<?php
/**
 * BaseCloud Boost — Security Settings
 *
 * @package BaseCloud\Boost
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

$options = (array) get_option( BCBOOST_OPTIONS_KEY, [] );
?>
<div class="bcboost-wrap">
	<?php include __DIR__ . '/partials/header.php'; ?>

	<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
		<?php wp_nonce_field( 'BCBOOST_save_settings' ); ?>
		<input type="hidden" name="action" value="BCBOOST_save_settings">
		<input type="hidden" name="BCBOOST_tab_checkboxes" value="security_headers,hsts_preload,disable_xmlrpc,clean_head">

		<div class="bcboost-card bcboost-card--accent-red">
			<h3><span class="bcboost-section-icon">🛡️</span> <?php esc_html_e( 'Security Headers', 'basecloud-boost' ); ?></h3>

			<p class="bcboost-field-desc" style="margin-bottom:16px;"><?php esc_html_e( 'Sends hardened HTTP response headers recommended by OWASP and Mozilla Observatory. These headers protect against clickjacking, MIME sniffing, and cross-site data leakage.', 'basecloud-boost' ); ?></p>

			<div class="bcboost-field bcboost-field--toggle">
				<label>
					<span class="bcboost-field-label"><?php esc_html_e( 'Enable Security Headers', 'basecloud-boost' ); ?></span>
					<span class="bcboost-field-desc">
						<?php esc_html_e( 'Adds the following headers to every response: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy, Permissions-Policy, X-XSS-Protection.', 'basecloud-boost' ); ?>
					</span>
				</label>
				<label class="bcboost-toggle">
					<input type="checkbox" name="security_headers" value="1" <?php checked( ! empty( $options['security_headers'] ) ); ?>>
					<span class="bcboost-toggle-slider"></span>
				</label>
			</div>
		</div>

		<div class="bcboost-card bcboost-card--accent-blue">
			<h3><span class="bcboost-section-icon">🔒</span> <?php esc_html_e( 'HSTS (HTTP Strict Transport Security)', 'basecloud-boost' ); ?></h3>

			<p class="bcboost-field-desc" style="margin-bottom:16px;"><?php esc_html_e( 'HSTS instructs browsers to only connect via HTTPS, preventing protocol downgrade attacks. Only enable this if your site is exclusively served over HTTPS.', 'basecloud-boost' ); ?></p>

			<div class="bcboost-field">
				<label class="bcboost-field-label" for="hsts_max_age"><?php esc_html_e( 'HSTS Max-Age (seconds)', 'basecloud-boost' ); ?></label>
				<span class="bcboost-field-desc"><?php esc_html_e( 'Set to 0 to disable HSTS. 31536000 = 1 year (recommended). The browser will refuse HTTP connections for this duration.', 'basecloud-boost' ); ?></span>
				<input type="number" id="hsts_max_age" name="hsts_max_age" class="bcboost-input" value="<?php echo (int) ( $options['hsts_max_age'] ?? 0 ); ?>" min="0" max="63072000" style="margin-top:10px;">
			</div>

			<div class="bcboost-field bcboost-field--toggle">
				<label>
					<span class="bcboost-field-label"><?php esc_html_e( 'HSTS Preload', 'basecloud-boost' ); ?></span>
					<span class="bcboost-field-desc">
						<?php esc_html_e( 'Add the preload directive to the HSTS header. Required to submit your domain to browser HSTS preload lists. ', 'basecloud-boost' ); ?>
						<strong><?php esc_html_e( 'Warning: this is very difficult to undo. Only enable once your site is permanently HTTPS.', 'basecloud-boost' ); ?></strong>
					</span>
				</label>
				<label class="bcboost-toggle">
					<input type="checkbox" name="hsts_preload" value="1" <?php checked( ! empty( $options['hsts_preload'] ) ); ?>>
					<span class="bcboost-toggle-slider"></span>
				</label>
			</div>
		</div>

		<div class="bcboost-card">
			<h3><span class="bcboost-section-icon">🔧</span> <?php esc_html_e( 'WordPress Hardening', 'basecloud-boost' ); ?></h3>

			<div class="bcboost-field bcboost-field--toggle">
				<label>
					<span class="bcboost-field-label"><?php esc_html_e( 'Disable XML-RPC', 'basecloud-boost' ); ?></span>
					<span class="bcboost-field-desc"><?php esc_html_e( 'Disable the XML-RPC endpoint (xmlrpc.php). Prevents brute-force amplification attacks. Only disable if you do not use Jetpack, mobile apps, or other XML-RPC-dependent services.', 'basecloud-boost' ); ?></span>
				</label>
				<label class="bcboost-toggle">
					<input type="checkbox" name="disable_xmlrpc" value="1" <?php checked( ! empty( $options['disable_xmlrpc'] ) ); ?>>
					<span class="bcboost-toggle-slider"></span>
				</label>
			</div>

			<div class="bcboost-field bcboost-field--toggle">
				<label>
					<span class="bcboost-field-label"><?php esc_html_e( 'Clean &lt;head&gt; Tag', 'basecloud-boost' ); ?></span>
					<span class="bcboost-field-desc"><?php esc_html_e( 'Remove unnecessary tags from the HTML head that leak WordPress version information: RSD link, WLManifest link, WordPress version meta, and shortlink tags.', 'basecloud-boost' ); ?></span>
				</label>
				<label class="bcboost-toggle">
					<input type="checkbox" name="clean_head" value="1" <?php checked( ! empty( $options['clean_head'] ) ); ?>>
					<span class="bcboost-toggle-slider"></span>
				</label>
			</div>
		</div>

		<div class="bcboost-form-footer">
			<button type="submit" class="bcboost-btn bcboost-btn--primary">
				<span class="dashicons dashicons-saved"></span>
				<?php esc_html_e( 'Save Settings', 'basecloud-boost' ); ?>
			</button>
		</div>
	</form>
</div>
