLAGGED = 'csdt_comment_guard_refuse_flagged';

	/**
	 * Whether a visitor who sends the same comment again on the same post is refused.
	 *
	 * Default OFF, the owner's rule for anything new. WordPress core refuses a repeat only
	 * when the name AND the email are both unchanged, so a commenter who corrects a typo in
	 * their name and sends the text again leaves two comments to moderate.
	 */
	const OPTION_REFUSE_DUPLICATES = 'csdt_comment_guard_refuse_duplicates';

	/**
	 * Whether a visitor's comment that carries a link is refused.
	 *
	 * Default OFF, the owner's rule for anything new. Added 2026-10-12 for the comment no
	 * other check here stops: polite, on topic, typed slowly enough, and written only to
	 * carry a link in its text and in the Website field.
	 */
	const OPTION_BLOCK_LINKS = 'csdt_comment_guard_block_links';

	/** The reason a refused link is recorded under in the firewall log, as `comment_` + this. */
	const LINK_RULE = 'link';

	/**
	 * Endings that make a bare host name (no scheme, no path) count as a link.
	 *
	 * Short on purpose. Every ending that is also an English word is left out (top, pro,
	 * live, app, shop, online), because "It works.Live with it" is a missing space and not
	 * an address. A host followed by a path counts whatever its ending.
	 */
	const LINK_TLDS = 'com|net|org|info|biz|io|ai|co|xyz|ru|cn|uk|de|fr|nl|eu|au|za';

	/** How far back a repeat from the same email address is looked for, seconds. */
	const DUPLICATE_EMAIL_WINDOW = 30 * DAY_IN_SECONDS;

	/**
	 * How far back a repeat from the same network address is looked for, seconds.
	 *
	 * Short on purpose: a mobile carrier puts thousands of people behind one address, and
	 * two of them writing the same short thank-you on one post in a month is ordinary.
	 */
	const DUPLICATE_IP_WINDOW = HOUR_IN_SECONDS;

	/** Most recent comments on the post that are compared; older ones are not looked at. */
	const DUPLICATE_SCAN_LIMIT = 100;

	/** When the form was served, as a Unix time. */
	const TIMER_FIELD = 'csdt_cg_t';

	/** Fewer seconds than this between serving the form and posting it is not a person. */
	const MIN_SECONDS = 3;

	/** Counter key in CSDT_Storage for comments per address. */
	const RATE_SIGNAL = 'comment';

	/** Comments allowed per address inside RATE_WINDOW; the next one is spam. */
	const RATE_LIMIT = 5;

	/** Rate window, seconds. */
	const RATE_WINDOW = 600;

	/** Comment meta recording why the guard acted, read by the moderation screen. */
	const META_KEY = '_csdt_comment_guard';

	/**
	 * The reason a comment carrying block delimiters is recorded under, as `rule:` + this.
	 *
	 * The Events Calendar (CVE-2026-78159, CVE-2026-78006) parsed blocks out of comment text,
	 * and a `<!-- wp:legacy-widget -->` block's attributes reached unserialize(). No reader
	 * types a block delimiter: the editor writes them, and comments never go through it.
	 */
	const BLOCK_MARKUP_RULE = 'block_markup';

	/** How many layers of URL and HTML-entity encoding has_block_markup() peels off. */
	const BLOCK_MARKUP_DECODE_ROUNDS = 3;

	/**
	 * The verdict for the comment being submitted on this request, or null.
	 *
	 * preprocess_comment decides, pre_comment_approved applies and comment_post records;
	 * WordPress gives no single hook that can do all three.
	 *
	 * @var array{status:string,reasons:array<int,string>,attack:bool}|null
	 */
	private static $verdict = null;

	/** Registers the hooks. Gated at call time, like CSDT_Enum_Guard. */
	public static function init(): void {
		add_action( 'comment_form_after_fields', array( __CLASS__, 'render_fields' ) );
		add_filter( 'preprocess_comment', array( __CLASS__, 'inspect' ), 1 );
		add_filter( 'pre_comment_approved', array( __CLASS__, 'apply_verdict' ), 99, 2 );
		add_filter( 'comment_form_default_fields', array( __CLASS__, 'remove_website_field' ), 99 );
		add_filter( 'preprocess_comment', array( __CLASS__, 'drop_profile_website' ), 2 );
		// After every check that can mark a comment spam (the ceiling runs at 100), so a
		// spammer is filed as spam and told nothing.
		add_filter( 'pre_comment_approved', array( __CLASS__, 'refuse_links' ), 101, 2 );
		add_filter( 'pre_comment_approved', array( __CLASS__, 'refuse_duplicate' ), 101, 2 );
		add_action( 'comment_post', array( __CLASS__, 'annotate' ), 10, 1 );
		add_filter( 'comment_text', array( __CLASS__, 'moderation_note' ), 10, 2 );
	}

	/** Whether the guard is switched on. */
	public static function is_enabled(): bool {
		return '1' === (string) get_option( self::OPTION_ENABLED, '1' );
	}

	/** Whether a comment without the guard's form fields is spam. */
	public static function requires_fields(): bool {
		return '1' === (string) get_option( self::OPTION_REQUIRE_FIELDS, '0' );
	}

	/** Whether block markup in a comment is enforced rather than only reported. */
	public static function enforces_block_markup(): bool {
		return class_exists( 'CSDT_Options' ) && '1' === (string) CSDT_Options::get( self::OPTION_ENFORCE_BLOCK_MARKUP );
	}

	/** Whether attack comments are refused instead of stored as spam. */
	public static function refuses_flagged(): bool {
		return class_exists( 'CSDT_Options' ) && '1' === (string) CSDT_Options::get( self::OPTION_REFUSE_FLAGGED );
	}

	/** Whether a repeat of a comment already on the post is refused. */
	public static function refuses_duplicates(): bool {
		return class_exists( 'CSDT_Options' ) && '1' === (string) CSDT_Options::get( self::OPTION_REFUSE_DUPLICATES );
	}

	/** Whether a visitor's comment carrying a link is refused. */
	public static function blocks_links(): bool {
		return class_exists( 'CSDT_Options' ) && '1' === (string) CSDT_Options::get( self::OPTION_BLOCK_LINKS );
	}

	/** Whether the current commenter is screened. */
	public static function is_active(): bool {
		if ( ! self::is_enabled() ) {
			return false;
		}
		$cap = class_exists( 'CSDT_Firewall' ) ? CSDT_Firewall::skip_capability() : 'edit_posts';
		return ! ( function_exists( 'current_user_can' ) && current_user_can( $cap ) );
	}

	/**
	 * Prints the honeypot and the timestamp into the comment form.
	 *
	 * Hooked to comment_form_after_fields, which WordPress fires only for a visitor who is
	 * not signed in, so a signed-in commenter never carries the fields at all.
	 */
	public static function render_fields(): void {
		if ( ! self::is_active() ) {
			return;
		}
		?>
		<p class="csdt-cg" aria-hidden="true" style="position:absolute;left:-10000px;top:auto;width:1px;height:1px;overflow:hidden;">
			<label for="<?php echo esc_attr( self::HONEYPOT_FIELD ); ?>"><?php esc_html_e( 'Leave this field empty', 'cloudscale-cyber-devtools' ); ?></label>
			<input type="text" name="<?php echo esc_attr( self::HONEYPOT_FIELD ); ?>" id="<?php echo esc_attr( self::HONEYPOT_FIELD ); ?>" value="" tabindex="-1" autocomplete="off">
			<input type="hidden" name="<?php echo esc_attr( self::TIMER_FIELD ); ?>" value="<?php echo esc_attr( (string) time() ); ?>">
		</p>
		<?php
	}

	/**
	 * Decides the verdict for a submitted comment. Hooked to preprocess_comment.
	 *
	 * Never modifies the comment. Fails open: an exception here leaves the comment to
	 * WordPress's own handling rather than losing it.
	 *
	 * @param array $commentdata Comment data.
	 * @return array Unchanged comment data.
	 */
	public static function inspect( $commentdata ) {
		self::$verdict = null;
		try {
			if ( ! is_array( $commentdata ) || ! self::is_active() ) {
				return $commentdata;
			}
			// Pingbacks and trackbacks carry neither field and are not typed by anyone.
			$type = (string) ( $commentdata['comment_type'] ?? '' );
			if ( '' !== $type && 'comment' !== $type ) {
				return $commentdata;
			}
			$verdict = self::judge(
				$commentdata,
				self::posted( self::HONEYPOT_FIELD ),
				self::posted( self::TIMER_FIELD ),
				self::client_ip(),
				time(),
				self::requires_fields()
			);
			if ( null === $verdict ) {
				return $commentdata;
			}
			self::$verdict = $verdict;
		} catch ( \Throwable $e ) {
			self::$verdict = null;
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
		}
		return $commentdata;
	}

	/**
	 * The verdict for one comment, and the side effects it implies.
	 *
	 * Separate from inspect() so the tests can drive it without superglobals.
	 *
	 * @param array       $commentdata Comment data.
	 * @param string|null $honeypot    Honeypot value, null when the field was not posted.
	 * @param string|null $timer       Timestamp value, null when the field was not posted.
	 * @param string      $ip          Client address, '' when unknown.
	 * @param int         $now         Unix time.
	 * @param bool        $require     Whether a comment without the fields is spam.
	 * @return array{status:string,reasons:array<int,string>}|null Null to leave it alone.
	 */
	public static function judge( array $commentdata, ?string $honeypot, ?string $timer, string $ip, int $now, bool $require = false ): ?array {
		$reasons = array();
		$attack  = false;

		if ( $require && ( null === $honeypot || null === $timer ) ) {
			// Spam, but not an attack: see OPTION_REQUIRE_FIELDS.
			$reasons[] = 'no_fields';
		}

		if ( null !== $honeypot && '' !== trim( $honeypot ) ) {
			$reasons[] = 'honeypot';
			$attack    = true;
		}
		if ( null !== $timer && ctype_digit( $timer ) ) {
			$served = (int) $timer;
			// A timestamp in the future was not written by this site; it proves nothing
			// either way, so it is ignored rather than trusted.
			if ( $served <= $now && ( $now - $served ) < self::MIN_SECONDS ) {
				$reasons[] = 'too_fast';
				$attack    = true;
			}
		}
		if ( '' !== $ip && class_exists( 'CSDT_Storage' ) && CSDT_Storage::is_available() ) {
			CSDT_Storage::record_event( $ip, self::RATE_SIGNAL, $now );
			$count = CSDT_Storage::count_events( $ip, self::RATE_SIGNAL, $now - self::RATE_WINDOW );
			// Null is "cannot judge", never zero and never over.
			if ( null !== $count && $count > self::RATE_LIMIT ) {
				$reasons[] = 'rate';
				$attack    = true;
			}
		}

		$matched = array();
		if ( class_exists( 'CSDT_Firewall' ) ) {
			foreach ( array( 'comment_content', 'comment_author', 'comment_author_url' ) as $field ) {
				$matched = array_merge( $matched, CSDT_Firewall::evaluate_text( (string) ( $commentdata[ $field ] ?? '' ) ) );
			}
			$matched = array_values( array_unique( $matched ) );
		}
		foreach ( $matched as $rule_id ) {
			$reasons[] = 'rule:' . $rule_id;
			$attack    = true;
			if ( '' !== $ip && class_exists( 'CSDT_Storage' ) ) {
				CSDT_Storage::record_match(
					$ip,
					'comment_' . $rule_id,
					'blocked',
					array(
						'method' => 'POST',
						'path'   => '/wp-comments-post.php',
					),
					$now
				);
			}
		}

		// Block markup is not a firewall rule (a post body is MADE of it), so it is checked
		// here. REPORT ONLY unless the admin enforces it (OPTION_ENFORCE_BLOCK_MARKUP): the
		// match is logged as `logged`, and the comment and its sender are left alone.
		$block_markup = false;
		foreach ( array( 'comment_content', 'comment_author', 'comment_author_url', 'comment_author_email' ) as $field ) {
			if ( self::has_block_markup( (string) ( $commentdata[ $field ] ?? '' ) ) ) {
				$block_markup = true;
				break;
			}
		}
		if ( $block_markup ) {
			$enforce = self::enforces_block_markup();
			if ( $enforce ) {
				$reasons[] = 'rule:' . self::BLOCK_MARKUP_RULE;
				$attack    = true;
			}
			if ( '' !== $ip && class_exists( 'CSDT_Storage' ) ) {
				CSDT_Storage::record_match(
					$ip,
					'comment_' . self::BLOCK_MARKUP_RULE,
					$enforce ? 'blocked' : 'logged',
					array(
						'method' => 'POST',
						'path'   => '/wp-comments-post.php',
					),
					$now
				);
			}
		}

		if ( empty( $reasons ) ) {
			return null;
		}
		if ( $attack && '' !== $ip && is_callable( array( 'CSDT_Auto_Block', 'record' ) ) ) {
			CSDT_Auto_Block::record( 'comment_attack', $ip );
		}
		return array(
			'status'  => 'spam',
			'reasons' => $reasons,
			'attack'  => $attack,
		);
	}

	/**
	 * Whether text carries a block delimiter, `<!-- wp:name` or `<!-- /wp:name`.
	 *
	 * Tolerant of case and of whitespace inside the delimiter, and of the encodings a payload
	 * arrives in: percent-encoding, HTML entities (named, decimal, hex) and JSON's <,
	 * peeled up to BLOCK_MARKUP_DECODE_ROUNDS deep. A letter must follow `wp:`, which is what
	 * a block name starts with.
	 *
	 * What is NOT a match, deliberately: an ordinary HTML comment (`<!-- note -->`), and a
	 * sentence that names a block ("use the wp:paragraph block"). Only the delimiter itself.
	 *
	 * @param string $text Comment field.
	 */
	public static function has_block_markup( string $text ): bool {
		if ( '' === $text ) {
			return false;
		}
		$re = '/<\s*!\s*-\s*-\s*\/?\s*wp\s*:\s*[a-z]/i';
		for ( $i = 0; $i <= self::BLOCK_MARKUP_DECODE_ROUNDS; $i++ ) {
			if ( preg_match( $re, $text ) ) {
				return true;
			}
			$next = $text;
			if ( false !== stripos( $next, '\\u00' ) ) {
				$next = (string) preg_replace_callback(
					'/\\\\u00([0-7][0-9a-f])/i',
					static function ( array $m ): string {
						return chr( (int) hexdec( $m[1] ) );
					},
					$next
				);
			}
			if ( false !== strpos( $next, '%' ) ) {
				$next = rawurldecode( $next );
			}
			if ( false !== strpos( $next, '&' ) ) {
				$next = html_entity_decode( $next, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
			}
			if ( $next === $text ) {
				return false;
			}
			$text = $next;
		}
		return false;
	}

	/**
	 * Applies the verdict. Hooked to pre_comment_approved, late, so it sees every other
	 * plugin's answer and can only ever tighten it.
	 *
	 * @param int|string|WP_Error $approved    1, 0, 'spam', 'trash' or an error.
	 * @param array               $commentdata Comment data.
	 * @return int|string|WP_Error
	 */
	public static function apply_verdict( $approved, $commentdata = array() ) {
		if ( null === self::$verdict || ( function_exists( 'is_wp_error' ) && is_wp_error( $approved ) ) ) {
			return $approved;
		}
		if ( 'trash' === $approved ) {
			return $approved;
		}
		if ( ! empty( self::$verdict['attack'] ) && self::refuses_flagged() ) {
			// Opt-in: refused before insertion, so a flood never fills wp_comments. The
			// WP_Error is core's own way to refuse here (its flood check does the same), and
			// wp-comments-post.php turns it into a 403 page with a back link.
			self::$verdict = null;
			return self::refusal(
				'csdt_comment_refused',
				__( 'Your comment could not be accepted.', 'cloudscale-cyber-devtools' ),
				403
			);
		}
		return 'spam';
	}

	/**
	 * Comment text reduced to what a person would call "the same comment": case and runs
	 * of whitespace do not count.
	 *
	 * @param string $text Comment text.
	 */
	public static function comparable_text( string $text ): string {
		$text = trim( (string) preg_replace( '/\s+/u', ' ', $text ) );
		return function_exists( 'mb_strtolower' ) ? mb_strtolower( $text, 'UTF-8' ) : strtolower( $text );
	}

	/**
	 * Whether a stored comment is the same comment from the same sender.
	 *
	 * The same sender is the same email address inside DUPLICATE_EMAIL_WINDOW, or the same
	 * network address inside DUPLICATE_IP_WINDOW. The name is deliberately not compared:
	 * a corrected name is the usual reason a comment is sent twice.
	 *
	 * @param object $stored A stored comment (comment_content, comment_author_email, comment_author_IP, comment_date_gmt).
	 * @param string $text   New comment text, unslashed.
	 * @param string $email  New comment email, '' when none.
	 * @param string $ip     Sender address, '' when unknown.
	 * @param int    $now    Unix time.
	 */
	public static function is_repeat_of( $stored, string $text, string $email, string $ip, int $now ): bool {
		$wanted = self::comparable_text( $text );
		if ( '' === $wanted || self::comparable_text( (string) ( $stored->comment_content ?? '' ) ) !== $wanted ) {
			return false;
		}
		$posted = strtotime( (string) ( $stored->comment_date_gmt ?? '' ) . ' UTC' );
		if ( false === $posted ) {
			return false;
		}
		$age        = $now - $posted;
		$their_mail = strtolower( trim( (string) ( $stored->comment_author_email ?? '' ) ) );
		if ( '' !== $email && strtolower( trim( $email ) ) === $their_mail && $age <= self::DUPLICATE_EMAIL_WINDOW ) {
			return true;
		}
		return '' !== $ip && (string) ( $stored->comment_author_IP ?? '' ) === $ip && $age <= self::DUPLICATE_IP_WINDOW;
	}

	/**
	 * Refuses a comment the same visitor has already left on the same post. Hooked to
	 * pre_comment_approved, opt-in.
	 *
	 * Only a comment that is published or waiting for approval counts as "already left":
	 * one the moderator put in Spam or the Trash can be sent again. A comment already judged
	 * spam or trash is left alone, so nothing here ever loosens a verdict or answers a bot.
	 *
	 * @param int|string|WP_Error $approved    1, 0, 'spam', 'trash' or an error.
	 * @param array               $commentdata Comment data, slashed as core passes it.
	 * @return int|string|WP_Error
	 */
	public static function refuse_duplicate( $approved, $commentdata = array() ) {
		try {
			if ( ( function_exists( 'is_wp_error' ) && is_wp_error( $approved ) ) || 'spam' === $approved || 'trash' === $approved ) {
				return $approved;
			}
			if ( ! is_array( $commentdata ) || ! self::refuses_duplicates() || ! self::is_active() ) {
				return $approved;
			}
			$type    = (string) ( $commentdata['comment_type'] ?? '' );
			$post_id = (int) ( $commentdata['comment_post_ID'] ?? 0 );
			if ( ( '' !== $type && 'comment' !== $type ) || $post_id <= 0 || ! function_exists( 'get_comments' ) ) {
				return $approved;
			}
			$text  = (string) wp_unslash( $commentdata['comment_content'] ?? '' );
			$email = (string) wp_unslash( $commentdata['comment_author_email'] ?? '' );
			$ip    = self::client_ip();
			$now   = time();
			$found = get_comments(
				array(
					'post_id' => $post_id,
					'status'  => array( 'hold', 'approve' ),
					'type'    => 'comment',
					'number'  => self::DUPLICATE_SCAN_LIMIT,
					'orderby' => 'comment_date_gmt',
					'order'   => 'DESC',
				)
			);
			foreach ( is_array( $found ) ? $found : array() as $stored ) {
				if ( ! self::is_repeat_of( $stored, $text, $email, $ip, $now ) ) {
					continue;
				}
				$waiting = '0' === (string) ( $stored->comment_approved ?? '' );
				return self::refusal(
					'csdt_comment_duplicate',
					$waiting
						? __( 'You have already sent this comment. It is waiting for approval, so there is no need to send it again.', 'cloudscale-cyber-devtools' )
						: __( 'You have already posted this comment here.', 'cloudscale-cyber-devtools' ),
					409
				);
			}
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
		}
		return $approved;
	}

	/**
	 * Whether text carries a link.
	 *
	 * A link is an address with a scheme (http, https, ftp), one starting `www.`, anchor or
	 * forum link markup, a host name followed by a path (`example.xyz/page`), or a bare host
	 * name of four letters or more ending in one of LINK_TLDS (`example.com`).
	 *
	 * What is NOT a link, deliberately: an email address, a file name (`wp-config.php`), a
	 * version number, a short product name that happens to end like a host (`ASP.NET`), and a
	 * sentence with a missing space ("It works.Live with it").
	 *
	 * @param string $text Comment field, unslashed.
	 */
	public static function has_link( string $text ): bool {
		if ( '' === $text ) {
			return false;
		}
		$text = html_entity_decode( $text, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
		if ( 1 === preg_match( '#\b(?:https?|ftp)\s*:\s*//|\bwww\.[a-z0-9-]|<\s*a\b[^>]*\bhref|\[\s*(?:url|link)\b#i', $text ) ) {
			return true;
		}
		// A host with a path, whatever it ends in.
		if ( 1 === preg_match( '#(?<![@\w.-])(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,24}/[\w?\#%~-]#i', $text ) ) {
			return true;
		}
		// A bare host: a name of four characters or more, then a listed ending.
		return 1 === preg_match( '#(?<![@\w.-])(?:[a-z0-9-]+\.)*[a-z0-9][a-z0-9-]{2,}[a-z0-9]\.(?:' . self::LINK_TLDS . ')(?:\.(?:' . self::LINK_TLDS . '))?(?![\w-]|\.[a-z0-9])#i', $text );
	}

	/**
	 * Why a comment is refused for carrying a link, or '' when it carries none.
	 *
	 * The Website field counts only for a visitor who is not signed in: a signed-in
	 * commenter's website comes from their profile, not from the form, see
	 * drop_profile_website().
	 *
	 * @param array $commentdata Comment data, unslashed.
	 * @return string 'text', 'name', 'website' or ''.
	 */
	public static function link_reason( array $commentdata ): string {
		if ( self::has_link( (string) ( $commentdata['comment_content'] ?? '' ) ) ) {
			return 'text';
		}
		if ( self::has_link( (string) ( $commentdata['comment_author'] ?? '' ) ) ) {
			return 'name';
		}
		$signed_in = (int) ( $commentdata['user_id'] ?? ( $commentdata['user_ID'] ?? 0 ) ) > 0;
		if ( ! $signed_in && '' !== trim( (string) ( $commentdata['comment_author_url'] ?? '' ) ) ) {
			return 'website';
		}
		return '';
	}

	/**
	 * Refuses a visitor's comment that carries a link. Hooked to pre_comment_approved, opt-in.
	 *
	 * Refused with a message, not filed as spam, so a reader who pasted a link learns what
	 * to remove. Never counted as an attack and nobody is blocked for it. A comment already
	 * judged spam or trash is left alone, so nothing here loosens a verdict or answers a bot.
	 *
	 * @param int|string|WP_Error $approved    1, 0, 'spam', 'trash' or an error.
	 * @param array               $commentdata Comment data, slashed as core passes it.
	 * @return int|string|WP_Error
	 */
	public static function refuse_links( $approved, $commentdata = array() ) {
		try {
			if ( ( function_exists( 'is_wp_error' ) && is_wp_error( $approved ) ) || 'spam' === $approved || 'trash' === $approved ) {
				return $approved;
			}
			if ( ! is_array( $commentdata ) || ! self::blocks_links() || ! self::is_active() ) {
				return $approved;
			}
			// A pingback or trackback IS a link; whether to accept those is a WordPress setting.
			$type = (string) ( $commentdata['comment_type'] ?? '' );
			if ( '' !== $type && 'comment' !== $type ) {
				return $approved;
			}
			$reason = self::link_reason( (array) wp_unslash( $commentdata ) );
			if ( '' === $reason ) {
				return $approved;
			}
			$ip = self::client_ip();
			if ( '' !== $ip && class_exists( 'CSDT_Storage' ) ) {
				CSDT_Storage::record_match(
					$ip,
					'comment_' . self::LINK_RULE,
					'blocked',
					array(
						'method' => 'POST',
						'path'   => '/wp-comments-post.php',
					),
					time()
				);
			}
			$messages = array(
				'text'    => __( 'Your comment was not posted because it contains a link or web address. Links are not allowed in comments on this site. Please remove the link and send your comment again.', 'cloudscale-cyber-devtools' ),
				'name'    => __( 'Your comment was not posted because the Name field contains a web address. Links are not allowed in comments on this site. Please enter only your name and send your comment again.', 'cloudscale-cyber-devtools' ),
				'website' => __( 'Your comment was not posted because the Website field is filled in. Links are not allowed in comments on this site. Please leave the Website field empty and send your comment again.', 'cloudscale-cyber-devtools' ),
			);
			return self::refusal( 'csdt_comment_link', $messages[ $reason ], 403 );
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
		}
		return $approved;
	}

	/**
	 * Takes the Website field out of the comment form while links are refused, so a reader
	 * is never offered a field the site will not accept. Hooked to comment_form_default_fields.
	 *
	 * @param array $fields Default comment form fields.
	 * @return array
	 */
	public static function remove_website_field( $fields ) {
		if ( is_array( $fields ) && self::is_enabled() && self::blocks_links() ) {
			unset( $fields['url'] );
			// WordPress's own tick box still offers to remember a website. Say what is left. The
			// label is replaced by its element, not its wording, so it is found in every language.
			if ( isset( $fields['cookies'] ) && is_string( $fields['cookies'] ) ) {
				$label             = esc_html__( 'Save my name and email in this browser for the next time I comment.', 'cloudscale-cyber-devtools' );
				$fields['cookies'] = (string) preg_replace(
					'#(<label\b[^>]*\bfor=(["\'])wp-comment-cookies-consent\2[^>]*>).*?(</label>)#is',
					'${1}' . str_replace( array( '\\', '$' ), array( '\\\\', '\\$' ), $label ) . '${3}',
					$fields['cookies'],
					1
				);
			}
		}
		return $fields;
	}

	/**
	 * Drops a signed-in commenter's profile website while links are refused. Hooked to
	 * preprocess_comment.
	 *
	 * WordPress fills the website of a signed-in commenter from their profile. They did not
	 * type it and cannot clear it in the form, so it is dropped rather than refused.
	 *
	 * @param array $commentdata Comment data.
	 * @return array
	 */
	public static function drop_profile_website( $commentdata ) {
		if ( ! is_array( $commentdata ) || ! self::blocks_links() || ! self::is_active() ) {
			return $commentdata;
		}
		if ( (int) ( $commentdata['user_id'] ?? ( $commentdata['user_ID'] ?? 0 ) ) > 0 ) {
			$commentdata['comment_author_url'] = '';
		}
		return $commentdata;
	}

	/**
	 * A refusal in the shape the submitting path expects.
	 *
	 * wp-comments-post.php reads the error data as an integer HTTP status; the REST comments
	 * endpoint reads it as array( 'status' => N ). Either one given the other's shape answers
	 * with the wrong status, so the shape follows the request.
	 *
	 * @param string $code    Error code.
	 * @param string $message Message shown to the commenter.
	 * @param int    $status  HTTP status.
	 * @return WP_Error
	 */
	public static function refusal( string $code, string $message, int $status ) {
		$data = ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ? array( 'status' => $status ) : $status;
		return new WP_Error( $code, $message, $data );
	}

	/**
	 * Records why the guard acted, on the stored comment. Hooked to comment_post.
	 *
	 * @param int $comment_id New comment ID.
	 */
	public static function annotate( $comment_id ): void {
		try {
			if ( null === self::$verdict ) {
				return;
			}
			$reasons       = self::$verdict['reasons'];
			self::$verdict = null;
			if ( function_exists( 'add_comment_meta' ) ) {
				add_comment_meta( (int) $comment_id, self::META_KEY, implode( ',', $reasons ), true );
			}
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
		}
	}

	/**
	 * Tells a moderator why a comment was marked spam, on the Comments screen only.
	 *
	 * @param string          $text    Comment text, already filtered.
	 * @param WP_Comment|null $comment The comment.
	 * @return string
	 */
	public static function moderation_note( $text, $comment = null ) {
		if ( ! function_exists( 'is_admin' ) || ! is_admin() || ! is_object( $comment ) || empty( $comment->comment_ID ) ) {
			return $text;
		}
		if ( ! current_user_can( 'moderate_comments' ) ) {
			return $text;
		}
		$raw = (string) get_comment_meta( (int) $comment->comment_ID, self::META_KEY, true );
		if ( '' === $raw ) {
			return $text;
		}
		$labels = array();
		foreach ( explode( ',', $raw ) as $reason ) {
			$labels[] = self::reason_label( $reason );
		}
		return '<p class="csdt-cg-note" style="margin:0 0 6px;padding:4px 8px;background:#fef3c7;border-left:3px solid #d97706;color:#78350f;font-size:12px;"><strong>'
			. esc_html__( 'CloudScale Comment Guard:', 'cloudscale-cyber-devtools' )
			. '</strong> ' . esc_html( implode( '; ', $labels ) ) . '</p>' . $text;
	}

	/**
	 * A reason code as a moderator reads it.
	 *
	 * @param string $reason Reason code.
	 */
	public static function reason_label( string $reason ): string {
		if ( 0 === strpos( $reason, 'rule:' ) ) {
			/* translators: %s: firewall rule id, e.g. xss_reflected */
			return sprintf( __( 'text matched the firewall rule %s, treated as an attack', 'cloudscale-cyber-devtools' ), substr( $reason, 5 ) );
		}
		$map = array(
			'honeypot'  => __( 'filled in a field that is invisible to people', 'cloudscale-cyber-devtools' ),
			'too_fast'  => __( 'posted within seconds of the page loading', 'cloudscale-cyber-devtools' ),
			'rate'      => __( 'too many comments from one address in ten minutes', 'cloudscale-cyber-devtools' ),
			'no_fields' => __( 'posted without the comment form (the form fields are required on this site)', 'cloudscale-cyber-devtools' ),
		);
		return $map[ $reason ] ?? $reason;
	}

	/**
	 * One posted field, or null when it was not posted. The only place this class reads
	 * the request.
	 *
	 * No nonce is verified, because none can be: core puts no nonce on the comment form
	 * for a visitor who is not signed in (wp-comments-post.php checks one only for a
	 * signed-in user's unfiltered HTML), and one added here would be baked into cached
	 * pages and expire there, so real commenters on a cached post would fail it. Nor would
	 * it help: these two fields are a bot trap, and a bot that drops or replays a nonce
	 * would walk past the trap. A nonce was added and verified here once, and the
	 * end-to-end comment tests showed exactly that: filled honeypots and too-fast posts
	 * were approved. The fields are sanitised, only compared, never stored or printed, and
	 * the only outcome is that a comment is held as spam.
	 *
	 * @param string $name Field name.
	 */
	private static function posted( string $name ): ?string {
		// A field posted as an array was not posted by the form.
		// wporg-risk-accepted: CS_REJECT_23, WordPress.Security.NonceVerification.Missing -- Comment Guard's bot trap. Core's comment form carries no nonce for a visitor who is not signed in, and one added here is baked into cached pages and expires there, so real commenters would fail it while bots replay it. The value is sanitised, only compared, never stored or printed; the only outcome is that a comment is held as spam.
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- the comment form carries no nonce for an anonymous visitor, see the docblock; the value is sanitised and only compared
		return isset( $_POST[ $name ] ) && ! is_array( $_POST[ $name ] ) ? sanitize_text_field( wp_unslash( $_POST[ $name ] ) ) : null;
	}

	/** The client address, '' when it cannot be resolved. */
	private static function client_ip(): string {
		return class_exists( 'CSDT_DevTools' ) ? (string) CSDT_DevTools::get_client_ip() : '';
	}

	/**
	 * Comments the guard acted on in the last 7 days, by outcome, for the panel.
	 *
	 * @return array{spam:int,payload:int}
	 */
	public static function recent_counts(): array {
		$out = array(
			'spam'    => 0,
			'payload' => 0,
		);
		if ( ! function_exists( 'get_comments' ) ) {
			return $out;
		}
		$base = array(
			'count'      => true,
			'meta_key'   => self::META_KEY, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- admin panel only, one indexed key over 7 days of comments
			'date_query' => array( array( 'after' => '7 days ago' ) ),
		);
		$out['spam']    = (int) get_comments( array_merge( $base, array( 'status' => 'spam' ) ) );
		$out['payload'] = (int) get_comments(
			array_merge(
				$base,
				array(
					'status'       => 'spam',
					'meta_value'   => 'rule:', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- admin panel only, 7 days of the guard's own rows
					'meta_compare' => 'LIKE',
				)
			)
		);
		return $out;
	}

	// ── Admin UI ─────────────────────────────────────────────────────────

	/** Renders the Comment Guard panel. */
	public static function render_panel(): void {
		$on      = self::is_enabled();
		$require = self::requires_fields();
		$markup  = self::enforces_block_markup();
		$refuse  = self::refuses_flagged();
		$repeats = self::refuses_duplicates();
		$links   = self::blocks_links();
		$counts  = self::recent_counts();
		?>
		<div class="cs-panel" id="cs-panel-comment-guard">
			<div class="cs-section-header" style="background:linear-gradient(90deg,#78350f 0%,#b45309 100%);border-left:3px solid #fcd34d;">
				<span>&#128172; <?php esc_html_e( 'Comment Guard', 'cloudscale-cyber-devtools' ); ?></span>
				<span class="cs-header-hint"><?php esc_html_e( 'Bots and attack payloads go to Spam, and the sender is blocked on the first one', 'cloudscale-cyber-devtools' ); ?></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'commentguard',
					'Comment Guard',
					array(
						array(
							'name' => 'Why comments need their own check',
							'rec'  => 'Read this first',
							'html' => 'The firewall inspects every comment submission, the name, email and website fields included, but it deliberately does not run its injection rules over the comment <em>text</em>. This is a security blog: a reader who pastes a script element or a SQL payload into a comment to ask about it is a reader, and refusing them would be wrong. Before this panel existed that meant a payload in a comment was never recorded anywhere.<br><br>WordPress core already strips script elements, event handlers and <code>javascript:</code> links from comments by visitors, before saving them. That stays the main defence. This guard adds the two things core does not do: telling a bot from a person, and treating a comment that carries a payload as the attack it is.',
						),
						array(
							'name' => 'Bots: marked spam',
							'rec'  => 'How it works',
							'html' => 'Three checks, none of which a person can fail:<br><br><strong>1. A hidden field.</strong> The comment form carries a field that is off-screen, hidden from screen readers and out of the tab order. A person never fills it; a bot filling every field it finds does.<br><strong>2. Speed.</strong> The form records when it was served. A comment posted less than ' . (int) self::MIN_SECONDS . ' seconds later was not typed.<br><strong>3. Rate.</strong> More than ' . (int) self::RATE_LIMIT . ' comments from one address in ' . (int) ( self::RATE_WINDOW / 60 ) . ' minutes.<br><br>A comment failing any of them goes to Spam and counts as an attack: see the next section.',
						),
						array(
							'name' => 'Attacks: spam, and the sender is blocked',
							'rec'  => 'How it works',
							'html' => 'The comment text, name and website are run through the firewall\'s parameter-content rules with the prose exemption lifted, so a script element, an event handler, a <code>javascript:</code> link, SQL injection, code execution or a serialized PHP object is caught wherever it appears.<br><br>So is a block delimiter, <code>&lt;!-- wp:name</code> or <code>&lt;!-- /wp:name</code>, in the text, name, email or website, however it is encoded. Readers never type one; the editor writes them. The Events Calendar (CVE-2026-78159, CVE-2026-78006) was exploited with a <code>wp:legacy-widget</code> block in a comment. An ordinary HTML comment, or a sentence naming a block such as wp:paragraph, is not a match. It is logged as <code>comment_block_markup</code>, and by default that is ALL it does: see the next section.<br><br>A firewall rule match, or any of the bot checks above, sends the comment to Spam and counts as an attack, <code>comments flagged as attacks</code> in Auto-Block. When Automatic Blocking is switched on (it is off on a new install) the threshold is <strong>' . (int) CSDT_Auto_Block::DEFAULT_COMMENT_ATTACK_THRESHOLD . '</strong>: the first bad comment blocks the address on the usual escalating ladder (1 hour, then 24 hours, then 7 days) and sends the usual Telegram block alert. A payload match also adds a <code>blocked</code> row to the firewall\'s Recent Matches table, under the rule name prefixed with <code>comment_</code>, and the comment on the Comments screen says which rule matched.<br><br><strong>The trade, stated plainly:</strong> a reader who pastes a live payload into a comment to ask about it is blocked like an attacker. Auto-Block\'s never-block rules still apply, so your own address while signed in, live administrator sessions and your allowlist are never blocked.',
						),
						array(
							'name' => 'Block markup: report only unless enforced',
							'rec'  => 'Optional, off by default',
							'html' => 'By default a block delimiter in a comment is only <strong>recorded</strong>: a <code>logged</code> row under <code>comment_block_markup</code> in the firewall\'s Recent Matches table. The comment is handled as if the check did not exist, and the sender is not counted towards a block.<br><br>Tick <strong>Enforce block-markup detection</strong> and a match is treated like any other attack: the comment goes to Spam, the row is <code>blocked</code>, and the address is counted as a <code>comment_attack</code>. Read the Recent Matches table for a while first: the check is new, and the log tells you whether it ever fires on your readers.',
						),
						array(
							'name' => 'Refusing attack comments instead of storing them',
							'rec'  => 'Optional, off by default',
							'html' => 'By default a comment the guard treats as an attack is still <strong>stored</strong>, in Spam, where you can read it and rescue a false positive. Under a flood that means every one of them is a row in your comments table.<br><br>Tick <strong>Refuse attack comments</strong> and they are refused before they are saved: the sender sees a short "could not be accepted" page with HTTP status 403, and nothing is written. The trade: there is nothing left to rescue, so a reader caught by mistake loses their comment. Comments that are spam without being an attack (the "require the comment form" check) are still stored as Spam.',
						),
						array(
							'name' => 'Refusing a comment sent twice',
							'rec'  => 'Optional, off by default',
							'html' => 'WordPress already refuses a comment that repeats one on the same post, but only when the name and the email address are both unchanged. A visitor who notices a typo in their name, corrects it and sends the same text again gets through, and you receive two comments and two moderation emails.<br><br>Tick <strong>Refuse a comment the same visitor already sent</strong> and the second one is refused, whatever name it carries. The same visitor means the same email address in the last ' . (int) ( self::DUPLICATE_EMAIL_WINDOW / DAY_IN_SECONDS ) . ' days, or the same network address in the last ' . (int) ( self::DUPLICATE_IP_WINDOW / MINUTE_IN_SECONDS ) . ' minutes. Capital letters and spacing are ignored when the text is compared. The visitor sees a short page saying the comment was already sent, and whether it is waiting for approval, with a link back.<br><br><strong>The trade:</strong> the first copy is the one that is kept, so a corrected name is not picked up. Edit the name on the Comments screen if it matters. A comment you moved to Spam or the Trash does not count, so that visitor can send it again. Nobody is blocked or counted as an attacker for repeating a comment.',
						),
						array(
							'name' => 'Refusing comments with links',
							'rec'  => 'Optional, off by default',
							'html' => 'The comment nothing else here stops is the polite one: on topic, typed at a human pace, and written only to carry a link, in its text and in the Website field.<br><br>Tick <strong>Refuse comments that contain a link</strong> and a visitor\'s comment is refused when its text or name holds a web address, or its Website field is filled in. The Website field is also taken out of your comment form, so readers are not offered a field the site will not accept.<br><br><strong>What counts as a link:</strong> an address starting <code>http://</code>, <code>https://</code> or <code>www.</code>, link markup, a host name followed by a path such as <code>example.xyz/page</code>, and a bare host name such as <code>example.com</code>. An email address, a file name such as <code>wp-config.php</code> and a product name such as ASP.NET are not links.<br><br>The visitor sees a short page saying links are not accepted and what to remove, with a link back, so a reader can take the address out and send the comment again. Nothing is stored. Each refusal adds a <code>blocked</code> row under <code>comment_link</code> to the firewall\'s Recent Matches table.<br><br><strong>The trade:</strong> a reader cannot share a useful link either. Nobody is blocked or counted as an attacker for posting one. Signed-in users who can write posts are never screened; any other signed-in commenter has their profile website left off the comment. Pingbacks and trackbacks are not affected, those are switched off under Settings, Discussion. If your pages are cached, the Website field stays on cached copies until they refresh, and a reader who fills it in is told to leave it empty.',
						),
						array(
							'name' => 'Requiring the comment form',
							'rec'  => 'Optional, off by default',
							'html' => 'The second checkbox closes the one gap the default leaves: a bot that posts straight to <code>wp-comments-post.php</code> without loading the page never carries the hidden field or the timestamp. With it ticked, a comment missing either is marked spam.<br><br><strong>Only tick it if your comments come through WordPress\'s own comment form.</strong> A theme that builds its own form, or an AMP comment template, never carries the fields, so every comment from it would go to Spam. Post a test comment as a logged-out visitor after turning it on.<br><br>These are never counted as attacks, so a misconfigured form cannot get your readers blocked.',
						),
						array(
							'name' => 'What it does not do',
							'rec'  => 'Honest limits',
							'html' => 'Signed-in users who can write posts are never screened, the same scope as the firewall.<br><br>A comment form your theme builds by hand, rather than with WordPress\'s <code>comment_form()</code>, carries neither the hidden field nor the timestamp, and by default their absence is never held against a comment. So a bot posting straight to <code>wp-comments-post.php</code> skips the first two bot checks; the rate cap and the payload check still apply to it.<br><br>This is not a spam-content filter: a polite comment advertising something gets through unless it carries a link and you have ticked <strong>Refuse comments that contain a link</strong>. Pair it with Akismet or manual moderation for the rest.<br><br>Page caching is safe: a cached form only ever makes a comment look slower, never faster.',
						),
					)
				);
				?>
			</div>
			<div class="cs-panel-body">
				<div class="cs-field-row">
					<div class="cs-field" style="flex:1 1 100%;">
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;">
							<input type="checkbox" id="csdt-cg-enabled" <?php checked( $on ); ?>>
							<?php esc_html_e( 'Screen comments from visitors', 'cloudscale-cyber-devtools' ); ?>
						</label>
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;margin-top:8px;">
							<input type="checkbox" id="csdt-cg-require" <?php checked( $require ); ?>>
							<?php esc_html_e( 'Also mark comments that did not come through the comment form as spam (breaks custom and AMP comment forms)', 'cloudscale-cyber-devtools' ); ?>
						</label>
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;margin-top:8px;">
							<input type="checkbox" id="csdt-cg-enforce-markup" <?php checked( $markup ); ?>>
							<?php esc_html_e( 'Enforce block-markup detection (off: logged only)', 'cloudscale-cyber-devtools' ); ?>
						</label>
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;margin-top:8px;">
							<input type="checkbox" id="csdt-cg-refuse" <?php checked( $refuse ); ?>>
							<?php esc_html_e( 'Refuse attack comments (403) instead of storing them as spam', 'cloudscale-cyber-devtools' ); ?>
						</label>
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;margin-top:8px;">
							<input type="checkbox" id="csdt-cg-duplicates" <?php checked( $repeats ); ?>>
							<?php esc_html_e( 'Refuse a comment the same visitor already sent on the same post, even under a corrected name', 'cloudscale-cyber-devtools' ); ?>
						</label>
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;margin-top:8px;">
							<input type="checkbox" id="csdt-cg-links" <?php checked( $links ); ?>>
							<?php esc_html_e( 'Refuse comments that contain a link, and remove the Website field from the comment form', 'cloudscale-cyber-devtools' ); ?>
						</label>
					</div>
				</div>
				<p style="font-size:12px;color:#334155;margin:6px 0 14px;">
					<?php
					echo esc_html(
						sprintf(
							/* translators: 1: comments marked spam, 2: of those, comments that carried an attack payload */
							__( 'Last 7 days: %1$d comments marked spam, %2$d of them carrying an attack payload.', 'cloudscale-cyber-devtools' ),
							$counts['spam'],
							$counts['payload']
						)
					);
					?>
				</p>
				<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;">
					<button type="button" class="cs-btn-primary" id="csdt-cg-save">&#128190; <?php esc_html_e( 'Save', 'cloudscale-cyber-devtools' ); ?></button>
					<span id="csdt-cg-msg" style="font-size:12px;"></span>
				</div>
			</div>
		</div>
		<?php
	}

	/** Saves the setting. */
	public static function ajax_save(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		$raw = sanitize_text_field( wp_unslash( $_POST['enabled'] ?? '' ) );
		$on  = ( '' !== $raw && '0' !== $raw );
		update_option( self::OPTION_ENABLED, $on ? '1' : '0' );
		$req = sanitize_text_field( wp_unslash( $_POST['require_fields'] ?? '0' ) );
		update_option( self::OPTION_REQUIRE_FIELDS, '1' === $req ? '1' : '0' );
		$markup = sanitize_text_field( wp_unslash( $_POST['enforce_block_markup'] ?? '0' ) );
		update_option( self::OPTION_ENFORCE_BLOCK_MARKUP, '1' === $markup ? '1' : '0' );
		$refuse = sanitize_text_field( wp_unslash( $_POST['refuse_flagged'] ?? '0' ) );
		update_option( self::OPTION_REFUSE_FLAGGED, '1' === $refuse ? '1' : '0' );
		$repeats = sanitize_text_field( wp_unslash( $_POST['refuse_duplicates'] ?? '0' ) );
		update_option( self::OPTION_REFUSE_DUPLICATES, '1' === $repeats ? '1' : '0' );
		$links = sanitize_text_field( wp_unslash( $_POST['block_links'] ?? '0' ) );
		update_option( self::OPTION_BLOCK_LINKS, '1' === $links ? '1' : '0' );
		wp_send_json_success(
			array(
				'msg' => $on
					? __( 'Saved. Visitor comments are screened.', 'cloudscale-cyber-devtools' )
					: __( 'Saved. Visitor comments are no longer screened.', 'cloudscale-cyber-devtools' ),
			)
		);
	}
}