<?php
/**
 * Catalog of every check: labels, explanations, remediation and method.
 * Also defines severity/classification vocabularies.
 *
 * @package SiteAuditHub
 */

namespace SiteAuditHub;

defined( 'ABSPATH' ) || exit;

/**
 * Check catalog.
 */
class Catalog {

	/**
	 * Cached definitions.
	 *
	 * @var array|null
	 */
	private static $checks = null;

	/**
	 * Integrity checks that point to possible malware, injected code or a
	 * backdoor. Everything else from the integrity scan is a note.
	 *
	 * @return array
	 */
	public static function threat_checks() {
		return array(
			'int_signature',      // Known web shell / backdoor code.
			'int_suspicious',     // Obfuscated or dynamic-execution code.
			'int_uploader',       // Upload script without security checks.
			'int_disguised',      // photo.jpg.php style files.
			'int_hidden_php',     // Hidden .php files.
			'int_uploads_exec',   // Executable files in uploads.
			'int_htaccess',       // Malicious .htaccess rules.
			'int_core_mismatch',  // Modified WordPress core file.
			'int_plugin_mismatch', // Modified WordPress.org plugin file.
			'int_core_unexpected', // Extra file hidden in wp-admin / wp-includes.
			'int_db_script',      // Injected script in posts.
			'int_db_iframe',      // Hidden iframe in posts.
			'int_db_option',      // Code hidden in settings.
			'int_new_file',       // New code file since the last scan.
			'int_modified',       // File edited without an update.
			'int_root_unexpected', // Unknown PHP file in the site root.
			'int_root_file',      // Any other unknown file in the site root.
			'int_root_dir',       // Unknown folder in the site root.
			'int_content_php',    // Unknown PHP file directly in wp-content.
			'int_plugin_extra',   // PHP file that is not part of the plugin's release.
		);
	}

	/**
	 * Integrity checks that are notes rather than threats.
	 *
	 * @return array
	 */
	public static function integrity_note_checks() {
		$notes = array();
		foreach ( array_keys( self::checks() ) as $id ) {
			if ( 0 === strpos( $id, 'int_' ) && ! in_array( $id, self::threat_checks(), true ) ) {
				$notes[] = $id;
			}
		}
		return $notes;
	}

	/**
	 * Severity labels (ordered).
	 *
	 * @return array
	 */
	public static function severities() {
		return array(
			'critical' => __( 'Critical', 'siteaudithub' ),
			'high'     => __( 'High', 'siteaudithub' ),
			'medium'   => __( 'Medium', 'siteaudithub' ),
			'low'      => __( 'Low', 'siteaudithub' ),
			'info'     => __( 'Informational', 'siteaudithub' ),
		);
	}

	/**
	 * Classification labels.
	 *
	 * @return array
	 */
	public static function classifications() {
		return array(
			'confirmed'          => __( 'Confirmed issue', 'siteaudithub' ),
			'potential'          => __( 'Potential issue', 'siteaudithub' ),
			'manual'             => __( 'Manual review required', 'siteaudithub' ),
			'failed'             => __( 'Scan failed', 'siteaudithub' ),
			'inaccessible'       => __( 'URL inaccessible', 'siteaudithub' ),
			'unsupported'        => __( 'Check unsupported', 'siteaudithub' ),
			'unavailable'        => __( 'Information unavailable', 'siteaudithub' ),
			'not_evaluated'      => __( 'Not evaluated', 'siteaudithub' ),
			'integrity_mismatch' => __( 'Confirmed integrity mismatch', 'siteaudithub' ),
			'signature_match'    => __( 'Known signature match', 'siteaudithub' ),
			'suspicious'         => __( 'Suspicious code, needs review', 'siteaudithub' ),
			'unverified'         => __( 'Unverified file', 'siteaudithub' ),
		);
	}

	/**
	 * Module labels.
	 *
	 * @return array
	 */
	public static function modules() {
		return array(
			'seo'       => __( 'SEO', 'siteaudithub' ),
			'a11y'      => __( 'Accessibility', 'siteaudithub' ),
			'health'    => __( 'Technical Health', 'siteaudithub' ),
			'plugins'   => __( 'Plugins', 'siteaudithub' ),
			'integrity' => __( 'Malware & Integrity', 'siteaudithub' ),
		);
	}

	/**
	 * Label helper.
	 *
	 * @param string $type  severity|classification|module.
	 * @param string $value Code.
	 * @return string
	 */
	public static function label( $type, $value ) {
		$map = 'severity' === $type ? self::severities() : ( 'module' === $type ? self::modules() : self::classifications() );
		return isset( $map[ $value ] ) ? $map[ $value ] : ucfirst( (string) $value );
	}

	/**
	 * All check definitions.
	 *
	 * Each: module, severity, class(ification), title, desc, fix, method.
	 *
	 * @return array
	 */
	public static function checks() {
		if ( null !== self::$checks ) {
			return self::$checks;
		}
		$c = array();

		$add = static function ( $id, $module, $severity, $class, $title, $desc, $fix, $method ) use ( &$c ) {
			$c[ $id ] = compact( 'module', 'severity', 'class', 'title', 'desc', 'fix', 'method' );
		};

		$html = __( 'Parsed the HTML returned to an anonymous visitor (no JavaScript executed).', 'siteaudithub' );

		/* SEO ------------------------------------------------------------ */
		$add( 'seo_http_error', 'seo', 'high', 'confirmed', __( 'Page returns an HTTP error', 'siteaudithub' ), __( 'The URL answered with a 4xx or 5xx status code, so visitors and search engines cannot reach the content.', 'siteaudithub' ), __( 'Restore the content, fix the server error, or redirect the URL to the most relevant live page and update internal links.', 'siteaudithub' ), __( 'HTTP status code of the response.', 'siteaudithub' ) );
		$add( 'seo_redirect_loop', 'seo', 'high', 'confirmed', __( 'Redirect loop', 'siteaudithub' ), __( 'Following the redirects returns to a URL that was already visited, so the page never loads.', 'siteaudithub' ), __( 'Check redirect rules (redirect plugins, .htaccess, server config, HTTPS/www settings) and remove the circular rule.', 'siteaudithub' ), __( 'Redirects followed hop by hop.', 'siteaudithub' ) );
		$add( 'seo_redirect_chain', 'seo', 'low', 'potential', __( 'Redirect chain', 'siteaudithub' ), __( 'The URL passes through two or more redirects before reaching the final page. Chains add latency and can dilute crawl efficiency.', 'siteaudithub' ), __( 'Point the first redirect (and internal links) straight at the final destination.', 'siteaudithub' ), __( 'Redirects followed hop by hop.', 'siteaudithub' ) );
		$add( 'seo_title_missing', 'seo', 'high', 'confirmed', __( 'Missing page title', 'siteaudithub' ), __( 'The HTML has no <title> or it is empty. Titles are used in search results, browser tabs and by assistive technology.', 'siteaudithub' ), __( 'Set a descriptive, unique title in your theme or SEO plugin.', 'siteaudithub' ), $html );
		$add( 'seo_title_multiple', 'seo', 'low', 'confirmed', __( 'Multiple <title> elements', 'siteaudithub' ), __( 'More than one <title> element was found. Browsers and search engines generally use only one, so the other is ignored.', 'siteaudithub' ), __( 'Make sure only one component (theme or SEO plugin) outputs the title tag.', 'siteaudithub' ), $html );
		$add( 'seo_title_length', 'seo', 'low', 'potential', __( 'Title is very short or very long', 'siteaudithub' ), __( 'The title is under 15 or over 65 characters. Long titles are often truncated in search results; very short titles may not describe the page well. This is a guideline, not an error.', 'siteaudithub' ), __( 'Consider a concise, descriptive title that reflects the page content.', 'siteaudithub' ), $html );
		$add( 'seo_title_duplicate', 'seo', 'medium', 'confirmed', __( 'Duplicate title', 'siteaudithub' ), __( 'Several scanned URLs share exactly the same title, which makes them harder to distinguish in search results.', 'siteaudithub' ), __( 'Give each page a unique title describing its specific content.', 'siteaudithub' ), __( 'Compared titles across all successfully scanned URLs.', 'siteaudithub' ) );
		$add( 'seo_desc_missing', 'seo', 'low', 'confirmed', __( 'Missing meta description', 'siteaudithub' ), __( 'No meta description was found in the HTML. Search engines may then generate a snippet automatically.', 'siteaudithub' ), __( 'Write a short summary of the page in your SEO plugin or theme.', 'siteaudithub' ), $html );
		$add( 'seo_desc_multiple', 'seo', 'low', 'confirmed', __( 'Multiple meta descriptions', 'siteaudithub' ), __( 'More than one meta description tag is output, usually because two plugins or a theme and a plugin both add one.', 'siteaudithub' ), __( 'Disable meta description output in all but one component.', 'siteaudithub' ), $html );
		$add( 'seo_desc_duplicate', 'seo', 'low', 'confirmed', __( 'Duplicate meta description', 'siteaudithub' ), __( 'Several scanned URLs share exactly the same meta description.', 'siteaudithub' ), __( 'Write a distinct description for each important page.', 'siteaudithub' ), __( 'Compared descriptions across all successfully scanned URLs.', 'siteaudithub' ) );
		$add( 'seo_canonical_missing', 'seo', 'low', 'potential', __( 'No canonical tag', 'siteaudithub' ), __( 'The page does not declare a canonical URL. Canonicals help search engines choose the preferred URL when duplicates exist.', 'siteaudithub' ), __( 'Most SEO plugins and WordPress core add a canonical for singular content; check your theme or SEO plugin configuration.', 'siteaudithub' ), $html );
		$add( 'seo_canonical_multiple', 'seo', 'medium', 'confirmed', __( 'Multiple canonical tags', 'siteaudithub' ), __( 'More than one canonical link was found. Conflicting canonicals may be ignored by search engines.', 'siteaudithub' ), __( 'Keep a single canonical output (typically from your SEO plugin) and disable the others.', 'siteaudithub' ), $html );
		$add( 'seo_canonical_other', 'seo', 'info', 'manual', __( 'Canonical points to a different URL', 'siteaudithub' ), __( 'The canonical tag names another URL as the preferred version. This is often intentional (pagination, parameters, syndicated content) but should be verified.', 'siteaudithub' ), __( 'Confirm the canonical target is the version you want indexed.', 'siteaudithub' ), $html );
		$add( 'seo_canonical_broken', 'seo', 'medium', 'confirmed', __( 'Canonical target is broken or redirects', 'siteaudithub' ), __( 'The canonical URL itself returned an error, redirected, or is marked noindex in this scan.', 'siteaudithub' ), __( 'Point the canonical at a live, indexable URL that returns status 200.', 'siteaudithub' ), __( 'Matched canonical targets against scanned URL results.', 'siteaudithub' ) );
		$add( 'seo_noindex', 'seo', 'info', 'manual', __( 'Page is marked noindex', 'siteaudithub' ), __( 'A robots meta tag or X-Robots-Tag header asks search engines not to index this URL. This is correct for private or utility pages but harmful if unintended.', 'siteaudithub' ), __( 'Verify this page should be excluded from search results; otherwise remove the noindex directive in your SEO plugin.', 'siteaudithub' ), __( 'Robots meta tags and X-Robots-Tag response header.', 'siteaudithub' ) );
		$add( 'seo_noindex_in_sitemap', 'seo', 'medium', 'potential', __( 'Noindex page listed in sitemap', 'siteaudithub' ), __( 'The URL is in the XML sitemap but also marked noindex, which sends mixed signals to search engines.', 'siteaudithub' ), __( 'Either remove the noindex directive or exclude the URL from the sitemap.', 'siteaudithub' ), __( 'Compared sitemap entries with robots directives.', 'siteaudithub' ) );
		$add( 'seo_robots_blocked', 'seo', 'medium', 'potential', __( 'URL disallowed by robots.txt', 'siteaudithub' ), __( 'A Disallow rule for all user agents matches this URL, although it is published content or listed in the sitemap.', 'siteaudithub' ), __( 'If the page should be crawled, adjust robots.txt. If not, also remove it from the sitemap.', 'siteaudithub' ), __( 'Simplified robots.txt matching for "User-agent: *" groups (Allow/Disallow, * and $ wildcards).', 'siteaudithub' ) );
		$add( 'seo_search_discouraged', 'seo', 'high', 'confirmed', __( 'Search engine visibility is discouraged', 'siteaudithub' ), __( 'Settings → Reading → "Discourage search engines from indexing this site" is enabled.', 'siteaudithub' ), __( 'Disable the option when the site is ready for public search traffic (keep it on for staging sites).', 'siteaudithub' ), __( 'WordPress blog_public option.', 'siteaudithub' ) );
		$add( 'seo_h1_missing', 'seo', 'medium', 'potential', __( 'No H1 heading', 'siteaudithub' ), __( 'The page has no H1. A clear main heading helps visitors, assistive technology and search engines understand the topic.', 'siteaudithub' ), __( 'Add one main heading that describes the page (often the post or page title).', 'siteaudithub' ), $html );
		$add( 'seo_h1_multiple', 'seo', 'info', 'manual', __( 'Multiple H1 headings', 'siteaudithub' ), __( 'More than one H1 was found. This is valid HTML and is not by itself a ranking penalty, but a single clear main heading usually makes structure easier to follow.', 'siteaudithub' ), __( 'Review whether the extra H1s (often logos or widgets) should be lower-level headings.', 'siteaudithub' ), $html );
		$add( 'seo_img_alt', 'seo', 'low', 'confirmed', __( 'Images without alt attributes', 'siteaudithub' ), __( 'Some images have no alt attribute, so search engines get less context about them. See the Accessibility module for the user impact.', 'siteaudithub' ), __( 'Add descriptive alt text to meaningful images and alt="" to decorative ones.', 'siteaudithub' ), $html );
		$add( 'seo_broken_internal_link', 'seo', 'high', 'confirmed', __( 'Broken internal link', 'siteaudithub' ), __( 'This page links to an internal URL that returned an error or could not be loaded during this scan.', 'siteaudithub' ), __( 'Update or remove the link, or restore/redirect the target.', 'siteaudithub' ), __( 'Matched outbound links against scanned URL results.', 'siteaudithub' ) );
		$add( 'seo_internal_link_redirect', 'seo', 'low', 'potential', __( 'Internal link points to a redirect', 'siteaudithub' ), __( 'The link target redirects elsewhere. Linking directly to the final URL avoids an extra request.', 'siteaudithub' ), __( 'Update the link to the final destination URL.', 'siteaudithub' ), __( 'Matched outbound links against scanned URL results.', 'siteaudithub' ) );
		$add( 'seo_broken_external_link', 'seo', 'medium', 'confirmed', __( 'Broken external link', 'siteaudithub' ), __( 'An external link returned 404/410 or a server error during this scan.', 'siteaudithub' ), __( 'Update the link to a working resource or remove it.', 'siteaudithub' ), __( 'HEAD (falling back to GET) request to each unique external URL, when external checking is enabled.', 'siteaudithub' ) );
		$add( 'seo_external_link_blocked', 'seo', 'info', 'manual', __( 'External link could not be verified', 'siteaudithub' ), __( 'The external site refused automated requests (for example 401, 403 or 429) or timed out. The link may work fine for real visitors.', 'siteaudithub' ), __( 'Open the link in a browser to confirm it works.', 'siteaudithub' ), __( 'HEAD/GET request to the external URL.', 'siteaudithub' ) );
		$add( 'seo_sitemap_missing', 'seo', 'medium', 'potential', __( 'No XML sitemap found', 'siteaudithub' ), __( 'Neither /wp-sitemap.xml, /sitemap_index.xml nor /sitemap.xml returned a parseable sitemap.', 'siteaudithub' ), __( 'Enable the WordPress core sitemap or your SEO plugin sitemap and reference it in robots.txt.', 'siteaudithub' ), __( 'Requested common sitemap locations.', 'siteaudithub' ) );
		$add( 'seo_sitemap_coverage', 'seo', 'low', 'potential', __( 'Published content missing from the sitemap', 'siteaudithub' ), __( 'Some published URLs discovered through WordPress were not found in the sitemap.', 'siteaudithub' ), __( 'Check sitemap settings in your SEO plugin (excluded post types, noindex settings).', 'siteaudithub' ), __( 'Compared WordPress-discovered URLs with sitemap entries (within the scan limits).', 'siteaudithub' ) );
		$add( 'seo_thin_content', 'seo', 'low', 'potential', __( 'Low word count', 'siteaudithub' ), __( 'The page has fewer visible words than the configured threshold. Short pages are not necessarily a problem (contact pages, galleries), so treat this as a signal to review.', 'siteaudithub' ), __( 'Consider whether the page fully answers its purpose; expand, merge or noindex it if appropriate.', 'siteaudithub' ), __( 'Counted words in visible body text, excluding scripts and styles.', 'siteaudithub' ) );
		$add( 'seo_duplicate_content', 'seo', 'medium', 'potential', __( 'Possible duplicate content', 'siteaudithub' ), __( 'The visible text of this page is identical to another scanned URL.', 'siteaudithub' ), __( 'Consolidate duplicates, use canonical tags, or differentiate the content.', 'siteaudithub' ), __( 'Exact hash of normalized visible text (pages with 50+ words).', 'siteaudithub' ) );
		$add( 'seo_orphan_page', 'seo', 'low', 'potential', __( 'No internal links found to this page', 'siteaudithub' ), __( 'None of the scanned pages link to this URL. Pages without internal links are harder for visitors and crawlers to find. Links from pages outside the scan scope are not counted.', 'siteaudithub' ), __( 'Link to the page from related content or navigation.', 'siteaudithub' ), __( 'Inbound link count across scanned pages.', 'siteaudithub' ) );
		$add( 'seo_mixed_content', 'seo', 'medium', 'confirmed', __( 'Mixed content on HTTPS page', 'siteaudithub' ), __( 'The HTTPS page loads images, scripts, frames or stylesheets over insecure http://. Browsers may block them or show warnings.', 'siteaudithub' ), __( 'Update the resource URLs to https:// (a search-replace on the database is often needed after an HTTPS migration).', 'siteaudithub' ), $html );
		$add( 'seo_jsonld_invalid', 'seo', 'medium', 'confirmed', __( 'Invalid structured data (JSON-LD)', 'siteaudithub' ), __( 'A JSON-LD script block could not be parsed as JSON, so it will be ignored.', 'siteaudithub' ), __( 'Fix the plugin or template generating the structured data, then validate it with a structured data testing tool.', 'siteaudithub' ), __( 'JSON parse of each application/ld+json block.', 'siteaudithub' ) );
		$add( 'seo_meta_refresh', 'seo', 'low', 'potential', __( 'Meta refresh redirect', 'siteaudithub' ), __( 'The page uses a meta refresh. Server-side redirects are clearer for visitors and search engines.', 'siteaudithub' ), __( 'Replace with a 301/302 server redirect where appropriate.', 'siteaudithub' ), $html );
		$add( 'seo_js_rendered', 'seo', 'info', 'manual', __( 'Content may be rendered by JavaScript', 'siteaudithub' ), __( 'Very little text was found in the HTML while the page loads many scripts. SiteAuditHub does not execute JavaScript, so content added by scripts was not evaluated.', 'siteaudithub' ), __( 'Review this page manually in a browser and with a rendering-capable tool.', 'siteaudithub' ), $html );

		/* Accessibility --------------------------------------------------- */
		$add( 'a11y_img_alt', 'a11y', 'medium', 'confirmed', __( 'Images missing alternative text', 'siteaudithub' ), __( 'Images without an alt attribute are announced by file name or skipped by screen readers.', 'siteaudithub' ), __( 'Add alt text describing the purpose of each meaningful image; use alt="" for purely decorative images.', 'siteaudithub' ), $html );
		$add( 'a11y_button_name', 'a11y', 'high', 'confirmed', __( 'Buttons without an accessible name', 'siteaudithub' ), __( 'Buttons with no text, aria-label or title are announced only as "button".', 'siteaudithub' ), __( 'Add visible text or an aria-label describing the action (e.g. "Close menu").', 'siteaudithub' ), $html );
		$add( 'a11y_link_name', 'a11y', 'high', 'confirmed', __( 'Links without an accessible name', 'siteaudithub' ), __( 'Links with no text (often icon-only links or images without alt) cannot be understood by screen reader users.', 'siteaudithub' ), __( 'Add link text, an aria-label, or alt text on the linked image.', 'siteaudithub' ), $html );
		$add( 'a11y_link_generic', 'a11y', 'low', 'potential', __( 'Non-descriptive link text', 'siteaudithub' ), __( 'Links such as "click here" or "read more" do not make sense out of context, for example in a screen reader links list.', 'siteaudithub' ), __( 'Use link text that describes the destination, or add visually hidden context.', 'siteaudithub' ), $html );
		$add( 'a11y_lang_missing', 'a11y', 'medium', 'confirmed', __( 'Missing document language', 'siteaudithub' ), __( 'The <html> element has no lang attribute, so screen readers may use the wrong pronunciation.', 'siteaudithub' ), __( 'Ensure your theme outputs language_attributes() on the <html> tag.', 'siteaudithub' ), $html );
		$add( 'a11y_title_missing', 'a11y', 'medium', 'confirmed', __( 'Missing document title', 'siteaudithub' ), __( 'The page has no title, which is the first thing screen readers announce and what identifies the browser tab.', 'siteaudithub' ), __( 'Make sure the theme supports title-tag and the page has a title.', 'siteaudithub' ), $html );
		$add( 'a11y_heading_skip', 'a11y', 'low', 'potential', __( 'Skipped heading levels', 'siteaudithub' ), __( 'Heading levels jump (for example H2 to H4). Screen reader users navigate by headings, and gaps can suggest missing content.', 'siteaudithub' ), __( 'Use heading levels in order to reflect the content outline; style them with CSS instead of picking levels for size.', 'siteaudithub' ), $html );
		$add( 'a11y_heading_empty', 'a11y', 'low', 'confirmed', __( 'Empty headings', 'siteaudithub' ), __( 'Headings without text are announced as empty headings.', 'siteaudithub' ), __( 'Remove empty heading elements or add text.', 'siteaudithub' ), $html );
		$add( 'a11y_aria_role', 'a11y', 'medium', 'confirmed', __( 'Invalid ARIA role', 'siteaudithub' ), __( 'These role values are not defined in WAI-ARIA, so assistive technology ignores them.', 'siteaudithub' ), __( 'Use a valid role or rely on native HTML elements.', 'siteaudithub' ), $html );
		$add( 'a11y_aria_attr', 'a11y', 'low', 'potential', __( 'Unknown ARIA attribute', 'siteaudithub' ), __( 'These aria-* attributes are not part of WAI-ARIA 1.2 (often typos).', 'siteaudithub' ), __( 'Correct the attribute name or remove it.', 'siteaudithub' ), $html );
		$add( 'a11y_aria_hidden_focus', 'a11y', 'high', 'confirmed', __( 'Focusable element hidden from assistive technology', 'siteaudithub' ), __( 'aria-hidden="true" is set on an element that can receive keyboard focus, so keyboard users reach something screen readers cannot describe.', 'siteaudithub' ), __( 'Remove aria-hidden, or make the element unfocusable (tabindex="-1" / disabled) when it is truly hidden.', 'siteaudithub' ), $html );
		$add( 'a11y_aria_ref', 'a11y', 'medium', 'confirmed', __( 'ARIA reference to a missing element', 'siteaudithub' ), __( 'aria-labelledby or aria-describedby points to an id that does not exist on the page.', 'siteaudithub' ), __( 'Fix the referenced id or add the missing element.', 'siteaudithub' ), $html );
		$add( 'a11y_duplicate_id', 'a11y', 'low', 'potential', __( 'Duplicate id attributes', 'siteaudithub' ), __( 'The same id is used more than once. This can break label and ARIA associations.', 'siteaudithub' ), __( 'Make ids unique on each page.', 'siteaudithub' ), $html );
		$add( 'a11y_tabindex', 'a11y', 'low', 'potential', __( 'Positive tabindex values', 'siteaudithub' ), __( 'tabindex values above 0 override the natural focus order and often create a confusing keyboard experience.', 'siteaudithub' ), __( 'Use tabindex="0" or "-1" and arrange the DOM in a logical order.', 'siteaudithub' ), $html );
		$add( 'a11y_click_handler', 'a11y', 'medium', 'potential', __( 'Clickable elements that may not be keyboard accessible', 'siteaudithub' ), __( 'Non-interactive elements (div, span…) have onclick handlers but no role or tabindex, so keyboard users may not be able to activate them.', 'siteaudithub' ), __( 'Use <button> or <a> elements, or add role, tabindex="0" and keyboard handlers.', 'siteaudithub' ), $html );
		$add( 'a11y_iframe_title', 'a11y', 'medium', 'confirmed', __( 'Frames without a title', 'siteaudithub' ), __( 'iframes need a title so screen reader users know what the embedded content is.', 'siteaudithub' ), __( 'Add a short descriptive title attribute to each iframe (e.g. "Store location map").', 'siteaudithub' ), $html );
		$add( 'a11y_autoplay', 'a11y', 'medium', 'potential', __( 'Auto-playing media with sound', 'siteaudithub' ), __( 'Audio or video autoplays without being muted, which can interfere with screen readers and distract users.', 'siteaudithub' ), __( 'Avoid autoplay or start muted and provide visible controls.', 'siteaudithub' ), $html );
		$add( 'a11y_contrast', 'a11y', 'medium', 'potential', __( 'Possible low colour contrast', 'siteaudithub' ), __( 'Inline styles declare text and background colours with a contrast ratio below 4.5:1. Only inline colours are evaluated; stylesheet colours, images and text size are not.', 'siteaudithub' ), __( 'Increase contrast (4.5:1 for normal text, 3:1 for large text) and verify with a contrast checker.', 'siteaudithub' ), __( 'WCAG relative-luminance formula on inline style colours.', 'siteaudithub' ) );
		$add( 'a11y_viewport_zoom', 'a11y', 'medium', 'confirmed', __( 'Zoom is disabled', 'siteaudithub' ), __( 'The viewport meta tag prevents or limits pinch-zoom (user-scalable=no or maximum-scale below 2).', 'siteaudithub' ), __( 'Remove user-scalable=no and maximum-scale restrictions from the viewport tag.', 'siteaudithub' ), $html );
		$add( 'a11y_required_hint', 'a11y', 'info', 'manual', __( 'Required fields without described instructions', 'siteaudithub' ), __( 'Required fields have no aria-describedby. Instructions may still be present visually; this needs manual review.', 'siteaudithub' ), __( 'Make sure required fields and input formats are explained in text that is programmatically associated with the field.', 'siteaudithub' ), $html );
		$add( 'a11y_manual_testing', 'a11y', 'info', 'manual', __( 'Manual accessibility testing still required', 'siteaudithub' ), __( 'Automated checks find only part of accessibility barriers. Keyboard navigation, focus visibility, screen reader behaviour, media captions, colour usage in stylesheets and content clarity were not evaluated.', 'siteaudithub' ), __( 'Test key templates with keyboard only and a screen reader, and consider an expert review. These results are not a WCAG conformance claim.', 'siteaudithub' ), __( 'Standing reminder added to every scan.', 'siteaudithub' ) );

		/* Technical health ------------------------------------------------ */
		$add( 'health_request_failed', 'health', 'medium', 'inaccessible', __( 'Internal URL could not be scanned', 'siteaudithub' ), __( 'The request failed (timeout, connection error, blocked, or non-HTML response) so no checks ran for this URL. This is not a statement about the page being healthy or unhealthy.', 'siteaudithub' ), __( 'Open the URL in a browser; if it works, the server may be blocking loopback requests or rate limiting. Try a larger request delay or timeout.', 'siteaudithub' ), __( 'HTTP request from the server to itself.', 'siteaudithub' ) );
		$add( 'health_wp_update', 'health', 'medium', 'confirmed', __( 'WordPress update available', 'siteaudithub' ), __( 'A newer WordPress version is available according to WordPress\' own update check.', 'siteaudithub' ), __( 'Back up the site, then update via Dashboard → Updates (test on staging first for major versions).', 'siteaudithub' ), __( 'WordPress core update data (update_core transient).', 'siteaudithub' ) );
		$add( 'health_php_version', 'health', 'medium', 'potential', __( 'Older PHP version', 'siteaudithub' ), __( 'The server runs a PHP version that no longer receives active support from the PHP project.', 'siteaudithub' ), __( 'Ask your host to move the site to a supported PHP version after testing compatibility.', 'siteaudithub' ), __( 'PHP_VERSION compared with the PHP project support schedule known at release.', 'siteaudithub' ) );
		$add( 'health_plugin_updates', 'health', 'medium', 'confirmed', __( 'Plugin updates pending', 'siteaudithub' ), __( 'One or more installed plugins have updates available.', 'siteaudithub' ), __( 'Review changelogs and update from Plugins, ideally after testing on staging.', 'siteaudithub' ), __( 'WordPress plugin update data.', 'siteaudithub' ) );
		$add( 'health_theme_updates', 'health', 'low', 'confirmed', __( 'Theme updates pending', 'siteaudithub' ), __( 'One or more installed themes have updates available.', 'siteaudithub' ), __( 'Update themes (child themes keep customizations safe).', 'siteaudithub' ), __( 'WordPress theme update data.', 'siteaudithub' ) );
		$add( 'health_not_https', 'health', 'high', 'confirmed', __( 'Site address does not use HTTPS', 'siteaudithub' ), __( 'The WordPress or Site Address uses http://, so traffic is not encrypted.', 'siteaudithub' ), __( 'Install a TLS certificate (most hosts offer one free) and switch both addresses to https://.', 'siteaudithub' ), __( 'home and siteurl options.', 'siteaudithub' ) );
		$add( 'health_https_unavailable', 'health', 'medium', 'potential', __( 'HTTPS version not reachable', 'siteaudithub' ), __( 'A request to the https:// version of the site failed.', 'siteaudithub' ), __( 'Check your TLS certificate with your host.', 'siteaudithub' ), __( 'Request to the https:// home URL.', 'siteaudithub' ) );
		$add( 'health_debug_display', 'health', 'medium', 'confirmed', __( 'Debug output is displayed to visitors', 'siteaudithub' ), __( 'WP_DEBUG and WP_DEBUG_DISPLAY are enabled, so PHP notices and paths may be shown publicly.', 'siteaudithub' ), __( 'On production set WP_DEBUG_DISPLAY to false (and log to a protected file if needed).', 'siteaudithub' ), __( 'WordPress debug constants.', 'siteaudithub' ) );
		$add( 'health_debug_log_public', 'health', 'high', 'confirmed', __( 'debug.log is publicly accessible', 'siteaudithub' ), __( 'wp-content/debug.log can be downloaded from the web and may expose file paths, queries or personal data.', 'siteaudithub' ), __( 'Delete or move the log (define WP_DEBUG_LOG as a path outside the web root) and block access to .log files.', 'siteaudithub' ), __( 'HTTP request to the default log location.', 'siteaudithub' ) );
		$add( 'health_admin_user', 'health', 'low', 'potential', __( 'A user named "admin" exists', 'siteaudithub' ), __( 'The default "admin" username is the first guess in automated login attacks.', 'siteaudithub' ), __( 'Create a new administrator with a unique username, then remove the old account (attributing content to the new one).', 'siteaudithub' ), __( 'User lookup by login.', 'siteaudithub' ) );
		$add( 'health_rest_api', 'health', 'medium', 'potential', __( 'REST API not reachable', 'siteaudithub' ), __( 'The REST API index did not return a successful response. The block editor and many plugins depend on it.', 'siteaudithub' ), __( 'Check security plugins, firewall rules or permalink settings that may block /wp-json/.', 'siteaudithub' ), __( 'Request to the REST API index.', 'siteaudithub' ) );
		$add( 'health_cron_disabled', 'health', 'info', 'manual', __( 'WP-Cron is disabled', 'siteaudithub' ), __( 'DISABLE_WP_CRON is set. Scheduled tasks (including SiteAuditHub scans) only run if a real server cron calls wp-cron.php.', 'siteaudithub' ), __( 'Make sure a system cron job requests wp-cron.php every few minutes.', 'siteaudithub' ), __( 'DISABLE_WP_CRON constant.', 'siteaudithub' ) );
		$add( 'health_cron_overdue', 'health', 'medium', 'potential', __( 'Scheduled tasks are overdue', 'siteaudithub' ), __( 'Some WP-Cron events are more than an hour late, which suggests cron is not running reliably (low traffic, loopback blocked, or disabled).', 'siteaudithub' ), __( 'Set up a real server cron for wp-cron.php or check why loopback requests fail.', 'siteaudithub' ), __( 'Next-run timestamps of scheduled events.', 'siteaudithub' ) );
		$add( 'health_robots_missing', 'health', 'info', 'manual', __( 'robots.txt not reachable', 'siteaudithub' ), __( 'robots.txt did not return status 200. WordPress normally generates one virtually.', 'siteaudithub' ), __( 'Check server rules or plugins that may block /robots.txt.', 'siteaudithub' ), __( 'Request to /robots.txt.', 'siteaudithub' ) );
		$add( 'health_autoload', 'health', 'medium', 'potential', __( 'Large autoloaded options', 'siteaudithub' ), __( 'Autoloaded options are loaded on every request. A large total can slow down every page.', 'siteaudithub' ), __( 'Identify large autoloaded options (often left by removed plugins) and clean them up carefully with a backup.', 'siteaudithub' ), __( 'Sum of autoloaded option sizes.', 'siteaudithub' ) );
		$add( 'health_php_extensions', 'health', 'medium', 'confirmed', __( 'Recommended PHP extensions missing', 'siteaudithub' ), __( 'Some PHP extensions WordPress recommends are not loaded.', 'siteaudithub' ), __( 'Ask your host to enable the missing extensions.', 'siteaudithub' ), __( 'extension_loaded() checks.', 'siteaudithub' ) );
		$add( 'health_memory_limit', 'health', 'low', 'potential', __( 'Low PHP memory limit', 'siteaudithub' ), __( 'The PHP memory limit is below 128 MB, which can cause failures on larger pages or plugins.', 'siteaudithub' ), __( 'Raise memory_limit or WP_MEMORY_LIMIT with your host.', 'siteaudithub' ), __( 'ini_get( memory_limit ).', 'siteaudithub' ) );
		$add( 'health_inactive_plugins', 'health', 'low', 'potential', __( 'Inactive plugins installed', 'siteaudithub' ), __( 'Inactive plugins still contain code on the server and may need updates.', 'siteaudithub' ), __( 'Delete plugins you no longer use.', 'siteaudithub' ), __( 'Installed vs active plugin list.', 'siteaudithub' ) );
		$add( 'health_inactive_themes', 'health', 'info', 'potential', __( 'Several inactive themes installed', 'siteaudithub' ), __( 'More than one inactive theme is installed (keeping one default theme as a fallback is reasonable).', 'siteaudithub' ), __( 'Remove themes you do not need.', 'siteaudithub' ), __( 'Installed theme list.', 'siteaudithub' ) );
		$add( 'health_uploads_writable', 'health', 'medium', 'confirmed', __( 'Uploads directory not writable', 'siteaudithub' ), __( 'WordPress cannot write to the uploads directory, so media uploads will fail.', 'siteaudithub' ), __( 'Ask your host to fix the directory permissions.', 'siteaudithub' ), __( 'wp_is_writable() on the uploads base directory.', 'siteaudithub' ) );

		/* Plugins --------------------------------------------------------- */
		$add( 'plugin_update', 'plugins', 'medium', 'confirmed', __( 'Plugin update available', 'siteaudithub' ), __( 'A newer version is offered through WordPress\' update system. Updates often contain security and compatibility fixes.', 'siteaudithub' ), __( 'Read the changelog, back up, and update (test on staging for major releases).', 'siteaudithub' ), __( 'WordPress update_plugins data.', 'siteaudithub' ) );
		$add( 'plugin_requires_php', 'plugins', 'high', 'confirmed', __( 'Plugin update requires a newer PHP version', 'siteaudithub' ), __( 'The available update declares a minimum PHP version higher than the server\'s.', 'siteaudithub' ), __( 'Upgrade PHP before updating the plugin.', 'siteaudithub' ), __( 'requires_php in update data.', 'siteaudithub' ) );
		$add( 'plugin_untested', 'plugins', 'info', 'manual', __( 'Not marked as tested with your WordPress version', 'siteaudithub' ), __( 'The plugin author has not declared testing with your major WordPress version. This does not mean it is broken.', 'siteaudithub' ), __( 'Watch for problems after WordPress updates and check the plugin support forum.', 'siteaudithub' ), __( '"Tested up to" value from WordPress.org data.', 'siteaudithub' ) );
		$add( 'plugin_closed', 'plugins', 'high', 'confirmed', __( 'Plugin closed on WordPress.org', 'siteaudithub' ), __( 'WordPress.org reports this plugin as closed and no longer available for download, so it will not receive updates through WordPress.org.', 'siteaudithub' ), __( 'Check the plugin page for details and plan a replacement.', 'siteaudithub' ), __( 'WordPress.org Plugins API response (opt-in lookup).', 'siteaudithub' ) );
		$add( 'plugin_security_closure', 'plugins', 'critical', 'confirmed', __( 'Plugin closed for a security issue', 'siteaudithub' ), __( 'WordPress.org reports the closure reason as a security issue.', 'siteaudithub' ), __( 'Deactivate and replace the plugin unless the author has published a fixed version from another trusted source.', 'siteaudithub' ), __( 'WordPress.org Plugins API response (opt-in lookup).', 'siteaudithub' ) );
		$add( 'plugin_not_verified', 'plugins', 'info', 'unavailable', __( 'No public WordPress.org listing verified', 'siteaudithub' ), __( 'This plugin was not found in WordPress.org update data. Premium, custom and privately distributed plugins are normal; this is not a security finding.', 'siteaudithub' ), __( 'Make sure you receive updates from the vendor.', 'siteaudithub' ), __( 'WordPress update_plugins data.', 'siteaudithub' ) );
		$add( 'plugin_stale', 'plugins', 'low', 'manual', __( 'No WordPress.org release in over two years', 'siteaudithub' ), __( 'According to WordPress.org, the plugin has not been updated in more than two years. Mature plugins can be stable; this only means it deserves a look.', 'siteaudithub' ), __( 'Check whether it still works with current WordPress and is supported.', 'siteaudithub' ), __( 'last_updated from WordPress.org Plugins API (opt-in lookup).', 'siteaudithub' ) );

		/* Integrity ------------------------------------------------------- */
		$add( 'int_core_mismatch', 'integrity', 'high', 'integrity_mismatch', __( 'Core file differs from the official checksum', 'siteaudithub' ), __( 'This WordPress core file does not match the official checksum for your version and locale. Core files should never be edited; a mismatch can indicate tampering or an incomplete update.', 'siteaudithub' ), __( 'Reinstall WordPress core from Dashboard → Updates ("Re-install"), after taking a backup. Investigate if files keep changing.', 'siteaudithub' ), __( 'MD5 compared with checksums from api.wordpress.org.', 'siteaudithub' ) );
		$add( 'int_core_missing', 'integrity', 'medium', 'integrity_mismatch', __( 'Core file missing', 'siteaudithub' ), __( 'A file listed in the official checksums is not present.', 'siteaudithub' ), __( 'Re-install WordPress core to restore missing files.', 'siteaudithub' ), __( 'Official checksum list compared with the filesystem.', 'siteaudithub' ) );
		$add( 'int_core_unexpected', 'integrity', 'high', 'unverified', __( 'Unexpected file in a core directory', 'siteaudithub' ), __( 'This file in wp-admin or wp-includes is not part of the official WordPress release. Attackers sometimes hide files there, but leftovers from old versions are also common.', 'siteaudithub' ), __( 'Compare with a clean WordPress download; remove the file only after confirming it is not needed (keep a backup).', 'siteaudithub' ), __( 'Official checksum list compared with the filesystem.', 'siteaudithub' ) );
		$add( 'int_root_dir_known', 'integrity', 'low', 'manual', __( 'Host or SSL folder in the site root', 'siteaudithub' ), __( 'Hosts and SSL certificate tools create this folder (for example .well-known, cgi-bin or .private). It is usually harmless; its files are inspected like every other file.', 'siteaudithub' ), __( 'No action needed unless you do not recognise what is inside.', 'siteaudithub' ), __( 'Folder name compared with common host folders.', 'siteaudithub' ) );
		$add( 'int_root_dir', 'integrity', 'medium', 'unverified', __( 'Unknown folder in the site root', 'siteaudithub' ), __( 'This folder in the WordPress root is not part of WordPress. Attackers sometimes create a folder here to hide their files; other websites, staging copies or host tools can also live here. Its files are inspected too.', 'siteaudithub' ), __( 'If you or your host did not create it, back it up and remove it. If it is yours, you can ignore this finding.', 'siteaudithub' ), __( 'Folder name compared with the folders WordPress uses.', 'siteaudithub' ) );
		$add( 'int_root_file', 'integrity', 'medium', 'unverified', __( 'Unknown file in the site root', 'siteaudithub' ), __( 'This file in the WordPress root folder is not part of WordPress and is not a common server, SEO or icon file. Attackers sometimes upload files here with random names; host tools and verification files are also placed here.', 'siteaudithub' ), __( 'If you or your host did not add it, back it up and remove it. If it is yours, you can ignore this finding.', 'siteaudithub' ), __( 'File name compared with the files WordPress and common services place in the root.', 'siteaudithub' ) );
		$add( 'int_root_unexpected', 'integrity', 'medium', 'unverified', __( 'Unrecognised PHP file in the site root', 'siteaudithub' ), __( 'A PHP file in the WordPress root is not part of core (wp-config.php is expected). It may be legitimate (host tools, verification files) or unwanted.', 'siteaudithub' ), __( 'Identify who added the file before removing it.', 'siteaudithub' ), __( 'Official checksum list compared with the filesystem.', 'siteaudithub' ) );
		$add( 'int_plugin_mismatch', 'integrity', 'high', 'integrity_mismatch', __( 'Plugin file differs from the WordPress.org release', 'siteaudithub' ), __( 'This file does not match the published checksum for the installed plugin version.', 'siteaudithub' ), __( 'Reinstall the plugin from WordPress.org (same version), after a backup, and investigate how the file changed.', 'siteaudithub' ), __( 'Hash compared with downloads.wordpress.org plugin checksums.', 'siteaudithub' ) );
		$add( 'int_plugin_extra', 'integrity', 'low', 'unverified', __( 'PHP file not in the plugin\'s published release', 'siteaudithub' ), __( 'The plugin is verified against WordPress.org checksums but this PHP file is not part of that release. Some plugins generate files; others may be unwanted.', 'siteaudithub' ), __( 'Review the file contents and origin.', 'siteaudithub' ), __( 'Hash list from downloads.wordpress.org.', 'siteaudithub' ) );
		$add( 'int_signature', 'integrity', 'critical', 'signature_match', __( 'Known malicious code signature', 'siteaudithub' ), __( 'The file matches a pattern associated with known web shells or backdoors in SiteAuditHub\'s local signature list. False positives are possible but uncommon for these signatures.', 'siteaudithub' ), __( 'Treat as a possible compromise: take a backup for evidence, restore the file from a clean source, change all passwords and keys, and consider a professional incident response.', 'siteaudithub' ), __( 'Local signature list (read-only content match).', 'siteaudithub' ) );
		$add( 'int_suspicious', 'integrity', 'medium', 'suspicious', __( 'Suspicious code pattern', 'siteaudithub' ), __( 'The file contains patterns that are common in malware but also appear in legitimate software (for example layered decoding or dynamic execution). This is not proof of infection.', 'siteaudithub' ), __( 'Check whether the file belongs to a plugin/theme you trust and compare it with a clean copy.', 'siteaudithub' ), __( 'Heuristic pattern match (read-only).', 'siteaudithub' ) );
		$add( 'int_uploads_exec', 'integrity', 'high', 'suspicious', __( 'Executable file in uploads', 'siteaudithub' ), __( 'The uploads directory should contain media, not executable scripts. PHP files there are a common sign of a compromised upload form, although some plugins do store PHP there.', 'siteaudithub' ), __( 'Identify which plugin created it; if unknown, back it up and remove it. Consider blocking PHP execution in uploads at the server level.', 'siteaudithub' ), __( 'File extension in the uploads directory.', 'siteaudithub' ) );
		$add( 'int_htaccess', 'integrity', 'high', 'suspicious', __( 'Suspicious .htaccess directive', 'siteaudithub' ), __( 'The .htaccess file contains directives often used in SEO spam or malware (conditional redirects for search engine visitors, executing PHP inside image files, or auto-prepending files).', 'siteaudithub' ), __( 'Review the directives; restore .htaccess from a clean backup or regenerate WordPress rules via Settings → Permalinks.', 'siteaudithub' ), __( 'Heuristic pattern match (read-only).', 'siteaudithub' ) );
		$add( 'int_changed', 'integrity', 'info', 'manual', __( 'File changed since the last baseline', 'siteaudithub' ), __( 'The file contents differ from the previous integrity scan and no official checksum is available to verify it. Updates normally cause these changes.', 'siteaudithub' ), __( 'If you did not update or edit anything recently, review the change.', 'siteaudithub' ), __( 'SHA-256 compared with the stored baseline.', 'siteaudithub' ) );
		$add( 'int_modified', 'integrity', 'high', 'suspicious', __( 'File changed without an update', 'siteaudithub' ), __( 'This file is different from the previous scan, but its plugin, theme or WordPress version did not change, so an update does not explain it. Injected code is usually added this way.', 'siteaudithub' ), __( 'If you did not edit this file yourself, compare it with a clean copy (reinstall the plugin or theme, or WordPress core) after taking a backup.', 'siteaudithub' ), __( 'SHA-256 compared with the previous scan, together with the installed version.', 'siteaudithub' ) );
		$add( 'int_new_file', 'integrity', 'high', 'suspicious', __( 'New file added since the last scan', 'siteaudithub' ), __( 'This code file did not exist during the previous scan and could not be verified against an official WordPress.org release. Attackers often add a new file like this as a backdoor. If you just added or updated something yourself, it is expected.', 'siteaudithub' ), __( 'If you do not recognise the file, back it up and remove it. If it belongs to something you installed, mark it as ignored.', 'siteaudithub' ), __( 'File list compared with the previous integrity scan.', 'siteaudithub' ) );
		$add( 'int_new_group', 'integrity', 'info', 'manual', __( 'Many new files in one plugin or theme', 'siteaudithub' ), __( 'A plugin or theme folder gained many new code files since the previous scan. This normally means it was installed or updated.', 'siteaudithub' ), __( 'If you did not install or update it, review the folder.', 'siteaudithub' ), __( 'File list compared with the previous integrity scan.', 'siteaudithub' ) );
		$add( 'int_unreadable', 'integrity', 'low', 'unavailable', __( 'File could not be inspected', 'siteaudithub' ), __( 'The file could not be read (permissions or I/O error), so it was not checked.', 'siteaudithub' ), __( 'Check file permissions or raise the size limit in settings if appropriate.', 'siteaudithub' ), __( 'Filesystem read.', 'siteaudithub' ) );
		$add( 'int_disguised', 'integrity', 'high', 'suspicious', __( 'PHP file disguised with a double extension', 'siteaudithub' ), __( 'The file name looks like an image or document but ends in .php (for example photo.jpg.php). This trick is commonly used to hide backdoors.', 'siteaudithub' ), __( 'Open the file in a text editor or ask your host; if you do not recognise it, back it up and remove it.', 'siteaudithub' ), __( 'File name pattern.', 'siteaudithub' ) );
		$add( 'int_hidden_php', 'integrity', 'high', 'suspicious', __( 'Hidden PHP file', 'siteaudithub' ), __( 'The PHP file name starts with a dot, which hides it in many file managers. Legitimate WordPress code almost never does this.', 'siteaudithub' ), __( 'Review the file contents; if unknown, back it up and remove it.', 'siteaudithub' ), __( 'File name pattern.', 'siteaudithub' ) );
		$add( 'int_content_php', 'integrity', 'medium', 'unverified', __( 'Unexpected PHP file directly in wp-content', 'siteaudithub' ), __( 'Only a few known drop-in files normally live directly in wp-content. Other PHP files there are often left by attackers, though some hosts and plugins add their own.', 'siteaudithub' ), __( 'Find out which plugin or host tool created it before removing it.', 'siteaudithub' ), __( 'Location compared with known WordPress drop-ins.', 'siteaudithub' ) );
		$add( 'int_uploader', 'integrity', 'high', 'suspicious', __( 'Upload form without WordPress security checks', 'siteaudithub' ), __( 'This file accepts file uploads and saves them without any WordPress permission or nonce check. Attackers use small upload scripts like this to place more malware on a site.', 'siteaudithub' ), __( 'If it is not part of a plugin or theme you trust, back it up and remove it.', 'siteaudithub' ), __( 'Code pattern combination (read-only).', 'siteaudithub' ) );
		$add( 'int_db_script', 'integrity', 'high', 'suspicious', __( 'Obfuscated script inside post content', 'siteaudithub' ), __( 'A script in this post or page decodes or evaluates hidden code (eval, atob, fromCharCode, unescape or document.write). Injected scripts like this are used for spam redirects and card skimming.', 'siteaudithub' ), __( 'Edit the content (Code editor), remove the script if you did not add it, then check how it got there (user accounts, plugins).', 'siteaudithub' ), __( 'Database content pattern (read-only).', 'siteaudithub' ) );
		$add( 'int_db_iframe', 'integrity', 'high', 'suspicious', __( 'Hidden iframe inside post content', 'siteaudithub' ), __( 'An iframe that is 0 or 1 pixel in size, or hidden with CSS, loads another page invisibly. This is a common sign of injected malware or spam.', 'siteaudithub' ), __( 'Remove the iframe if you did not add it on purpose.', 'siteaudithub' ), __( 'Database content pattern (read-only).', 'siteaudithub' ) );
		$add( 'int_db_external_script', 'integrity', 'info', 'manual', __( 'External script inside post content', 'siteaudithub' ), __( 'This content loads JavaScript from another website. Embeds (maps, forms, social posts) do this legitimately, but injected malware does too.', 'siteaudithub' ), __( 'Confirm you recognise every listed address.', 'siteaudithub' ), __( 'Database content pattern (read-only).', 'siteaudithub' ) );
		$add( 'int_db_option', 'integrity', 'high', 'suspicious', __( 'Suspicious code stored in a setting', 'siteaudithub' ), __( 'A WordPress option contains code that decodes or evaluates hidden data. Malware often hides in options (widgets, theme settings) so it survives file clean-ups.', 'siteaudithub' ), __( 'Identify which plugin or widget owns the option and remove the injected code (take a database backup first).', 'siteaudithub' ), __( 'Database content pattern (read-only).', 'siteaudithub' ) );
		$add( 'int_db_new_admin', 'integrity', 'info', 'manual', __( 'Administrator created in the last 7 days', 'siteaudithub' ), __( 'A new administrator account was created recently. Attackers often add their own admin account; if you created it, everything is fine.', 'siteaudithub' ), __( 'Check Users → Administrators. Remove accounts you do not recognise and change all passwords.', 'siteaudithub' ), __( 'User registration date.', 'siteaudithub' ) );
		$add( 'int_too_large', 'integrity', 'info', 'not_evaluated', __( 'Large files not content-inspected', 'siteaudithub' ), __( 'These files are bigger than the inspection size limit, so their contents were not scanned for signatures. Large files are usually bundled libraries (for example the WordPress block editor scripts). Files verified by official checksums never appear here.', 'siteaudithub' ), __( 'Enable official checksum verification (Settings → Plugins & Integrity) so WordPress core files are verified, or raise the maximum file size to inspect.', 'siteaudithub' ), __( 'File size compared with the configured limit.', 'siteaudithub' ) );
		$add( 'int_checksums_unavailable', 'integrity', 'info', 'unavailable', __( 'Official checksums not used', 'siteaudithub' ), __( 'Core and plugin files were not compared with official WordPress.org checksums, either because the option is disabled or the reference data could not be downloaded. Those files are treated as unverified.', 'siteaudithub' ), __( 'Enable "Verify against WordPress.org checksums" in Settings → Integrity to compare files with official releases.', 'siteaudithub' ), __( 'Scanner configuration.', 'siteaudithub' ) );
		$add( 'int_limit_reached', 'integrity', 'low', 'not_evaluated', __( 'File limit reached', 'siteaudithub' ), __( 'The scan stopped enumerating files after reaching the configured maximum, so some files were not inspected.', 'siteaudithub' ), __( 'Raise the file limit in Settings → Integrity if your server can handle it.', 'siteaudithub' ), __( 'Scanner configuration.', 'siteaudithub' ) );

		self::$checks = $c;
		return $c;
	}

	/**
	 * Build a finding array from a catalog entry.
	 *
	 * @param string $check_id  Check.
	 * @param string $item_key  URL/file ('' for site-level).
	 * @param string $evidence  Evidence text.
	 * @param array  $overrides severity, class, fp_extra, title.
	 * @return array
	 */
	public static function finding( $check_id, $item_key, $evidence = '', array $overrides = array() ) {
		$checks = self::checks();
		$def    = isset( $checks[ $check_id ] ) ? $checks[ $check_id ] : array(
			'module'   => 'health',
			'severity' => 'info',
			'class'    => 'manual',
			'title'    => $check_id,
			'desc'     => '',
			'fix'      => '',
			'method'   => '',
		);
		return array(
			'module'         => $def['module'],
			'check_id'       => $check_id,
			'severity'       => isset( $overrides['severity'] ) ? $overrides['severity'] : $def['severity'],
			'classification' => isset( $overrides['class'] ) ? $overrides['class'] : $def['class'],
			'item_key'       => (string) $item_key,
			'title'          => isset( $overrides['title'] ) ? $overrides['title'] : $def['title'],
			'description'    => $def['desc'],
			'evidence'       => (string) $evidence,
			'recommendation' => $def['fix'],
			'method'         => $def['method'],
			'fp_extra'       => isset( $overrides['fp_extra'] ) ? $overrides['fp_extra'] : '',
		);
	}
}