<?php
/**
 * Admin screens, AJAX endpoints, settings, report and scheduling.
 *
 * @package Malsift
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Admin.
 */
class Malsift_Admin {

	/**
	 * Hook everything up.
	 */
	public static function init() {
		add_action( is_multisite() ? 'network_admin_menu' : 'admin_menu', array( __CLASS__, 'menu' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'assets' ) );
		add_action( 'wp_ajax_malsift_scan', array( __CLASS__, 'ajax_scan' ) );
		add_action( 'wp_ajax_malsift_action', array( __CLASS__, 'ajax_action' ) );
		add_action( 'wp_ajax_malsift_fix_all', array( __CLASS__, 'ajax_fix_all' ) );
		add_action( 'wp_ajax_malsift_quarantine', array( __CLASS__, 'ajax_quarantine' ) );
		add_action( 'wp_ajax_malsift_reinstall', array( __CLASS__, 'ajax_reinstall' ) );
		add_action( 'admin_post_malsift_settings', array( __CLASS__, 'save_settings' ) );
		add_action( 'admin_post_malsift_firewall', array( __CLASS__, 'save_firewall' ) );
		add_action( 'admin_post_malsift_fw_event', array( __CLASS__, 'firewall_event' ) );
		add_action( 'admin_post_malsift_report', array( __CLASS__, 'report' ) );
		add_action( 'admin_post_malsift_toggle', array( __CLASS__, 'toggle' ) );
		add_action( 'admin_post_malsift_fw_mode', array( __CLASS__, 'firewall_mode' ) );
		add_action( 'admin_post_malsift_rescue_hide', array( __CLASS__, 'rescue_hide' ) );
		add_action( 'admin_head', array( __CLASS__, 'menu_style' ) );
		add_action( 'malsift_daily_scan', array( __CLASS__, 'cron_start' ) );
		add_action( 'malsift_continue_scan', array( __CLASS__, 'cron_continue' ) );
		add_filter( 'map_meta_cap', array( __CLASS__, 'lock_editor' ), 10, 2 );
	}

	/**
	 * Capability needed to use Malsift.
	 *
	 * @return string
	 */
	public static function cap() {
		return is_multisite() ? 'manage_network_options' : 'manage_options';
	}

	/**
	 * URL of a Malsift screen.
	 *
	 * @param string $page Page slug.
	 * @return string
	 */
	public static function page_url( $page = 'malsift' ) {
		$path = 'admin.php?page=' . $page;
		return is_multisite() ? network_admin_url( $path ) : admin_url( $path );
	}

	/**
	 * Activation: schedule the daily scan.
	 */
	public static function activate() {
		if ( Malsift_Storage::settings()['daily_scan'] ) {
			self::schedule();
		}
		if ( empty( Malsift_Firewall::settings()['since'] ) ) {
			Malsift_Firewall::update( array( 'since' => time() ) );
		}
		if ( Malsift_Firewall::settings()['uploads_php'] && Malsift_Firewall::server_supports_htaccess() ) {
			Malsift_Firewall::set_uploads_block( true );
		}
	}

	/**
	 * Deactivation: remove scheduled events.
	 */
	public static function deactivate() {
		wp_clear_scheduled_hook( 'malsift_daily_scan' );
		wp_clear_scheduled_hook( 'malsift_continue_scan' );
		delete_option( Malsift_Storage::OPT_STATE );
		Malsift_Firewall::set_uploads_block( false );
	}

	/**
	 * Schedule the daily scan for 03:00 site time.
	 */
	public static function schedule() {
		if ( ! wp_next_scheduled( 'malsift_daily_scan' ) ) {
			$when = new DateTime( 'tomorrow 03:00', wp_timezone() );
			wp_schedule_event( $when->getTimestamp(), 'daily', 'malsift_daily_scan' );
		}
	}

	/**
	 * Cron: start the daily scan.
	 */
	public static function cron_start() {
		if ( Malsift_Scanner::running() ) {
			return;
		}
		$start = Malsift_Scanner::start( 'scheduled' );
		if ( ! is_wp_error( $start ) ) {
			self::cron_continue();
		}
	}

	/**
	 * Cron: continue a scan in 20-second slices.
	 */
	public static function cron_continue() {
		$progress = Malsift_Scanner::run( 20 );
		if ( ! is_wp_error( $progress ) && empty( $progress['done'] ) ) {
			wp_schedule_single_event( time() + 60, 'malsift_continue_scan' );
		}
	}

	/**
	 * Block the theme/plugin code editor when locked.
	 *
	 * @param array  $caps Primitive caps.
	 * @param string $cap  Meta cap.
	 * @return array
	 */
	public static function lock_editor( $caps, $cap ) {
		if ( in_array( $cap, array( 'edit_themes', 'edit_plugins', 'edit_files' ), true ) && Malsift_Storage::settings()['lock_editor'] ) {
			$caps[] = 'do_not_allow';
		}
		return $caps;
	}

	/**
	 * Admin menu.
	 */
	public static function menu() {
		$cap = self::cap();
		add_menu_page( __( 'Malsift', 'malsift' ), __( 'Malsift', 'malsift' ), $cap, 'malsift', array( __CLASS__, 'render' ), 'dashicons-shield', 80 );
		add_submenu_page( 'malsift', __( 'Malsift Dashboard', 'malsift' ), __( 'Dashboard', 'malsift' ), $cap, 'malsift', array( __CLASS__, 'render' ) );
		add_submenu_page( 'malsift', __( 'Malsift Findings', 'malsift' ), __( 'Findings', 'malsift' ), $cap, 'malsift-findings', array( __CLASS__, 'render' ) );
		add_submenu_page( 'malsift', __( 'Malsift Firewall', 'malsift' ), __( 'Firewall', 'malsift' ), $cap, 'malsift-firewall', array( __CLASS__, 'render' ) );
		add_submenu_page( 'malsift', __( 'Malsift Reinstall', 'malsift' ), __( 'Reinstall', 'malsift' ), $cap, 'malsift-reinstall', array( __CLASS__, 'render' ) );
		add_submenu_page( 'malsift', __( 'Malsift Quarantine', 'malsift' ), __( 'Quarantine', 'malsift' ), $cap, 'malsift-quarantine', array( __CLASS__, 'render' ) );
		add_submenu_page( 'malsift', __( 'Malsift Scan History', 'malsift' ), __( 'Scan history', 'malsift' ), $cap, 'malsift-history', array( __CLASS__, 'render' ) );
		add_submenu_page( 'malsift', __( 'Malsift Settings', 'malsift' ), __( 'Settings', 'malsift' ), $cap, 'malsift-settings', array( __CLASS__, 'render' ) );
		/**
		 * Fires after Malsift's admin menu is registered, so add-ons can add screens.
		 *
		 * @param string $cap Capability required for Malsift screens.
		 */
		do_action( 'malsift_admin_menu', $cap );
	}

	/**
	 * Scripts and styles on Malsift screens only.
	 *
	 * @param string $hook Screen hook.
	 */
	public static function assets( $hook ) {
		if ( false === strpos( $hook, 'malsift' ) ) {
			return;
		}
		// The file time is part of the version, so browsers and caches pick up changed files.
		$ver = function ( $file ) {
			$time = @filemtime( MALSIFT_DIR . $file ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- missing file falls back to the plugin version.
			return MALSIFT_VERSION . ( $time ? '.' . $time : '' );
		};
		wp_enqueue_style( 'malsift-admin', MALSIFT_URL . 'assets/admin.css', array(), $ver( 'assets/admin.css' ) );
		wp_enqueue_script( 'malsift-admin', MALSIFT_URL . 'assets/admin.js', array(), $ver( 'assets/admin.js' ), true );
		wp_localize_script(
			'malsift-admin',
			'malsiftAdmin',
			array(
				'ajax'  => admin_url( 'admin-ajax.php' ),
				'nonce' => wp_create_nonce( 'malsift' ),
				'i18n'  => array(
					'starting' => __( 'Starting scan…', 'malsift' ),
					'error'    => __( 'Something went wrong:', 'malsift' ),
					'fixAll'   => __( 'Apply the safe automatic fix to every open threat? Replaced and removed files are kept in quarantine.', 'malsift' ),
					'working'  => __( 'Working…', 'malsift' ),
					'purge'    => __( 'Delete these files permanently? This cannot be undone.', 'malsift' ),
					'reinstall'   => __( 'Reinstall the selected items from WordPress.org? Changed files are backed up to quarantine first. Keep this page open until it finishes.', 'malsift' ),
					'reinstalling' => __( 'Reinstalling…', 'malsift' ),
					'done'        => __( 'Done', 'malsift' ),
					'failed'      => __( 'Failed', 'malsift' ),
					'rescan'      => __( 'Reinstall finished. Run a new scan to confirm the site is clean.', 'malsift' ),
				),
			)
		);
	}

	/**
	 * Verify AJAX request.
	 */
	private static function check_ajax() {
		check_ajax_referer( 'malsift', 'nonce' );
		if ( ! current_user_can( self::cap() ) ) {
			wp_send_json_error( array( 'message' => __( 'You are not allowed to do this.', 'malsift' ) ), 403 );
		}
	}

	/**
	 * AJAX: start/step a scan.
	 */
	public static function ajax_scan() {
		self::check_ajax();
		$op       = isset( $_POST['op'] ) ? sanitize_key( wp_unslash( $_POST['op'] ) ) : 'step';
		$progress = 'start' === $op ? Malsift_Scanner::start( 'manual' ) : Malsift_Scanner::run( 8 );
		if ( is_wp_error( $progress ) ) {
			wp_send_json_error( array( 'message' => $progress->get_error_message() ) );
		}
		wp_send_json_success( $progress );
	}

	/**
	 * AJAX: run an action on a finding.
	 */
	public static function ajax_action() {
		self::check_ajax();
		$id     = isset( $_POST['id'] ) ? sanitize_key( wp_unslash( $_POST['id'] ) ) : '';
		$action = isset( $_POST['act'] ) ? sanitize_key( wp_unslash( $_POST['act'] ) ) : '';
		$r      = Malsift_Actions::run( $id, $action );
		if ( is_wp_error( $r ) ) {
			wp_send_json_error( array( 'message' => $r->get_error_message() ) );
		}
		wp_send_json_success( $r );
	}

	/**
	 * AJAX: fix all threats.
	 */
	public static function ajax_fix_all() {
		self::check_ajax();
		$r = Malsift_Actions::fix_all();
		/* translators: 1: fixed, 2: failed, 3: needing manual review. */
		$msg = sprintf( __( 'Fixed %1$d, failed %2$d, %3$d need manual review. Run a new scan to confirm the site is clean.', 'malsift' ), $r['fixed'], $r['failed'], $r['skipped'] );
		wp_send_json_success( array( 'message' => trim( $msg . ' ' . implode( ' ', $r['messages'] ) ) ) );
	}

	/**
	 * AJAX: restore or purge quarantine items.
	 */
	public static function ajax_quarantine() {
		self::check_ajax();
		$group = isset( $_POST['group'] ) ? sanitize_key( wp_unslash( $_POST['group'] ) ) : '';
		$op    = isset( $_POST['op'] ) ? sanitize_key( wp_unslash( $_POST['op'] ) ) : '';
		$r     = 'restore' === $op ? Malsift_Quarantine::restore( $group ) : Malsift_Quarantine::purge( $group );
		if ( is_wp_error( $r ) ) {
			wp_send_json_error( array( 'message' => $r->get_error_message() ) );
		}
		wp_send_json_success( array( 'message' => 'restore' === $op ? __( 'Restored to the original location.', 'malsift' ) : __( 'Deleted permanently.', 'malsift' ) ) );
	}

	/**
	 * AJAX: reinstall one item.
	 */
	public static function ajax_reinstall() {
		self::check_ajax();
		$type = isset( $_POST['type'] ) ? sanitize_key( wp_unslash( $_POST['type'] ) ) : '';
		$key  = isset( $_POST['key'] ) ? sanitize_text_field( wp_unslash( $_POST['key'] ) ) : '';
		$r    = Malsift_Reinstall::run( $type, $key );
		if ( is_wp_error( $r ) ) {
			wp_send_json_error( array( 'message' => $r->get_error_message() ) );
		}
		wp_send_json_success( array( 'message' => $r ) );
	}

	/**
	 * Save settings.
	 */
	public static function save_settings() {
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_settings' );
		$email = isset( $_POST['alert_email'] ) ? sanitize_email( wp_unslash( $_POST['alert_email'] ) ) : '';
		$max   = isset( $_POST['max_file_mb'] ) ? absint( $_POST['max_file_mb'] ) : 8;
		Malsift_Storage::update_settings(
			array(
				'daily_scan'          => empty( $_POST['daily_scan'] ) ? 0 : 1,
				'email_alerts'        => empty( $_POST['email_alerts'] ) ? 0 : 1,
				'alert_email'         => $email ? $email : get_option( 'admin_email' ),
				'lock_editor'         => empty( $_POST['lock_editor'] ) ? 0 : 1,
				'max_file_mb'         => min( 64, max( 1, $max ) ),
				'delete_on_uninstall' => empty( $_POST['delete_on_uninstall'] ) ? 0 : 1,
				'spam_delete_permanently' => empty( $_POST['spam_delete_permanently'] ) ? 0 : 1,
			)
		);
		if ( Malsift_Storage::settings()['daily_scan'] ) {
			self::schedule();
		} else {
			wp_clear_scheduled_hook( 'malsift_daily_scan' );
		}
		wp_safe_redirect( add_query_arg( 'saved', '1', self::page_url( 'malsift-settings' ) ) );
		exit;
	}

	/* ------------------------------------------------------------------ */
	/* Rendering                                                            */
	/* ------------------------------------------------------------------ */

	/**
	 * Render the current screen.
	 */
	public static function render() {
		if ( ! current_user_can( self::cap() ) ) {
			return;
		}
		$page   = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : 'malsift'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$result = get_option( Malsift_Storage::OPT_RESULT );
		$result = is_array( $result ) ? $result : null;
		echo '<div class="wrap malsift">';
		self::rescue_banner( $result );
		self::header( $result, $page );
		echo '<div class="malsift-notice" id="malsift-notice" hidden></div>';
		switch ( $page ) {
			case 'malsift-findings':
				self::page_findings( $result );
				break;
			case 'malsift-reinstall':
				self::page_reinstall( $result );
				break;
			case 'malsift-quarantine':
				self::page_quarantine();
				break;
			case 'malsift-history':
				self::page_history();
				break;
			case 'malsift-settings':
				self::page_settings();
				break;
			case 'malsift-firewall':
				self::page_firewall();
				break;
			case 'malsift':
				self::page_dashboard( $result );
				break;
			default:
				/**
				 * Render an add-on screen. Return true when the page was rendered.
				 *
				 * @param bool   $done   Rendered.
				 * @param string $page   Page slug.
				 * @param array  $result Last scan result or null.
				 */
				if ( ! apply_filters( 'malsift_render_page', false, $page, $result ) ) {
					self::page_dashboard( $result );
				}
		}
		echo '</div>';
	}

	/**
	 * Tabs shown at the top of every Malsift screen. Add-ons add theirs with the malsift_tabs filter.
	 *
	 * @param array|null $result Last result.
	 * @return array slug => [label, order, count, count_class, url]
	 */
	public static function tabs( $result = null ) {
		$open    = 0;
		$threats = 0;
		if ( is_array( $result ) ) {
			$open    = (int) $result['counts']['threat'] + (int) $result['counts']['warning'];
			$threats = (int) $result['counts']['threat'];
		}
		$tabs = array(
			'malsift'            => array( __( 'Overview', 'malsift' ), 10 ),
			'malsift-findings'   => array( __( 'Findings', 'malsift' ), 20, $open, $threats ? 'is-bad' : '' ),
			'malsift-firewall'   => array( __( 'Firewall', 'malsift' ), 30 ),
			'malsift-reinstall'  => array( __( 'Reinstall', 'malsift' ), 80 ),
			'malsift-quarantine' => array( __( 'Quarantine', 'malsift' ), 85 ),
			'malsift-history'    => array( __( 'History', 'malsift' ), 90 ),
			'malsift-settings'   => array( __( 'Settings', 'malsift' ), 95 ),
		);
		/**
		 * Filter the Malsift tabs. Each tab is [label, order, count, count class, url].
		 *
		 * @param array      $tabs   Tabs keyed by page slug.
		 * @param array|null $result Last scan result.
		 */
		$tabs = apply_filters( 'malsift_tabs', $tabs, $result );
		uasort(
			$tabs,
			function ( $a, $b ) {
				return ( isset( $a[1] ) ? (int) $a[1] : 50 ) - ( isset( $b[1] ) ? (int) $b[1] : 50 );
			}
		);
		return $tabs;
	}

	/**
	 * Hide Malsift's sub-menu items in the WordPress menu: the tabs replace them.
	 */
	public static function menu_style() {
		if ( current_user_can( self::cap() ) ) {
			echo '<style>#toplevel_page_malsift .wp-submenu,#toplevel_page_malsift .wp-menu-arrow{display:none!important}#toplevel_page_malsift.wp-has-current-submenu .wp-menu-name{font-weight:600}</style>';
		}
	}

	/**
	 * Header with title, buttons and tabs.
	 *
	 * @param array|null $result Last result.
	 * @param string     $page   Current page.
	 */
	private static function header( $result, $page = 'malsift' ) {
		$running = Malsift_Scanner::running();
		/**
		 * Short badge next to the Malsift name (for example "PRO").
		 *
		 * @param string $badge Badge text.
		 */
		$badge = (string) apply_filters( 'malsift_header_badge', '' );
		?>
		<div class="malsift-head">
			<div class="malsift-brand">
				<span class="malsift-logo" aria-hidden="true"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="2"><path d="M12 3l8 3v6c0 4.5-3.4 8.3-8 9-4.6-.7-8-4.5-8-9V6l8-3z"/><path d="M9 12l2 2 4-4"/></svg></span>
				<div>
					<h1 class="malsift-title"><?php esc_html_e( 'Malsift', 'malsift' ); ?><?php if ( '' !== $badge ) : ?> <span class="malsift-badge"><?php echo esc_html( $badge ); ?></span><?php endif; ?></h1>
					<div class="malsift-meta">
						<?php
						if ( $result ) {
							printf(
								/* translators: 1: date, 2: duration, 3: files. */
								esc_html__( 'Last scan %1$s · %2$s · %3$s files', 'malsift' ),
								esc_html( wp_date( 'j M, H:i', $result['time'] ) ),
								esc_html( human_time_diff( $result['started'], max( $result['time'], $result['started'] + 1 ) ) ),
								esc_html( number_format_i18n( $result['stats']['files_verified'] + $result['stats']['files_scanned'] ) )
							);
						} else {
							esc_html_e( 'No scan has been run yet.', 'malsift' );
						}
						?>
					</div>
				</div>
			</div>
			<div class="malsift-btns">
				<?php if ( $result ) : ?>
					<a class="malsift-btn-sec" target="_blank" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=malsift_report' ), 'malsift_report' ) ); ?>"><?php esc_html_e( 'Download report', 'malsift' ); ?></a>
				<?php endif; ?>
				<button type="button" class="malsift-btn" id="malsift-scan" data-resume="<?php echo $running ? '1' : ''; ?>"><svg width="14" height="14" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M7 4v16l13-8z"/></svg><?php esc_html_e( 'Run full scan', 'malsift' ); ?></button>
			</div>
		</div>
		<nav class="malsift-tabs" aria-label="<?php esc_attr_e( 'Malsift sections', 'malsift' ); ?>">
			<?php
			foreach ( self::tabs( $result ) as $slug => $tab ) {
				$url = ! empty( $tab[4] ) ? $tab[4] : self::page_url( $slug );
				$on  = $slug === $page;
				printf(
					'<a class="malsift-tab%s" href="%s"%s>%s%s</a>',
					$on ? ' is-on' : '',
					esc_url( $url ),
					$on ? ' aria-current="page"' : '',
					esc_html( $tab[0] ),
					! empty( $tab[2] ) ? ' <span class="malsift-count ' . esc_attr( isset( $tab[3] ) ? $tab[3] : '' ) . '">' . esc_html( number_format_i18n( $tab[2] ) ) . '</span>' : ''
				);
			}
			?>
		</nav>
		<div class="malsift-progress" id="malsift-progress" hidden>
			<div class="malsift-progress-label" id="malsift-progress-label"></div>
			<div class="malsift-bar"><span id="malsift-bar"></span></div>
		</div>
		<?php
	}

	/**
	 * Severity chip.
	 *
	 * @param string $status ok|warn|bad|threat|warning|info.
	 * @param string $label  Text.
	 */
	private static function chip( $status, $label ) {
		$map = array(
			'ok'      => 'ok',
			'warn'    => 'warn',
			'warning' => 'warn',
			'bad'     => 'bad',
			'threat'  => 'bad',
			'info'    => 'info',
		);
		printf( '<span class="malsift-chip malsift-chip-%s">%s</span>', esc_attr( isset( $map[ $status ] ) ? $map[ $status ] : 'info' ), esc_html( $label ) );
	}

	/**
	 * Action buttons for a finding.
	 *
	 * @param array $f Finding.
	 */
	private static function actions( $f ) {
		if ( ! empty( $f['resolved'] ) ) {
			self::chip( 'ok', __( 'Fixed', 'malsift' ) );
			return;
		}
		if ( ! empty( $f['ignored'] ) ) {
			printf( '<button type="button" class="malsift-a malsift-a-g" data-id="%s" data-act="unignore">%s</button>', esc_attr( $f['id'] ), esc_html__( 'Stop ignoring', 'malsift' ) );
			return;
		}
		$first = true;
		foreach ( $f['actions'] as $action ) {
			if ( 'link' === $action ) {
				if ( ! empty( $f['meta']['link'] ) ) {
					printf( '<a class="malsift-a" href="%s">%s</a>', esc_url( $f['meta']['link'] ), esc_html( Malsift_Actions::label( $action, $f ) ) );
				}
				continue;
			}
			$class = 'ignore' === $action ? 'malsift-a malsift-a-g' : ( $first ? 'malsift-a malsift-a-p' : 'malsift-a' );
			printf(
				'<button type="button" class="%s" data-id="%s" data-act="%s" data-confirm="%s">%s</button>',
				esc_attr( $class ),
				esc_attr( $f['id'] ),
				esc_attr( $action ),
				esc_attr( Malsift_Actions::confirm_text( $action, $f ) ),
				esc_html( Malsift_Actions::label( $action, $f ) )
			);
			if ( 'ignore' !== $action ) {
				$first = false;
			}
		}
	}

	/**
	 * Target line for a finding.
	 *
	 * @param array $f Finding.
	 * @return string
	 */
	private static function target_text( $f ) {
		if ( in_array( $f['type'], array( 'file', 'dir' ), true ) ) {
			return $f['target'] . ( 'dir' === $f['type'] ? '/' : '' );
		}
		return '';
	}

	/**
	 * A finding: one line that opens to show the explanation and the fixes.
	 *
	 * @param array $f    Finding.
	 * @param bool  $open Open by default.
	 */
	private static function finding_card( $f, $open = false ) {
		$target = self::target_text( $f );
		$sub    = $target ? $target : strtok( (string) $f['detail'], "\n" );
		$labels = array(
			'threat'  => array( 'bad', __( 'Threat', 'malsift' ) ),
			'warning' => array( 'warn', __( 'Review', 'malsift' ) ),
			'info'    => array( 'info', __( 'Info', 'malsift' ) ),
		);
		$sev    = isset( $labels[ $f['severity'] ] ) ? $labels[ $f['severity'] ] : $labels['info'];
		if ( ! empty( $f['resolved'] ) ) {
			$sev = array( 'ok', __( 'Fixed', 'malsift' ) );
		} elseif ( ! empty( $f['ignored'] ) ) {
			$sev = array( 'info', __( 'Known', 'malsift' ) );
		}
		?>
		<details class="malsift-find"<?php echo $open ? ' open' : ''; ?>>
			<summary>
				<span class="malsift-dot malsift-dot-<?php echo esc_attr( $f['severity'] ); ?>"></span>
				<span class="malsift-find-t"><strong><?php echo esc_html( $f['title'] ); ?></strong><?php if ( $sub ) : ?><span><?php echo esc_html( $sub ); ?></span><?php endif; ?></span>
				<?php self::chip( $sev[0], $sev[1] ); ?>
				<svg class="malsift-chev" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M6 9l6 6 6-6"/></svg>
			</summary>
			<div class="malsift-find-b">
				<?php if ( $f['detail'] ) : ?>
					<p><?php echo nl2br( esc_html( $f['detail'] ) ); ?></p>
				<?php endif; ?>
				<div class="malsift-acts"><?php self::actions( $f ); ?></div>
			</div>
		</details>
		<?php
	}

	/**
	 * Link to the professional clean-up service.
	 *
	 * @return string
	 */
	public static function rescue_url() {
		/**
		 * Filter the "Site Rescue" link shown when threats are found.
		 *
		 * @param string $url URL.
		 */
		return apply_filters( 'malsift_rescue_url', 'https://blackspacelabs.com/site-rescue/?utm_source=malsift&utm_medium=plugin&utm_campaign=cleanup' );
	}

	/**
	 * Price shown for the manual clean-up service.
	 *
	 * @return string
	 */
	public static function rescue_price() {
		/**
		 * Filter the manual clean-up price shown in Malsift.
		 *
		 * @param string $price Price.
		 */
		return (string) apply_filters( 'malsift_rescue_price', '$49' );
	}

	/**
	 * Top banner offering manual clean-up by Blackspace Labs.
	 *
	 * @param array|null $result Last scan result.
	 */
	private static function rescue_banner( $result ) {
		$threats = is_array( $result ) ? (int) $result['counts']['threat'] : 0;
		$hidden  = get_user_meta( get_current_user_id(), 'malsift_rescue_hidden', true );
		$hidden  = is_array( $hidden ) ? $hidden : array( 0, 0 );
		if ( $threats ) {
			// Hidden for this scan only: a new scan with threats shows it again.
			if ( (int) $hidden[1] && is_array( $result ) && (int) $hidden[1] === (int) $result['time'] ) {
				return;
			}
		} elseif ( (int) $hidden[0] && time() - (int) $hidden[0] < 90 * DAY_IN_SECONDS ) {
			return;
		}
		$price = self::rescue_price();
		$url   = self::rescue_url();
		$more  = add_query_arg( 'utm_content', 'included', $url ) . '#included';
		?>
		<section class="malsift-promo<?php echo $threats ? ' is-urgent' : ''; ?>" aria-label="<?php esc_attr_e( 'Manual clean-up service', 'malsift' ); ?>">
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="malsift-promo-x">
				<input type="hidden" name="action" value="malsift_rescue_hide">
				<input type="hidden" name="scan" value="<?php echo esc_attr( is_array( $result ) ? (int) $result['time'] : 0 ); ?>">
				<?php wp_nonce_field( 'malsift_rescue_hide' ); ?>
				<button type="submit" aria-label="<?php esc_attr_e( 'Hide this offer', 'malsift' ); ?>"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M6 6l12 12M18 6L6 18"/></svg></button>
			</form>
			<div class="malsift-promo-main">
				<span class="malsift-promo-tag">BLACKSPACE LABS · SITE RESCUE</span>
				<h2>
				<?php
				echo esc_html(
					$threats
						/* translators: 1: number of infections, 2: price. */
						? sprintf( _n( 'Malsift found %1$d infection. Let our experts clean it for %2$s.', 'Malsift found %1$d infections. Let our experts clean them for %2$s.', $threats, 'malsift' ), $threats, $price )
						/* translators: %s: price. */
						: sprintf( __( 'Hacked site? Our experts clean it for %s.', 'malsift' ), $price )
				);
				?>
				</h2>
				<div class="malsift-promo-btns">
					<a class="malsift-promo-b1" href="<?php echo esc_url( $url ); ?>" target="_blank" rel="noopener"><?php echo esc_html( sprintf( /* translators: %s: price. */ __( 'Request clean-up — %s', 'malsift' ), $price ) ); ?> <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M14 4h6v6M20 4l-9 9M19 14v6H4V5h6"/></svg></a>
					<a class="malsift-promo-b2" href="<?php echo esc_url( $more ); ?>" target="_blank" rel="noopener"><?php esc_html_e( 'What\'s included', 'malsift' ); ?></a>
				</div>
			</div>
			<ul class="malsift-promo-list">
				<li><strong><?php esc_html_e( 'Malware removed by hand', 'malsift' ); ?></strong><span><?php esc_html_e( 'a security expert, not a script', 'malsift' ); ?></span></li>
				<li><strong><?php esc_html_e( 'Backdoors closed', 'malsift' ); ?></strong><span><?php esc_html_e( 'so the hack does not come back', 'malsift' ); ?></span></li>
				<li><strong><?php esc_html_e( 'Database and users checked', 'malsift' ); ?></strong><span><?php esc_html_e( 'spam, rogue admins and API keys', 'malsift' ); ?></span></li>
				<li><strong><?php esc_html_e( 'Clean-up report', 'malsift' ); ?></strong><span><?php esc_html_e( 'what we found and fixed', 'malsift' ); ?></span></li>
			</ul>
		</section>
		<?php
	}

	/**
	 * Hide the clean-up banner: for this scan when it found threats, otherwise for 90 days.
	 */
	public static function rescue_hide() {
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_rescue_hide' );
		update_user_meta( get_current_user_id(), 'malsift_rescue_hidden', array( time(), isset( $_POST['scan'] ) ? absint( $_POST['scan'] ) : 0 ) );
		$back = wp_get_referer();
		wp_safe_redirect( $back ? $back : self::page_url() );
		exit;
	}

	/**
	 * Open findings of the last scan, threats first.
	 *
	 * @param array  $result Result.
	 * @param string $sev    threat|warning|'' for both.
	 * @return array
	 */
	private static function open_findings( $result, $sev = '' ) {
		return array_filter(
			$result['findings'],
			function ( $f ) use ( $sev ) {
				return empty( $f['resolved'] ) && empty( $f['ignored'] ) && 'info' !== $f['severity'] && ( '' === $sev || $sev === $f['severity'] );
			}
		);
	}

	/**
	 * Blocked attacks per day for the last days, oldest first.
	 *
	 * @param int $days Days.
	 * @return int[]
	 */
	private static function daily_blocks( $days = 7 ) {
		$out   = array_fill( 0, $days, 0 );
		$today = (int) floor( ( time() + (int) wp_timezone()->getOffset( new DateTime() ) ) / DAY_IN_SECONDS );
		$off   = (int) wp_timezone()->getOffset( new DateTime() );
		foreach ( Malsift_Firewall::log() as $e ) {
			if ( ! in_array( $e['action'], array( 'blocked', 'locked' ), true ) ) {
				continue;
			}
			$i = $days - 1 - ( $today - (int) floor( ( $e['time'] + $off ) / DAY_IN_SECONDS ) );
			if ( $i >= 0 && $i < $days ) {
				$out[ $i ] += max( 1, (int) $e['count'] );
			}
		}
		return $out;
	}

	/**
	 * Small bar chart.
	 *
	 * @param int[]  $values Values.
	 * @param string $label  Accessible label.
	 * @return string SVG.
	 */
	private static function sparkline( $values, $label ) {
		$max = max( 1, max( $values ) );
		$n   = count( $values );
		$w   = 13;
		$gap = 4;
		$h   = 40;
		$svg = '<svg class="malsift-spark" width="' . ( $n * ( $w + $gap ) - $gap ) . '" height="' . $h . '" viewBox="0 0 ' . ( $n * ( $w + $gap ) - $gap ) . ' ' . $h . '" role="img" aria-label="' . esc_attr( $label ) . '">';
		foreach ( $values as $i => $v ) {
			$bh   = max( 3, (int) round( $h * $v / $max ) );
			$svg .= '<rect x="' . ( $i * ( $w + $gap ) ) . '" y="' . ( $h - $bh ) . '" width="' . $w . '" height="' . $bh . '" rx="2" fill="' . ( $i === $n - 1 ? '#1d4ed8' : '#bfdbfe' ) . '"></rect>';
		}
		return $svg . '</svg>';
	}

	/**
	 * Protection items for the dashboard. Add-ons add theirs with the malsift_protection_items filter.
	 *
	 * @return array[]
	 */
	public static function protection_items() {
		$fw    = Malsift_Firewall::settings();
		$s     = Malsift_Storage::settings();
		$stats = Malsift_Firewall::stats( 7 );
		$modes = array(
			'off'      => array( 'bad', __( 'Off', 'malsift' ) ),
			'learning' => array( 'warn', __( 'Learning', 'malsift' ) ),
			'protect'  => array( 'ok', __( 'Protecting', 'malsift' ) ),
		);
		$ht    = Malsift_Firewall::server_supports_htaccess();
		$items = array(
			'firewall'    => array(
				'title'  => __( 'Firewall', 'malsift' ),
				/* translators: %s: number of blocked attacks. */
				'detail' => sprintf( __( '%s blocked this week', 'malsift' ), number_format_i18n( $stats['blocked'] ) ),
				'chip'   => $modes[ $fw['mode'] ],
				'link'   => self::page_url( 'malsift-firewall' ),
			),
			'login_limit' => array(
				'title'  => __( 'Login limits', 'malsift' ),
				/* translators: 1: attempts, 2: minutes. */
				'detail' => sprintf( __( '%1$d tries, then a %2$d-minute lockout', 'malsift' ), $fw['login_attempts'], $fw['lockout_minutes'] ),
				'toggle' => (bool) $fw['login_limit'],
			),
			'block_enum'  => array(
				'title'  => __( 'Hide usernames', 'malsift' ),
				'detail' => __( 'Stops visitors from listing user accounts', 'malsift' ),
				'toggle' => (bool) $fw['block_enum'],
			),
			'uploads_php' => array(
				'title'    => __( 'Block PHP in uploads', 'malsift' ),
				'detail'   => $ht ? __( 'Uploaded webshells cannot run', 'malsift' ) : __( 'Ask your host (server does not read .htaccess)', 'malsift' ),
				'toggle'   => $ht && $fw['uploads_php'],
				'disabled' => ! $ht,
			),
			'lock_editor' => array(
				'title'  => __( 'Lock the code editor', 'malsift' ),
				'detail' => __( 'No PHP edits from the dashboard', 'malsift' ),
				'toggle' => (bool) $s['lock_editor'],
			),
			'daily_scan'  => array(
				'title'  => __( 'Daily scan', 'malsift' ),
				'detail' => __( 'Every day at 03:00 site time', 'malsift' ),
				'toggle' => (bool) $s['daily_scan'],
			),
		);
		/**
		 * Filter the protection items on the dashboard. An item with "toggle" shows a switch
		 * that posts to admin-post.php with "post_action" (default malsift_toggle) and "key".
		 *
		 * @param array $items Items keyed by name.
		 */
		return apply_filters( 'malsift_protection_items', $items );
	}

	/**
	 * Render one protection item.
	 *
	 * @param string $key  Key.
	 * @param array  $item Item.
	 */
	private static function protection_row( $key, $item ) {
		echo '<div class="malsift-prot"><div class="malsift-prot-t"><strong>' . esc_html( $item['title'] ) . '</strong><span>' . esc_html( $item['detail'] ) . '</span></div>';
		if ( isset( $item['toggle'] ) ) {
			$action = isset( $item['post_action'] ) ? $item['post_action'] : 'malsift_toggle';
			echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '">';
			wp_nonce_field( $action . '_' . $key );
			echo '<input type="hidden" name="action" value="' . esc_attr( $action ) . '"><input type="hidden" name="key" value="' . esc_attr( $key ) . '"><input type="hidden" name="on" value="' . ( $item['toggle'] ? '0' : '1' ) . '">';
			printf(
				'<button type="submit" class="malsift-switch" role="switch" aria-checked="%s" aria-label="%s"%s></button>',
				$item['toggle'] ? 'true' : 'false',
				esc_attr( $item['title'] ),
				! empty( $item['disabled'] ) ? ' disabled' : ''
			);
			echo '</form>';
		} elseif ( ! empty( $item['chip'] ) ) {
			echo ! empty( $item['link'] ) ? '<a href="' . esc_url( $item['link'] ) . '" style="text-decoration:none">' : '';
			self::chip( $item['chip'][0], $item['chip'][1] );
			echo ! empty( $item['link'] ) ? '</a>' : '';
		} elseif ( ! empty( $item['link'] ) ) {
			echo '<a class="malsift-a" href="' . esc_url( $item['link'] ) . '">' . esc_html( isset( $item['link_label'] ) ? $item['link_label'] : __( 'Set up', 'malsift' ) ) . '</a>';
		}
		echo '</div>';
	}

	/**
	 * Recent activity: scans and firewall events.
	 *
	 * @return array[] [time, chip status, chip label, text]
	 */
	private static function activity() {
		$labels = Malsift_Firewall::labels();
		$items  = array();
		foreach ( array_slice( Malsift_Firewall::log(), 0, 6 ) as $e ) {
			$names   = array(
				'blocked' => array( 'bad', __( 'Blocked', 'malsift' ) ),
				'logged'  => array( 'warn', __( 'Logged', 'malsift' ) ),
				'locked'  => array( 'warn', __( 'Locked out', 'malsift' ) ),
			);
			$n       = isset( $names[ $e['action'] ] ) ? $names[ $e['action'] ] : $names['logged'];
			$text    = sprintf(
				/* translators: 1: attack type, 2: IP address. */
				__( '%1$s from %2$s', 'malsift' ),
				isset( $labels[ $e['rule'] ] ) ? $labels[ $e['rule'] ] : $e['rule'],
				$e['ip']
			);
			$items[] = array( (int) $e['time'], $n[0], $n[1], $text . ( $e['count'] > 1 ? ' · ' . sprintf( /* translators: %d: count. */ _n( '%d time', '%d times', $e['count'], 'malsift' ), $e['count'] ) : '' ) );
		}
		$history = get_option( Malsift_Storage::OPT_HISTORY, array() );
		foreach ( array_slice( (array) $history, 0, 4 ) as $h ) {
			if ( $h['threats'] ) {
				/* translators: %d: count. */
				$text = sprintf( _n( 'Scan finished — %d threat found', 'Scan finished — %d threats found', $h['threats'], 'malsift' ), $h['threats'] );
			} elseif ( $h['warnings'] ) {
				/* translators: %d: count. */
				$text = sprintf( _n( 'Scan finished — no malware, %d item to review', 'Scan finished — no malware, %d items to review', $h['warnings'], 'malsift' ), $h['warnings'] );
			} else {
				$text = __( 'Scan finished — clean', 'malsift' );
			}
			$items[] = array( (int) $h['time'], $h['threats'] ? 'bad' : 'ok', __( 'Scan', 'malsift' ), $text );
		}
		/**
		 * Filter the dashboard activity list. Each item is [time, chip status, chip label, text].
		 *
		 * @param array $items Items.
		 */
		$items = apply_filters( 'malsift_activity', $items );
		usort(
			$items,
			function ( $a, $b ) {
				return $b[0] - $a[0];
			}
		);
		return array_slice( $items, 0, 6 );
	}

	/**
	 * Dashboard.
	 *
	 * @param array|null $result Last result.
	 */
	private static function page_dashboard( $result ) {
		if ( ! $result ) {
			?>
			<div class="malsift-empty">
				<h2><?php esc_html_e( 'Check this site for malware', 'malsift' ); ?></h2>
				<p><?php esc_html_e( 'Malsift compares your WordPress core and plugin files with the official releases, scans everything else for malicious code, and checks administrator accounts, API keys, spam posts and injected scripts. A typical scan takes one to three minutes.', 'malsift' ); ?></p>
				<p><button type="button" class="malsift-btn" data-start-scan="1"><?php esc_html_e( 'Run your first scan', 'malsift' ); ?></button></p>
			</div>
			<?php
			return;
		}
		$c        = $result['counts'];
		$threats  = self::open_findings( $result, 'threat' );
		$warnings = self::open_findings( $result, 'warning' );
		$open     = $threats + $warnings;
		$fixed    = count(
			array_filter(
				$result['findings'],
				function ( $f ) {
					return ! empty( $f['resolved'] );
				}
			)
		);
		$score    = (int) $result['score'];
		$color    = $c['threat'] ? '#dc2626' : ( $score < 90 ? '#d97706' : '#059669' );
		$dash     = round( 314 * $score / 100 );
		$blocks   = self::daily_blocks( 7 );
		?>
		<section class="malsift-hero">
			<div class="malsift-ring">
				<svg width="120" height="120" viewBox="0 0 120 120" role="img" aria-label="<?php echo esc_attr( sprintf( /* translators: %d: score. */ __( 'Security score %d out of 100', 'malsift' ), $score ) ); ?>">
					<circle cx="60" cy="60" r="50" fill="none" stroke="#f3f4f6" stroke-width="12"></circle>
					<circle cx="60" cy="60" r="50" fill="none" stroke="<?php echo esc_attr( $color ); ?>" stroke-width="12" stroke-linecap="round" stroke-dasharray="<?php echo esc_attr( $dash . ' 314' ); ?>" transform="rotate(-90 60 60)"></circle>
				</svg>
				<b><?php echo esc_html( $score ); ?><small><?php esc_html_e( 'out of 100', 'malsift' ); ?></small></b>
			</div>
			<div class="malsift-hero-main">
				<?php if ( $c['threat'] ) : ?>
					<span class="malsift-pill malsift-pill-bad"><?php echo esc_html( sprintf( /* translators: %d: threats. */ _n( '%d infection found', '%d infections found', $c['threat'], 'malsift' ), $c['threat'] ) ); ?></span>
					<h2><?php esc_html_e( 'Clean up this site now', 'malsift' ); ?></h2>
					<p><?php esc_html_e( 'Fix the threats, then run a new scan to confirm the site is clean. Every file Malsift replaces or removes is kept in quarantine, so it can be restored.', 'malsift' ); ?></p>
				<?php else : ?>
					<span class="malsift-pill malsift-pill-ok"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M5 12l5 5L20 7"/></svg><?php esc_html_e( 'No malware found', 'malsift' ); ?></span>
					<h2>
					<?php
					echo esc_html(
						$c['warning']
							/* translators: %d: number of items. */
							? sprintf( _n( '%d thing to tighten', '%d things to tighten', $c['warning'], 'malsift' ), $c['warning'] )
							: __( 'This site looks clean', 'malsift' )
					);
					?>
					</h2>
					<p>
					<?php
					if ( $c['warning'] ) {
						esc_html_e( 'Your files are clean. Fixing the items below raises your score — most take one click.', 'malsift' );
					} elseif ( $fixed ) {
						esc_html_e( 'Everything from the last scan has been handled. Run a new scan to confirm.', 'malsift' );
					} else {
						esc_html_e( 'Nothing needs your attention. Malsift keeps checking every day.', 'malsift' );
					}
					?>
					</p>
				<?php endif; ?>
				<div class="malsift-btns">
					<?php if ( $c['threat'] ) : ?>
						<button type="button" class="malsift-btn malsift-btn-red" id="malsift-fix-all"><?php esc_html_e( 'Fix all threats', 'malsift' ); ?></button>
					<?php endif; ?>
					<?php if ( $open ) : ?>
						<a class="<?php echo $c['threat'] ? 'malsift-btn-sec' : 'malsift-btn'; ?>" href="<?php echo esc_url( self::page_url( 'malsift-findings' ) ); ?>"><?php echo esc_html( sprintf( /* translators: %d: items. */ _n( 'Review %d item', 'Review %d items', count( $open ), 'malsift' ), count( $open ) ) ); ?></a>
					<?php endif; ?>
				</div>
			</div>
			<?php if ( $open ) : ?>
				<div class="malsift-hero-side">
					<div class="k"><?php esc_html_e( 'Each fix adds points', 'malsift' ); ?></div>
					<?php foreach ( array_slice( $open, 0, 4 ) as $f ) : ?>
						<div class="row"><span><?php echo esc_html( $f['title'] ); ?></span><span class="malsift-pts">+<?php echo esc_html( 'threat' === $f['severity'] ? 15 : 3 ); ?></span></div>
					<?php endforeach; ?>
				</div>
			<?php endif; ?>
		</section>

		<?php
		/**
		 * Fires below the dashboard summary.
		 *
		 * @param array $result Last scan result.
		 */
		do_action( 'malsift_dashboard_after_banner', $result );
		?>

		<div class="malsift-cards">
			<div class="malsift-card"><div class="l"><?php esc_html_e( 'Threats', 'malsift' ); ?></div><div class="n<?php echo $c['threat'] ? ' malsift-red' : ''; ?>"><?php echo esc_html( $c['threat'] ); ?></div><div class="s"><?php echo $c['threat'] ? esc_html__( 'Needs cleaning', 'malsift' ) : esc_html__( 'Nothing to clean', 'malsift' ); ?></div></div>
			<div class="malsift-card"><div class="l"><?php esc_html_e( 'To review', 'malsift' ); ?></div><div class="n<?php echo $c['warning'] ? ' malsift-amb' : ''; ?>"><?php echo esc_html( $c['warning'] ); ?></div><div class="s"><?php echo esc_html( sprintf( /* translators: 1: passed checks, 2: all checks. */ __( '%1$d of %2$d checks passed', 'malsift' ), $result['passed'], count( $result['checks'] ) ) ); ?></div></div>
			<div class="malsift-card"><div class="malsift-card-row"><div><div class="l"><?php esc_html_e( 'Attacks blocked', 'malsift' ); ?></div><div class="n"><?php echo esc_html( number_format_i18n( array_sum( $blocks ) ) ); ?></div></div><?php echo self::sparkline( $blocks, __( 'Blocked attacks per day, last 7 days', 'malsift' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built from numbers. ?></div><div class="s"><?php esc_html_e( 'Last 7 days', 'malsift' ); ?></div></div>
			<div class="malsift-card"><div class="l"><?php esc_html_e( 'Files checked', 'malsift' ); ?></div><div class="n"><?php echo esc_html( number_format_i18n( $result['stats']['files_verified'] + $result['stats']['files_scanned'] ) ); ?></div><div class="s"><?php echo esc_html( sprintf( /* translators: %s: number. */ __( '%s matched official copies', 'malsift' ), number_format_i18n( $result['stats']['files_verified'] ) ) ); ?></div></div>
		</div>

		<div class="malsift-cols">
			<section class="malsift-panel malsift-col-main">
				<h3><?php esc_html_e( 'Needs your attention', 'malsift' ); ?> <?php if ( count( $open ) > 6 ) : ?><a href="<?php echo esc_url( self::page_url( 'malsift-findings' ) ); ?>"><?php echo esc_html( sprintf( /* translators: %d: items. */ __( 'See all %d', 'malsift' ), count( $open ) ) ); ?></a><?php endif; ?></h3>
				<?php
				if ( ! $open ) {
					echo '<p class="malsift-none">' . esc_html__( 'Nothing needs your attention.', 'malsift' ) . '</p>';
				}
				foreach ( array_slice( $open, 0, 6 ) as $f ) {
					self::finding_card( $f );
				}
				?>
			</section>
			<section class="malsift-panel malsift-col-side">
				<h3><?php esc_html_e( 'Protection', 'malsift' ); ?></h3>
				<?php
				foreach ( self::protection_items() as $key => $item ) {
					self::protection_row( $key, $item );
				}
				?>
			</section>
		</div>

		<?php $activity = self::activity(); ?>
		<?php if ( $activity ) : ?>
			<section class="malsift-panel">
				<h3><?php esc_html_e( 'Recent activity', 'malsift' ); ?> <a href="<?php echo esc_url( self::page_url( 'malsift-firewall' ) ); ?>"><?php esc_html_e( 'Firewall log', 'malsift' ); ?></a></h3>
				<?php foreach ( $activity as $a ) : ?>
					<div class="malsift-act"><time datetime="<?php echo esc_attr( gmdate( 'c', $a[0] ) ); ?>"><?php echo esc_html( wp_date( 'j M, H:i', $a[0] ) ); ?></time><?php self::chip( $a[1], $a[2] ); ?><span class="t"><?php echo esc_html( $a[3] ); ?></span></div>
				<?php endforeach; ?>
			</section>
		<?php endif; ?>

		<section class="malsift-panel">
			<h3><?php esc_html_e( 'All checks', 'malsift' ); ?> <span><?php echo esc_html( sprintf( /* translators: 1: passed, 2: all. */ __( '%1$d of %2$d passed', 'malsift' ), $result['passed'], count( $result['checks'] ) ) ); ?></span></h3>
			<div class="malsift-checks">
			<?php
			$groups  = array(
				'files'     => __( 'Files', 'malsift' ),
				'access'    => __( 'Access', 'malsift' ),
				'database'  => __( 'Database', 'malsift' ),
				'hardening' => __( 'Hardening', 'malsift' ),
			);
			$current = '';
			foreach ( Malsift_Scanner::checks() as $key => $def ) {
				if ( $def[0] !== $current ) {
					$current = $def[0];
					echo '<div class="malsift-check-g">' . esc_html( $groups[ $current ] ) . '</div>';
				}
				$check = isset( $result['checks'][ $key ] ) ? $result['checks'][ $key ] : array(
					'status' => 'info',
					'label'  => __( 'Not checked yet', 'malsift' ),
				);
				echo '<div class="malsift-check"><div class="t"><strong>' . esc_html( $def[1] ) . '</strong><span>' . esc_html( $def[2] ) . '</span></div>';
				self::chip( $check['status'], $check['label'] );
				echo '</div>';
			}
			?>
			</div>
		</section>
		<?php
	}

	/**
	 * History table.
	 *
	 * @param int $limit Rows.
	 */
	private static function history_table( $limit ) {
		$history = get_option( Malsift_Storage::OPT_HISTORY, array() );
		if ( ! $history ) {
			echo '<p class="malsift-none">' . esc_html__( 'No scans yet.', 'malsift' ) . '</p>';
			return;
		}
		echo '<table class="malsift-table malsift-hist"><tbody>';
		foreach ( array_slice( $history, 0, $limit ) as $h ) {
			echo '<tr><td>' . esc_html( wp_date( 'j M, H:i', $h['time'] ) ) . '</td><td>' . esc_html( 'scheduled' === $h['trigger'] ? __( 'Daily scan', 'malsift' ) : __( 'Full scan', 'malsift' ) ) . '</td><td>';
			if ( $h['threats'] ) {
				/* translators: %d: count. */
				self::chip( 'bad', sprintf( _n( '%d threat', '%d threats', $h['threats'], 'malsift' ), $h['threats'] ) );
			} elseif ( $h['warnings'] ) {
				/* translators: %d: count. */
				self::chip( 'warn', sprintf( _n( '%d warning', '%d warnings', $h['warnings'], 'malsift' ), $h['warnings'] ) );
			} else {
				self::chip( 'ok', __( 'Clean', 'malsift' ) );
			}
			echo '</td></tr>';
		}
		echo '</tbody></table>';
	}

	/**
	 * All findings.
	 *
	 * @param array|null $result Last result.
	 */
	private static function page_findings( $result ) {
		if ( ! $result ) {
			echo '<div class="malsift-empty"><h2>' . esc_html__( 'No findings yet', 'malsift' ) . '</h2><p>' . esc_html__( 'Run a scan to see what Malsift finds.', 'malsift' ) . '</p></div>';
			return;
		}
		$filter = isset( $_GET['show'] ) ? sanitize_key( wp_unslash( $_GET['show'] ) ) : 'open'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$match  = array(
			'open'     => function ( $f ) {
				return empty( $f['resolved'] ) && empty( $f['ignored'] ) && 'info' !== $f['severity'];
			},
			'threat'   => function ( $f ) {
				return empty( $f['resolved'] ) && empty( $f['ignored'] ) && 'threat' === $f['severity'];
			},
			'warning'  => function ( $f ) {
				return empty( $f['resolved'] ) && empty( $f['ignored'] ) && 'warning' === $f['severity'];
			},
			'resolved' => function ( $f ) {
				return ! empty( $f['resolved'] );
			},
			'ignored'  => function ( $f ) {
				return ! empty( $f['ignored'] ) && empty( $f['resolved'] );
			},
			'info'     => function ( $f ) {
				return 'info' === $f['severity'] && empty( $f['resolved'] );
			},
		);
		$names  = array(
			'open'     => __( 'Open', 'malsift' ),
			'threat'   => __( 'Threats', 'malsift' ),
			'warning'  => __( 'To review', 'malsift' ),
			'resolved' => __( 'Fixed', 'malsift' ),
			'ignored'  => __( 'Known', 'malsift' ),
			'info'     => __( 'Info', 'malsift' ),
		);
		if ( ! isset( $match[ $filter ] ) ) {
			$filter = 'open';
		}
		?>
		<div class="malsift-toolbar">
			<nav class="malsift-filters" aria-label="<?php esc_attr_e( 'Show', 'malsift' ); ?>">
				<?php
				foreach ( $names as $key => $label ) {
					$count = count( array_filter( $result['findings'], $match[ $key ] ) );
					printf(
						'<a class="malsift-filter%s" href="%s"%s>%s <span>%s</span></a>',
						$key === $filter ? ' is-on' : '',
						esc_url( add_query_arg( 'show', $key, self::page_url( 'malsift-findings' ) ) ),
						$key === $filter ? ' aria-current="true"' : '',
						esc_html( $label ),
						esc_html( number_format_i18n( $count ) )
					);
				}
				?>
			</nav>
			<?php if ( $result['counts']['threat'] ) : ?>
				<button type="button" class="malsift-btn malsift-btn-red" id="malsift-fix-all"><?php esc_html_e( 'Fix all threats', 'malsift' ); ?></button>
			<?php endif; ?>
		</div>
		<?php
		$groups = array(
			'files'     => __( 'Files', 'malsift' ),
			'access'    => __( 'Access', 'malsift' ),
			'database'  => __( 'Database', 'malsift' ),
			'hardening' => __( 'Settings and updates', 'malsift' ),
		);
		$checks = Malsift_Scanner::checks();
		$by     = array();
		foreach ( array_filter( $result['findings'], $match[ $filter ] ) as $f ) {
			$g          = isset( $checks[ $f['check'] ] ) ? $checks[ $f['check'] ][0] : 'files';
			$by[ $g ][] = $f;
		}
		if ( ! $by ) {
			echo '<div class="malsift-panel"><p class="malsift-none">' . esc_html__( 'Nothing here.', 'malsift' ) . '</p></div>';
		}
		$first = true;
		foreach ( $groups as $g => $title ) {
			if ( empty( $by[ $g ] ) ) {
				continue;
			}
			echo '<section class="malsift-panel"><h3>' . esc_html( $title ) . ' <span>' . esc_html( sprintf( /* translators: %d: items. */ _n( '%d item', '%d items', count( $by[ $g ] ), 'malsift' ), count( $by[ $g ] ) ) ) . '</span></h3>';
			foreach ( $by[ $g ] as $f ) {
				self::finding_card( $f, $first && 'open' === $filter );
				$first = false;
			}
			echo '</section>';
		}
		if ( ! empty( $result['notes'] ) && 'info' === $filter ) {
			echo '<section class="malsift-panel"><h3>' . esc_html__( 'Scan notes', 'malsift' ) . '</h3><ul class="malsift-notes">';
			foreach ( $result['notes'] as $note ) {
				echo '<li>' . esc_html( $note ) . '</li>';
			}
			echo '</ul></section>';
		}
	}

	/**
	 * Reinstall screen.
	 *
	 * @param array|null $result Last result.
	 */
	private static function page_reinstall( $result ) {
		$blocked = Malsift_Reinstall::blocked();
		$items   = Malsift_Reinstall::items();
		$issues  = array();
		if ( $result ) {
			foreach ( $result['findings'] as $f ) {
				if ( in_array( $f['type'], array( 'file', 'dir' ), true ) && empty( $f['resolved'] ) && empty( $f['ignored'] ) && 'info' !== $f['severity'] ) {
					foreach ( $items as $id => $item ) {
						$in = 'core' === $item['type']
							? ( 0 === strpos( $f['target'], 'wp-admin/' ) || 0 === strpos( $f['target'], 'wp-includes/' ) || false === strpos( $f['target'], '/' ) )
							: Malsift_Storage::in( $f['target'], $item['rel'] );
						if ( $in ) {
							$issues[ $id ] = isset( $issues[ $id ] ) ? $issues[ $id ] + 1 : 1;
							break;
						}
					}
				}
			}
		}
		if ( $blocked ) {
			echo '<div class="notice notice-warning inline"><p>' . esc_html__( 'File changes are disabled on this site (DISALLOW_FILE_MODS in wp-config.php), so reinstalling is not possible. Remove the setting temporarily, reinstall, then add it back.', 'malsift' ) . '</p></div>';
		}
		$groups = array(
			'core'   => __( 'WordPress core', 'malsift' ),
			'plugin' => __( 'Plugins', 'malsift' ),
			'theme'  => __( 'Themes', 'malsift' ),
		);
		?>
		<div class="malsift-panel">
			<h3><?php esc_html_e( 'Reinstall from WordPress.org', 'malsift' ); ?> <span><?php esc_html_e( 'Replaces every file with a fresh official copy. Changed and extra files are backed up to quarantine first.', 'malsift' ); ?></span></h3>
			<table class="malsift-table malsift-reinstall">
				<thead><tr><th style="width:32px"><input type="checkbox" id="malsift-ri-all" aria-label="<?php esc_attr_e( 'Select all', 'malsift' ); ?>" <?php disabled( $blocked ); ?>></th><th><?php esc_html_e( 'Name', 'malsift' ); ?></th><th><?php esc_html_e( 'Version', 'malsift' ); ?></th><th><?php esc_html_e( 'Last scan', 'malsift' ); ?></th><th><?php esc_html_e( 'Status', 'malsift' ); ?></th></tr></thead>
				<tbody>
				<?php
				$current = '';
				foreach ( $items as $id => $item ) {
					if ( $item['type'] !== $current ) {
						$current = $item['type'];
						printf( '<tr class="malsift-grp"><td colspan="5">%s</td></tr>', esc_html( $groups[ $current ] ) );
					}
					$can = $item['available'] && ! $blocked;
					echo '<tr data-ri-row="' . esc_attr( $id ) . '"><td>';
					if ( $can ) {
						printf( '<input type="checkbox" class="malsift-ri" data-type="%s" data-key="%s" aria-label="%s">', esc_attr( $item['type'] ), esc_attr( $item['key'] ), esc_attr( $item['name'] ) );
					}
					echo '</td><td>' . esc_html( $item['name'] );
					if ( $item['note'] ) {
						echo '<div class="d">' . esc_html( $item['note'] ) . '</div>';
					}
					echo '</td><td>' . esc_html( $item['version'] ) . '</td><td>';
					if ( ! $result ) {
						echo '—';
					} elseif ( isset( $issues[ $id ] ) ) {
						/* translators: %d: number of files. */
						self::chip( 'bad', sprintf( _n( '%d file flagged', '%d files flagged', $issues[ $id ], 'malsift' ), $issues[ $id ] ) );
					} else {
						self::chip( 'ok', __( 'Clean', 'malsift' ) );
					}
					echo '</td><td class="malsift-ri-status">' . ( $can ? '' : esc_html__( 'Not available', 'malsift' ) ) . '</td></tr>';
				}
				?>
				</tbody>
			</table>
			<p class="malsift-ri-actions">
				<button type="button" class="button button-primary malsift-btn" id="malsift-ri-run" <?php disabled( $blocked ); ?>><?php esc_html_e( 'Reinstall selected', 'malsift' ); ?></button>
				<button type="button" class="button malsift-btn-sec" id="malsift-ri-flagged" data-ids="<?php echo esc_attr( wp_json_encode( array_keys( $issues ) ) ); ?>" <?php disabled( $blocked || ! $issues ); ?>><?php esc_html_e( 'Select items with flagged files', 'malsift' ); ?></button>
			</p>
		</div>
		<?php
	}

	/**
	 * Quarantine screen.
	 */
	private static function page_quarantine() {
		$groups = Malsift_Quarantine::groups();
		echo '<div class="malsift-panel"><h3>' . esc_html__( 'Quarantine', 'malsift' ) . ' <span>' . esc_html__( 'Files are stored compressed in a protected folder and cannot run.', 'malsift' ) . '</span></h3>';
		if ( ! $groups ) {
			echo '<p class="malsift-none">' . esc_html__( 'Quarantine is empty.', 'malsift' ) . '</p></div>';
			return;
		}
		echo '<table class="malsift-table"><thead><tr><th>' . esc_html__( 'File or folder', 'malsift' ) . '</th><th>' . esc_html__( 'Reason', 'malsift' ) . '</th><th>' . esc_html__( 'Date', 'malsift' ) . '</th><th>' . esc_html__( 'Size', 'malsift' ) . '</th><th></th></tr></thead><tbody>';
		foreach ( $groups as $id => $g ) {
			printf(
				'<tr><td><code>%s</code>%s</td><td>%s</td><td>%s</td><td>%s</td><td class="malsift-acts"><button type="button" class="malsift-a" data-q="%s" data-qop="restore">%s</button> <button type="button" class="malsift-a malsift-a-g" data-q="%s" data-qop="purge">%s</button></td></tr>',
				esc_html( $g['label'] ),
				$g['count'] > 1 ? ' <span class="d">' . esc_html( sprintf( /* translators: %d: files. */ _n( '%d file', '%d files', $g['count'], 'malsift' ), $g['count'] ) ) . '</span>' : '',
				esc_html( $g['reason'] ),
				esc_html( wp_date( 'j M Y, H:i', $g['time'] ) ),
				esc_html( size_format( $g['size'] ) ),
				esc_attr( $id ),
				esc_html__( 'Restore', 'malsift' ),
				esc_attr( $id ),
				esc_html__( 'Delete permanently', 'malsift' )
			);
		}
		echo '</tbody></table></div>';
	}

	/**
	 * History screen.
	 */
	private static function page_history() {
		echo '<div class="malsift-panel"><h3>' . esc_html__( 'Scan history', 'malsift' ) . ' <span>' . esc_html__( 'Last 30 scans', 'malsift' ) . '</span></h3>';
		self::history_table( 30 );
		echo '</div>';
	}

	/**
	 * Settings screen.
	 */
	private static function page_settings() {
		$s = Malsift_Storage::settings();
		if ( isset( $_GET['saved'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			echo '<div class="notice notice-success"><p>' . esc_html__( 'Settings saved.', 'malsift' ) . '</p></div>';
		}
		$next = wp_next_scheduled( 'malsift_daily_scan' );
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="malsift-panel malsift-settings">
			<input type="hidden" name="action" value="malsift_settings">
			<?php wp_nonce_field( 'malsift_settings' ); ?>
			<h3><?php esc_html_e( 'Settings', 'malsift' ); ?></h3>
			<table class="form-table" role="presentation">
				<tr><th scope="row"><?php esc_html_e( 'Daily scan', 'malsift' ); ?></th><td><label><input type="checkbox" name="daily_scan" value="1" <?php checked( $s['daily_scan'] ); ?>> <?php esc_html_e( 'Scan automatically every day at 03:00 (site time)', 'malsift' ); ?></label>
				<?php
				if ( $next ) {
					/* translators: %s: date. */
					echo '<p class="description">' . esc_html( sprintf( __( 'Next scan: %s', 'malsift' ), wp_date( 'j M Y, H:i', $next ) ) ) . '</p>';
				}
				?>
				</td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Email alerts', 'malsift' ); ?></th><td><label><input type="checkbox" name="email_alerts" value="1" <?php checked( $s['email_alerts'] ); ?>> <?php esc_html_e( 'Email me when a daily scan finds a threat', 'malsift' ); ?></label><p><input type="email" class="regular-text" name="alert_email" value="<?php echo esc_attr( $s['alert_email'] ); ?>"></p></td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Code editor', 'malsift' ); ?></th><td><label><input type="checkbox" name="lock_editor" value="1" <?php checked( $s['lock_editor'] ); ?>> <?php esc_html_e( 'Disable the theme and plugin code editor while Malsift is active', 'malsift' ); ?></label></td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Spam posts', 'malsift' ); ?></th><td><label><input type="checkbox" name="spam_delete_permanently" value="1" <?php checked( $s['spam_delete_permanently'] ); ?>> <?php esc_html_e( '"Fix all threats" deletes gambling spam permanently instead of moving it to the trash', 'malsift' ); ?></label></td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Largest file to scan', 'malsift' ); ?></th><td><input type="number" min="1" max="64" name="max_file_mb" value="<?php echo esc_attr( $s['max_file_mb'] ); ?>" class="small-text"> MB</td></tr>
				<tr><th scope="row"><?php esc_html_e( 'Uninstall', 'malsift' ); ?></th><td><label><input type="checkbox" name="delete_on_uninstall" value="1" <?php checked( $s['delete_on_uninstall'] ); ?>> <?php esc_html_e( 'Delete scan results, settings and quarantined files when Malsift is deleted', 'malsift' ); ?></label></td></tr>
			</table>
			<p class="description malsift-about">
			<?php
			/* translators: %s: signature version. */
			echo esc_html( sprintf( __( 'Signatures version %s. Malsift contacts WordPress.org only, to download official checksums and clean copies of core and plugin files. No site data is sent anywhere.', 'malsift' ), Malsift_Signatures::VERSION ) );
			?>
			</p>
			<?php submit_button(); ?>
		</form>
		<?php
	}

	/**
	 * Dashboard switches.
	 */
	public static function toggle() {
		$key = isset( $_POST['key'] ) ? sanitize_key( wp_unslash( $_POST['key'] ) ) : '';
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_toggle_' . $key );
		$on = ! empty( $_POST['on'] ) ? 1 : 0;
		switch ( $key ) {
			case 'login_limit':
			case 'block_enum':
				Malsift_Firewall::update( array( $key => $on ) );
				break;
			case 'uploads_php':
				$on = $on && Malsift_Firewall::server_supports_htaccess() ? 1 : 0;
				Malsift_Firewall::update( array( 'uploads_php' => $on ) );
				Malsift_Firewall::set_uploads_block( (bool) $on );
				break;
			case 'lock_editor':
				Malsift_Storage::update_settings( array( 'lock_editor' => $on ) );
				break;
			case 'daily_scan':
				Malsift_Storage::update_settings( array( 'daily_scan' => $on ) );
				if ( $on ) {
					self::schedule();
				} else {
					wp_clear_scheduled_hook( 'malsift_daily_scan' );
				}
				break;
		}
		wp_safe_redirect( self::page_url() );
		exit;
	}

	/**
	 * Firewall mode buttons.
	 */
	public static function firewall_mode() {
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_fw_mode' );
		$mode = isset( $_POST['mode'] ) ? sanitize_key( wp_unslash( $_POST['mode'] ) ) : '';
		if ( in_array( $mode, array( 'off', 'learning', 'protect' ), true ) ) {
			Malsift_Firewall::update( array( 'mode' => $mode ) );
		}
		wp_safe_redirect( add_query_arg( 'saved', '1', self::page_url( 'malsift-firewall' ) ) );
		exit;
	}

	/**
	 * Save firewall settings.
	 */
	public static function save_firewall() {
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_firewall' );
		// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- sanitised by the helpers below.
		$mode     = isset( $_POST['mode'] ) ? sanitize_key( wp_unslash( $_POST['mode'] ) ) : 'learning';
		$source   = isset( $_POST['ip_source'] ) ? sanitize_key( wp_unslash( $_POST['ip_source'] ) ) : 'auto';
		$xmlrpc   = isset( $_POST['xmlrpc'] ) ? sanitize_key( wp_unslash( $_POST['xmlrpc'] ) ) : 'no_multicall';
		$enabled  = isset( $_POST['rules'] ) ? array_map( 'sanitize_key', (array) wp_unslash( $_POST['rules'] ) ) : array();
		$allow    = isset( $_POST['allow_ips'] ) ? Malsift_Firewall::parse_ip_list( wp_unslash( $_POST['allow_ips'] ) ) : array();
		$block    = isset( $_POST['block_ips'] ) ? Malsift_Firewall::parse_ip_list( wp_unslash( $_POST['block_ips'] ) ) : array();
		// phpcs:enable
		$me       = Malsift_Firewall::client_ip();
		$block    = array_values(
			array_filter(
				$block,
				function ( $entry ) use ( $me ) {
					return ! Malsift_Firewall::ip_listed( $me, array( $entry ) );
				}
			)
		);
		$disabled = array_values( array_diff( array_keys( Malsift_Firewall::rules() ), $enabled ) );
		$uploads  = ! empty( $_POST['uploads_php'] ) && Malsift_Firewall::server_supports_htaccess();
		Malsift_Firewall::update(
			array(
				'mode'            => in_array( $mode, array( 'off', 'learning', 'protect' ), true ) ? $mode : 'learning',
				'ip_source'       => in_array( $source, array( 'auto', 'remote_addr', 'cloudflare', 'x_forwarded_for', 'x_real_ip' ), true ) ? $source : 'auto',
				'xmlrpc'          => in_array( $xmlrpc, array( 'allow', 'no_multicall', 'off' ), true ) ? $xmlrpc : 'no_multicall',
				'disabled_rules'  => $disabled,
				'allow_ips'       => $allow,
				'block_ips'       => $block,
				'login_limit'     => empty( $_POST['login_limit'] ) ? 0 : 1,
				'login_attempts'  => isset( $_POST['login_attempts'] ) ? min( 50, max( 2, absint( $_POST['login_attempts'] ) ) ) : 5,
				'login_window'    => isset( $_POST['login_window'] ) ? min( 1440, max( 1, absint( $_POST['login_window'] ) ) ) : 15,
				'lockout_minutes' => isset( $_POST['lockout_minutes'] ) ? min( 10080, max( 1, absint( $_POST['lockout_minutes'] ) ) ) : 30,
				'generic_errors'  => empty( $_POST['generic_errors'] ) ? 0 : 1,
				'block_enum'      => empty( $_POST['block_enum'] ) ? 0 : 1,
				'uploads_php'     => $uploads ? 1 : 0,
			)
		);
		Malsift_Firewall::set_uploads_block( $uploads );
		wp_safe_redirect( add_query_arg( 'saved', '1', self::page_url( 'malsift-firewall' ) ) );
		exit;
	}

	/**
	 * Quick actions from the firewall log.
	 */
	public static function firewall_event() {
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_fw_event' );
		$op  = isset( $_GET['op'] ) ? sanitize_key( wp_unslash( $_GET['op'] ) ) : '';
		$val = isset( $_GET['val'] ) ? sanitize_text_field( wp_unslash( $_GET['val'] ) ) : '';
		$s   = Malsift_Firewall::settings();
		$msg = '';
		if ( 'allow_rule' === $op && isset( Malsift_Firewall::rules()[ $val ] ) ) {
			Malsift_Firewall::update( array( 'disabled_rules' => array_values( array_unique( array_merge( $s['disabled_rules'], array( $val ) ) ) ) ) );
			$msg = 'rule';
		} elseif ( 'block_ip' === $op && filter_var( $val, FILTER_VALIDATE_IP ) && $val !== Malsift_Firewall::client_ip() ) {
			Malsift_Firewall::update( array( 'block_ips' => array_values( array_unique( array_merge( $s['block_ips'], array( $val ) ) ) ) ) );
			$msg = 'blocked';
		} elseif ( 'allow_ip' === $op && filter_var( $val, FILTER_VALIDATE_IP ) ) {
			Malsift_Firewall::update( array( 'allow_ips' => array_values( array_unique( array_merge( $s['allow_ips'], array( $val ) ) ) ) ) );
			Malsift_Firewall::unlock( $val );
			$msg = 'allowed';
		} elseif ( 'clear' === $op ) {
			Malsift_Firewall::clear_log();
			$msg = 'cleared';
		}
		wp_safe_redirect( add_query_arg( 'done', $msg, self::page_url( 'malsift-firewall' ) ) );
		exit;
	}

	/**
	 * Link for a firewall log action.
	 *
	 * @param string $op  Operation.
	 * @param string $val Value.
	 * @return string
	 */
	private static function fw_link( $op, $val = '' ) {
		return wp_nonce_url(
			add_query_arg(
				array(
					'action' => 'malsift_fw_event',
					'op'     => $op,
					'val'    => rawurlencode( $val ),
				),
				admin_url( 'admin-post.php' )
			),
			'malsift_fw_event'
		);
	}

	/**
	 * Firewall screen.
	 */
	private static function page_firewall() {
		$s       = Malsift_Firewall::settings();
		$labels  = Malsift_Firewall::labels();
		$stats   = Malsift_Firewall::stats( 7 );
		$log     = Malsift_Firewall::log();
		$me      = Malsift_Firewall::client_ip();
		$headers = Malsift_Firewall::proxy_headers();
		$htaccess = Malsift_Firewall::server_supports_htaccess();
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- display only.
		if ( isset( $_GET['saved'] ) ) {
			echo '<div class="notice notice-success"><p>' . esc_html__( 'Firewall settings saved.', 'malsift' ) . '</p></div>';
		}
		$done     = isset( $_GET['done'] ) ? sanitize_key( wp_unslash( $_GET['done'] ) ) : '';
		// phpcs:enable
		$messages = array(
			'rule'    => __( 'That rule is now switched off. You can switch it back on below.', 'malsift' ),
			'blocked' => __( 'IP address added to the block list.', 'malsift' ),
			'allowed' => __( 'IP address added to the allow list and unlocked.', 'malsift' ),
			'cleared' => __( 'Firewall log cleared.', 'malsift' ),
		);
		if ( isset( $messages[ $done ] ) ) {
			echo '<div class="notice notice-success"><p>' . esc_html( $messages[ $done ] ) . '</p></div>';
		}
		$mode_text = array(
			'off'      => array( 'warn', __( 'Off', 'malsift' ), __( 'The firewall is off. Login protection and the other options below still work.', 'malsift' ) ),
			'learning' => array( 'warn', __( 'Learning mode', 'malsift' ), __( 'Attacks are logged but not blocked. Check the log below for a few days; if nothing legitimate shows up, switch to Protect.', 'malsift' ) ),
			'protect'  => array( 'ok', __( 'Protecting', 'malsift' ), __( 'Requests that look like attacks are blocked. Logged-in editors and administrators are never blocked.', 'malsift' ) ),
		);
		$m      = $mode_text[ $s['mode'] ];
		$colors = array(
			'off'      => '#9ca3af',
			'learning' => '#d97706',
			'protect'  => '#059669',
		);
		$blocks = self::daily_blocks( 7 );
		$counts = array();
		foreach ( $log as $e ) {
			if ( $e['time'] >= time() - WEEK_IN_SECONDS && 'login_lockout' !== $e['rule'] ) {
				$counts[ $e['rule'] ] = ( isset( $counts[ $e['rule'] ] ) ? $counts[ $e['rule'] ] : 0 ) + (int) $e['count'];
			}
		}
		arsort( $counts );
		$top = key( $counts );
		?>
		<section class="malsift-panel malsift-mode">
			<div style="flex:1 1 320px;min-width:0">
				<h2><span class="malsift-mode-dot" style="background:<?php echo esc_attr( $colors[ $s['mode'] ] ); ?>;box-shadow:0 0 0 4px <?php echo esc_attr( $colors[ $s['mode'] ] ); ?>22"></span><?php echo esc_html( 'protect' === $s['mode'] ? __( 'Protecting your site', 'malsift' ) : $m[1] ); ?></h2>
				<p><?php echo esc_html( $m[2] ); ?></p>
			</div>
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="malsift-seg" role="radiogroup" aria-label="<?php esc_attr_e( 'Firewall mode', 'malsift' ); ?>">
				<input type="hidden" name="action" value="malsift_fw_mode">
				<?php wp_nonce_field( 'malsift_fw_mode' ); ?>
				<?php
				foreach ( array(
					'protect'  => __( 'Protect', 'malsift' ),
					'learning' => __( 'Learning', 'malsift' ),
					'off'      => __( 'Off', 'malsift' ),
				) as $k => $label ) {
					printf( '<button type="submit" name="mode" value="%s" role="radio" aria-checked="%s">%s</button>', esc_attr( $k ), $k === $s['mode'] ? 'true' : 'false', esc_html( $label ) );
				}
				?>
			</form>
		</section>
		<div class="malsift-cards">
			<div class="malsift-card"><div class="malsift-card-row"><div><div class="l"><?php esc_html_e( 'Attacks blocked · 7 days', 'malsift' ); ?></div><div class="n"><?php echo esc_html( number_format_i18n( $stats['blocked'] ) ); ?></div></div><?php echo self::sparkline( $blocks, __( 'Blocked attacks per day, last 7 days', 'malsift' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built from numbers. ?></div><?php if ( $stats['logged'] ) : ?><div class="s"><?php echo esc_html( sprintf( /* translators: %s: number. */ __( '%s more logged in learning mode', 'malsift' ), number_format_i18n( $stats['logged'] ) ) ); ?></div><?php endif; ?></div>
			<div class="malsift-card"><div class="l"><?php esc_html_e( 'Login lockouts · 7 days', 'malsift' ); ?></div><div class="n"><?php echo esc_html( number_format_i18n( $stats['locked'] ) ); ?></div><div class="s"><?php echo esc_html( $s['login_limit'] ? sprintf( /* translators: %d: attempts. */ __( 'After %d wrong passwords', 'malsift' ), $s['login_attempts'] ) : __( 'Login limits are off', 'malsift' ) ); ?></div></div>
			<div class="malsift-card"><div class="l"><?php esc_html_e( 'Top attack type', 'malsift' ); ?></div><div class="n" style="font-size:19px;margin-top:10px"><?php echo esc_html( $top ? ( isset( $labels[ $top ] ) ? $labels[ $top ] : $top ) : __( 'None this week', 'malsift' ) ); ?></div></div>
			<div class="malsift-card"><div class="l"><?php esc_html_e( 'Your IP address', 'malsift' ); ?></div><div class="n" style="font-size:17px;margin-top:10px"><code style="font-size:16px"><?php echo esc_html( $me ); ?></code></div><div class="s malsift-grn"><?php esc_html_e( 'Never blocked while logged in', 'malsift' ); ?></div></div>
		</div>
		<div class="malsift-panel">
			<h3><?php esc_html_e( 'Recent events', 'malsift' ); ?> <span><?php if ( $log ) : ?><a href="<?php echo esc_url( self::fw_link( 'clear' ) ); ?>"><?php esc_html_e( 'Clear log', 'malsift' ); ?></a><?php endif; ?></span></h3>
			<?php if ( ! $log ) : ?>
				<p class="malsift-none"><?php esc_html_e( 'Nothing yet. Blocked and logged attacks and login lockouts will appear here.', 'malsift' ); ?></p>
			<?php else : ?>
				<div class="malsift-scroll"><table class="malsift-table malsift-fwlog" style="min-width:760px">
					<thead><tr><th><?php esc_html_e( 'Time', 'malsift' ); ?></th><th><?php esc_html_e( 'IP address', 'malsift' ); ?></th><th><?php esc_html_e( 'What happened', 'malsift' ); ?></th><th><?php esc_html_e( 'Request', 'malsift' ); ?></th><th></th></tr></thead>
					<tbody>
					<?php
					$names = array(
						'blocked' => __( 'Blocked', 'malsift' ),
						'logged'  => __( 'Logged', 'malsift' ),
						'locked'  => __( 'Locked out', 'malsift' ),
					);
					$all   = isset( $_GET['all'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
					foreach ( array_slice( $log, 0, $all ? 200 : 15 ) as $e ) :
						$label = isset( $labels[ $e['rule'] ] ) ? $labels[ $e['rule'] ] : $e['rule'];
						?>
						<tr>
							<td><?php echo esc_html( wp_date( 'j M, H:i', $e['time'] ) ); ?><?php if ( $e['count'] > 1 ) : ?><div class="d"><?php echo esc_html( sprintf( /* translators: %d: count. */ _n( '%d time', '%d times', $e['count'], 'malsift' ), $e['count'] ) ); ?></div><?php endif; ?></td>
							<td><code><?php echo esc_html( $e['ip'] ); ?></code></td>
							<td><?php self::chip( 'logged' === $e['action'] ? 'warn' : 'bad', $names[ $e['action'] ] ); ?> <?php echo esc_html( $label ); ?>
								<?php if ( $e['snippet'] ) : ?><div class="d"><?php echo esc_html( 'login_lockout' === $e['rule'] ? sprintf( /* translators: %s: username. */ __( 'Last username tried: %s', 'malsift' ), $e['snippet'] ) : $e['field'] . ': ' . $e['snippet'] ); ?></div><?php endif; ?>
							</td>
							<td class="malsift-fwreq"><?php echo esc_html( strtoupper( $e['method'] ) . ' ' . $e['uri'] ); ?><?php if ( $e['ua'] ) : ?><div class="d"><?php echo esc_html( $e['ua'] ); ?></div><?php endif; ?></td>
							<td class="malsift-acts">
								<?php if ( isset( Malsift_Firewall::rules()[ $e['rule'] ] ) && ! in_array( $e['rule'], $s['disabled_rules'], true ) ) : ?>
									<a class="malsift-a malsift-a-g" href="<?php echo esc_url( self::fw_link( 'allow_rule', $e['rule'] ) ); ?>"><?php esc_html_e( 'Not an attack', 'malsift' ); ?></a>
								<?php endif; ?>
								<?php if ( 'login_lockout' === $e['rule'] ) : ?>
									<a class="malsift-a malsift-a-g" href="<?php echo esc_url( self::fw_link( 'allow_ip', $e['ip'] ) ); ?>"><?php esc_html_e( 'Unlock & allow', 'malsift' ); ?></a>
								<?php endif; ?>
								<?php if ( $e['ip'] !== $me && ! Malsift_Firewall::ip_listed( $e['ip'], $s['block_ips'] ) ) : ?>
									<a class="malsift-a" href="<?php echo esc_url( self::fw_link( 'block_ip', $e['ip'] ) ); ?>"><?php esc_html_e( 'Block IP', 'malsift' ); ?></a>
								<?php endif; ?>
							</td>
						</tr>
					<?php endforeach; ?>
					</tbody>
				</table></div>
				<?php if ( ! $all && count( $log ) > 15 ) : ?>
					<p class="malsift-more"><a href="<?php echo esc_url( add_query_arg( 'all', '1', self::page_url( 'malsift-firewall' ) ) ); ?>"><?php echo esc_html( sprintf( /* translators: %d: number of events. */ __( 'Show all %d events', 'malsift' ), count( $log ) ) ); ?></a></p>
				<?php endif; ?>
			<?php endif; ?>
		</div>

		<h2 class="malsift-section-title" style="font-size:16px;font-weight:600;margin:28px 0 12px"><?php esc_html_e( 'Rules and settings', 'malsift' ); ?></h2>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="malsift_firewall">
			<?php wp_nonce_field( 'malsift_firewall' ); ?>
			<div class="malsift-grid">
				<div>
					<div class="malsift-panel malsift-settings">
						<h3><?php esc_html_e( 'Request firewall', 'malsift' ); ?></h3>
						<table class="form-table" role="presentation">
							<tr><th scope="row"><?php esc_html_e( 'Mode', 'malsift' ); ?></th><td>
								<fieldset>
									<label><input type="radio" name="mode" value="protect" <?php checked( 'protect', $s['mode'] ); ?>> <strong><?php esc_html_e( 'Protect', 'malsift' ); ?></strong> — <?php esc_html_e( 'block attacks', 'malsift' ); ?></label><br>
									<label><input type="radio" name="mode" value="learning" <?php checked( 'learning', $s['mode'] ); ?>> <strong><?php esc_html_e( 'Learning', 'malsift' ); ?></strong> — <?php esc_html_e( 'log attacks without blocking (recommended for the first few days)', 'malsift' ); ?></label><br>
									<label><input type="radio" name="mode" value="off" <?php checked( 'off', $s['mode'] ); ?>> <strong><?php esc_html_e( 'Off', 'malsift' ); ?></strong></label>
								</fieldset>
							</td></tr>
							<tr><th scope="row"><?php esc_html_e( 'Rules', 'malsift' ); ?></th><td>
								<fieldset>
								<?php foreach ( array_keys( Malsift_Firewall::rules() ) as $id ) : ?>
									<label><input type="checkbox" name="rules[]" value="<?php echo esc_attr( $id ); ?>" <?php checked( ! in_array( $id, $s['disabled_rules'], true ) ); ?>> <?php echo esc_html( isset( $labels[ $id ] ) ? $labels[ $id ] : $id ); ?></label><br>
								<?php endforeach; ?>
								</fieldset>
								<p class="description"><?php esc_html_e( 'Untick a rule only if it blocks something legitimate on your site.', 'malsift' ); ?></p>
							</td></tr>
						</table>
					</div>
					<div class="malsift-panel malsift-settings">
						<h3><?php esc_html_e( 'Login protection', 'malsift' ); ?></h3>
						<table class="form-table" role="presentation">
							<tr><th scope="row"><?php esc_html_e( 'Limit login attempts', 'malsift' ); ?></th><td>
								<label><input type="checkbox" name="login_limit" value="1" <?php checked( $s['login_limit'] ); ?>> <?php esc_html_e( 'Lock out an IP address after too many failed logins (also covers XML-RPC)', 'malsift' ); ?></label>
								<p class="malsift-inline">
									<?php
									printf(
										/* translators: 1: attempts field, 2: minutes field, 3: lockout minutes field. */
										esc_html__( 'Lock out after %1$s failures within %2$s minutes, for %3$s minutes.', 'malsift' ),
										'<input type="number" min="2" max="50" class="small-text" name="login_attempts" value="' . esc_attr( $s['login_attempts'] ) . '">',
										'<input type="number" min="1" max="1440" class="small-text" name="login_window" value="' . esc_attr( $s['login_window'] ) . '">',
										'<input type="number" min="1" max="10080" class="small-text" name="lockout_minutes" value="' . esc_attr( $s['lockout_minutes'] ) . '">'
									); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- inputs escaped above.
									?>
								</p>
							</td></tr>
							<tr><th scope="row"><?php esc_html_e( 'Login error messages', 'malsift' ); ?></th><td><label><input type="checkbox" name="generic_errors" value="1" <?php checked( $s['generic_errors'] ); ?>> <?php esc_html_e( 'Show the same message for a wrong username and a wrong password', 'malsift' ); ?></label></td></tr>
							<tr><th scope="row"><?php esc_html_e( 'Usernames', 'malsift' ); ?></th><td><label><input type="checkbox" name="block_enum" value="1" <?php checked( $s['block_enum'] ); ?>> <?php esc_html_e( 'Stop visitors from listing usernames (author scans, the users REST endpoint and the users sitemap)', 'malsift' ); ?></label></td></tr>
							<tr><th scope="row"><?php esc_html_e( 'XML-RPC', 'malsift' ); ?></th><td>
								<select name="xmlrpc">
									<option value="no_multicall" <?php selected( 'no_multicall', $s['xmlrpc'] ); ?>><?php esc_html_e( 'Block abuse (multi-call password guessing and pingbacks)', 'malsift' ); ?></option>
									<option value="off" <?php selected( 'off', $s['xmlrpc'] ); ?>><?php esc_html_e( 'Turn off completely', 'malsift' ); ?></option>
									<option value="allow" <?php selected( 'allow', $s['xmlrpc'] ); ?>><?php esc_html_e( 'Leave unchanged', 'malsift' ); ?></option>
								</select>
								<p class="description"><?php esc_html_e( 'Turning XML-RPC off can stop the WordPress mobile app and some older services from connecting.', 'malsift' ); ?></p>
							</td></tr>
						</table>
					</div>
				</div>
				<div>
					<div class="malsift-panel malsift-settings">
						<h3><?php esc_html_e( 'Uploads folder', 'malsift' ); ?></h3>
						<table class="form-table" role="presentation">
							<tr><td>
								<label><input type="checkbox" name="uploads_php" value="1" <?php checked( $s['uploads_php'] && $htaccess ); ?> <?php disabled( ! $htaccess ); ?>> <?php esc_html_e( 'Block PHP files from running in the uploads folder', 'malsift' ); ?></label>
								<p class="description">
								<?php
								echo $htaccess
									? esc_html__( 'Adds a small rule to wp-content/uploads/.htaccess. Even if an attacker uploads a webshell, it cannot run. The rule is removed when Malsift is deactivated.', 'malsift' )
									: esc_html__( 'Your server does not read .htaccess files (for example Nginx). Ask your host to deny PHP execution in wp-content/uploads.', 'malsift' );
								?>
								</p>
							</td></tr>
						</table>
					</div>
					<div class="malsift-panel malsift-settings">
						<h3><?php esc_html_e( 'Visitor IP addresses', 'malsift' ); ?></h3>
						<table class="form-table" role="presentation">
							<tr><td>
								<p><?php echo esc_html( sprintf( /* translators: %s: IP address. */ __( 'Your IP address as Malsift sees it: %s', 'malsift' ), $me ) ); ?></p>
								<select name="ip_source">
									<option value="auto" <?php selected( 'auto', $s['ip_source'] ); ?>><?php esc_html_e( 'Automatic (recommended)', 'malsift' ); ?></option>
									<option value="remote_addr" <?php selected( 'remote_addr', $s['ip_source'] ); ?>><?php esc_html_e( 'Direct connection (REMOTE_ADDR)', 'malsift' ); ?></option>
									<option value="cloudflare" <?php selected( 'cloudflare', $s['ip_source'] ); ?>>Cloudflare (CF-Connecting-IP)</option>
									<option value="x_forwarded_for" <?php selected( 'x_forwarded_for', $s['ip_source'] ); ?>>X-Forwarded-For</option>
									<option value="x_real_ip" <?php selected( 'x_real_ip', $s['ip_source'] ); ?>>X-Real-IP</option>
								</select>
								<?php if ( $headers ) : ?>
									<p class="description"><?php echo esc_html( sprintf( /* translators: %s: header list. */ __( 'Proxy headers on this request: %s', 'malsift' ), implode( ', ', array_map( function ( $k, $v ) { return $k . ' = ' . $v; }, array_keys( $headers ), $headers ) ) ) ); ?></p>
								<?php endif; ?>
								<p class="description"><?php esc_html_e( 'Automatic only trusts proxy headers when the request comes from Cloudflare or from a proxy on your own network, and reads them so the address added by your proxy is used, not one supplied by the visitor. If your site sits behind a proxy that does not add X-Forwarded-For, choose Direct connection. Only change this if your IP above is wrong.', 'malsift' ); ?></p>
							</td></tr>
						</table>
					</div>
					<div class="malsift-panel malsift-settings">
						<h3><?php esc_html_e( 'Allow and block lists', 'malsift' ); ?></h3>
						<table class="form-table" role="presentation">
							<tr><td>
								<label for="malsift-allow"><strong><?php esc_html_e( 'Always allow', 'malsift' ); ?></strong></label>
								<textarea id="malsift-allow" name="allow_ips" rows="3" class="large-text code" placeholder="203.0.113.10"><?php echo esc_textarea( implode( "\n", $s['allow_ips'] ) ); ?></textarea>
								<label for="malsift-block"><strong><?php esc_html_e( 'Always block', 'malsift' ); ?></strong></label>
								<textarea id="malsift-block" name="block_ips" rows="3" class="large-text code" placeholder="198.51.100.0/24"><?php echo esc_textarea( implode( "\n", $s['block_ips'] ) ); ?></textarea>
								<p class="description"><?php esc_html_e( 'One IP address or range (CIDR) per line. Your own IP address is never added to the block list.', 'malsift' ); ?></p>
							</td></tr>
						</table>
					</div>
				</div>
			</div>
			<p><?php submit_button( __( 'Save firewall settings', 'malsift' ), 'primary', 'submit', false ); ?></p>
		</form>

		<?php
		/**
		 * Fires at the end of the Firewall screen.
		 */
		do_action( 'malsift_firewall_page_after' );
	}

	/**
	 * Printable report (save as PDF from the browser).
	 */
	public static function report() {
		if ( ! current_user_can( self::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'malsift' ) );
		}
		check_admin_referer( 'malsift_report' );
		$result = get_option( Malsift_Storage::OPT_RESULT );
		if ( ! is_array( $result ) ) {
			wp_die( esc_html__( 'Run a scan first.', 'malsift' ) );
		}
		$site = wp_parse_url( home_url(), PHP_URL_HOST );
		wp_register_style( 'malsift-report', MALSIFT_URL . 'assets/report.css', array(), MALSIFT_VERSION );
		wp_register_script( 'malsift-report', MALSIFT_URL . 'assets/report.js', array(), MALSIFT_VERSION, true );
		?>
		<!doctype html><html><head><meta charset="utf-8"><title><?php echo esc_html( sprintf( /* translators: %s: site host. */ __( 'Security scan report – %s', 'malsift' ), $site ) ); ?></title>
		<?php wp_print_styles( 'malsift-report' ); ?></head>
		<body>
		<button type="button" id="malsift-print"><?php esc_html_e( 'Print / Save as PDF', 'malsift' ); ?></button>
		<h1><?php echo esc_html( sprintf( /* translators: %s: site host. */ __( 'Security scan report – %s', 'malsift' ), $site ) ); ?></h1>
		<div class="m"><?php echo esc_html( sprintf( /* translators: 1: date, 2: version. */ __( 'Scanned %1$s with Malsift %2$s', 'malsift' ), wp_date( 'j F Y, H:i T', $result['time'] ), MALSIFT_VERSION ) ); ?></div>
		<div class="sum">
			<div><?php esc_html_e( 'Security score', 'malsift' ); ?><b><?php echo esc_html( $result['score'] ); ?>/100</b></div>
			<div><?php esc_html_e( 'Open threats', 'malsift' ); ?><b class="bad"><?php echo esc_html( $result['counts']['threat'] ); ?></b></div>
			<div><?php esc_html_e( 'To review', 'malsift' ); ?><b class="warn"><?php echo esc_html( $result['counts']['warning'] ); ?></b></div>
			<div><?php esc_html_e( 'Files checked', 'malsift' ); ?><b><?php echo esc_html( number_format_i18n( $result['stats']['files_verified'] + $result['stats']['files_scanned'] ) ); ?></b></div>
		</div>
		<h2><?php esc_html_e( 'Checks', 'malsift' ); ?></h2>
		<table><tr><th><?php esc_html_e( 'Check', 'malsift' ); ?></th><th><?php esc_html_e( 'Result', 'malsift' ); ?></th></tr>
		<?php foreach ( Malsift_Scanner::checks() as $key => $def ) : ?>
			<?php
			$check = isset( $result['checks'][ $key ] ) ? $result['checks'][ $key ] : array(
				'status' => 'info',
				'label'  => __( 'Not checked yet', 'malsift' ),
			);
			?>
			<tr><td><?php echo esc_html( $def[1] ); ?><div class="m"><?php echo esc_html( $def[2] ); ?></div></td><td class="<?php echo esc_attr( $check['status'] ); ?>"><?php echo esc_html( $check['label'] ); ?></td></tr>
		<?php endforeach; ?>
		</table>
		<h2><?php esc_html_e( 'Findings', 'malsift' ); ?></h2>
		<table><tr><th><?php esc_html_e( 'Severity', 'malsift' ); ?></th><th><?php esc_html_e( 'Finding', 'malsift' ); ?></th><th><?php esc_html_e( 'Status', 'malsift' ); ?></th></tr>
		<?php
		$any = false;
		foreach ( $result['findings'] as $f ) {
			if ( 'info' === $f['severity'] ) {
				continue;
			}
			$any    = true;
			$status = ! empty( $f['resolved'] ) ? __( 'Fixed', 'malsift' ) : ( ! empty( $f['ignored'] ) ? __( 'Marked as known', 'malsift' ) : __( 'Open', 'malsift' ) );
			$target = self::target_text( $f );
			printf(
				'<tr><td class="%s">%s</td><td>%s%s</td><td>%s</td></tr>',
				esc_attr( 'threat' === $f['severity'] ? 'bad' : 'warn' ),
				esc_html( 'threat' === $f['severity'] ? __( 'Threat', 'malsift' ) : __( 'Warning', 'malsift' ) ),
				esc_html( $f['title'] ),
				$target ? '<br><code>' . esc_html( $target ) . '</code>' : '',
				esc_html( $status )
			);
		}
		if ( ! $any ) {
			echo '<tr><td colspan="3" class="ok">' . esc_html__( 'No issues found.', 'malsift' ) . '</td></tr>';
		}
		?>
		</table>
		<?php wp_print_scripts( 'malsift-report' ); ?>
		</body></html>
		<?php
		exit;
	}
}