<?php
/**
 * Reversible URL text randomiser.
 *
 * Internal link paths are rewritten so the visible slug becomes a random-looking
 * token, and the token is decoded back on the next request. The transform is a
 * keyed XOR keystream over the slug plus a two-byte CRC checksum, followed by
 * Crockford base32:
 *
 *   token = base32( ( slug . crc16( slug ) ) XOR keystream(seed) )
 *
 * XOR with a fixed keystream is a bijection and base32 is a bijection, so
 * distinct slugs can never collide and a slug can always be recovered without
 * storing a map in the database. The checksum makes accidental decoding of an
 * ordinary slug practically impossible (about 1 in 65536).
 *
 * Only the last path segment is masked, so language prefixes, directories and
 * WordPress routing keep working, and every path stays on the same site.
 *
 * Masking is applied only to <a> and <form> tags: canonical, hreflang and other
 * <link> tags must keep pointing at the real URLs so search engines are never
 * given a scrambled canonical.
 *
 * @package NiceShieldPro
 */

namespace NSP;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * URL token engine.
 */
final class Urls {

	/**
	 * Crockford base32 alphabet: no i, l, o or u, so tokens cannot spell a word
	 * and cannot be misread when copied by hand.
	 */
	const B32 = '0123456789abcdefghjkmnpqrstvwxyz';

	/**
	 * Shortest token accepted when decoding. A three-letter slug already
	 * produces an eight-character token, so anything shorter is not ours.
	 */
	const MIN_TOKEN = 8;

	/**
	 * Cached keystream per seed.
	 *
	 * @var array
	 */
	private static $keystream = array();

	/**
	 * Whether the current request arrived with a masked token that has already
	 * been translated back into the real path.
	 *
	 * @var bool
	 */
	private static $masked = false;

	/**
	 * Register hooks and resolve a masked path before WordPress parses it.
	 *
	 * The token lives in the last path segment, so WordPress would otherwise
	 * match the single-segment rewrite rule and look for a *post* with that name
	 * (producing a 404 for pages). Rewriting REQUEST_URI here makes routing,
	 * templates and canonical behaviour identical to the real URL.
	 *
	 * @return void
	 */
	public static function init() {
		// Keep WordPress from "correcting" the masked address back to the real
		// permalink; the flag is set before REQUEST_URI is rewritten.
		add_filter( 'redirect_canonical', array( __CLASS__, 'suppress_canonical' ), 99, 2 );

		self::rewrite_request_uri();
	}

	/**
	 * Translate a masked last segment in REQUEST_URI back to the real slug.
	 *
	 * Runs on plugins_loaded, before WP::parse_request(), so the request matches
	 * the same rewrite rule it would have matched without masking.
	 *
	 * @return void
	 */
	private static function rewrite_request_uri() {
		if ( ! self::enabled() ) {
			return;
		}

		if ( defined( 'REST_REQUEST' ) && REST_REQUEST ) {
			return;
		}

		if ( defined( 'WP_CLI' ) && WP_CLI ) {
			return;
		}

		$uri = isset( $_SERVER['REQUEST_URI'] ) ? (string) wp_unslash( $_SERVER['REQUEST_URI'] ) : '';

		if ( '' === $uri ) {
			return;
		}

		// Never touch admin, API, feed, sitemap or asset requests.
		if ( preg_match( '~(wp-admin|wp-login|wp-json|xmlrpc\.php|/feed|sitemap|robots\.txt|wp-content|wp-includes)~i', $uri ) ) {
			return;
		}

		$parts = wp_parse_url( $uri );
		$path  = isset( $parts['path'] ) ? (string) $parts['path'] : '';

		if ( '' === $path ) {
			return;
		}

		$trailing = ( '/' === substr( $path, -1 ) );
		$segments = array_values( array_filter( explode( '/', $path ), 'strlen' ) );

		if ( empty( $segments ) ) {
			return;
		}

		$last = array_pop( $segments );
		$slug = self::unmask( $last );

		if ( false === $slug || '' === $slug ) {
			return;
		}

		$segments[] = $slug;

		$new = '/' . implode( '/', $segments ) . ( $trailing ? '/' : '' );

		if ( ! empty( $parts['query'] ) ) {
			$new .= '?' . $parts['query'];
		}

		self::$masked = true;

		$_SERVER['REQUEST_URI'] = $new;
	}

	/**
	 * Whether the feature is enabled.
	 *
	 * @return bool
	 */
	public static function enabled() {
		if ( (bool) Settings::get( 'slug_mask', 0 ) ) {
			return true;
		}

		// A full scramble (the one-click red button stores preset=all with a
		// non-off mode) must never leave real link paths readable. Treat that as
		// an implicit request to mask URLs even if the separate checkbox was not
		// saved, so the two states can never disagree.
		return ( 'all' === Settings::get( 'preset', 'all' ) && 'off' !== Settings::mode() );
	}

	/**
	 * Active seed. Generated once and stored with the settings.
	 *
	 * @return string
	 */
	private static function seed() {
		$seed = (string) Settings::get( 'slug_seed', '' );

		if ( '' === $seed ) {
			$seed = 'nsp-default-seed';
		}

		return $seed;
	}

	/**
	 * Build (or reuse) a keystream long enough for the payload.
	 *
	 * @param int $len Needed length.
	 * @return string
	 */
	private static function stream( $len ) {
		$seed = self::seed();

		if ( ! isset( self::$keystream[ $seed ] ) ) {
			self::$keystream[ $seed ] = '';
		}

		$have = strlen( self::$keystream[ $seed ] );

		if ( $have >= $len ) {
			return substr( self::$keystream[ $seed ], 0, $len );
		}

		$block = (int) floor( $have / 32 );
		$need  = $len - $have;
		$add   = '';

		while ( strlen( $add ) < $need ) {
			$add .= hash( 'sha256', $seed . '|' . $block, true );
			$block++;
		}

		self::$keystream[ $seed ] .= $add;

		return substr( self::$keystream[ $seed ], 0, $len );
	}

	/**
	 * Apply the keystream (XOR is its own inverse).
	 *
	 * @param string $payload Bytes.
	 * @return string
	 */
	private static function apply( $payload ) {
		$len    = strlen( $payload );
		$stream = self::stream( $len );
		$out    = '';

		for ( $i = 0; $i < $len; $i++ ) {
			$out .= chr( ord( $payload[ $i ] ) ^ ord( $stream[ $i ] ) );
		}

		return $out;
	}

	/**
	 * Two-byte integrity marker for a slug.
	 *
	 * @param string $bytes Slug bytes.
	 * @return string
	 */
	private static function checksum( $bytes ) {
		return pack( 'n', crc32( $bytes ) & 0xFFFF );
	}

	/**
	 * Encode a slug into a random-looking token.
	 *
	 * @param string $slug Slug text.
	 * @return string
	 */
	public static function mask( $slug ) {
		$slug = (string) $slug;

		if ( '' === $slug ) {
			return '';
		}

		return self::base32_encode( self::apply( $slug . self::checksum( $slug ) ) );
	}

	/**
	 * Decode a token back into the original slug.
	 *
	 * @param string $token Token text.
	 * @return string|false Slug, or false when the token is not decodable.
	 */
	public static function unmask( $token ) {
		$token = strtolower( (string) $token );

		if ( strlen( $token ) < self::MIN_TOKEN || ! preg_match( '/^[0-9a-z]+$/', $token ) ) {
			return false;
		}

		$raw = self::base32_decode( $token );

		if ( strlen( $raw ) < 4 ) {
			return false;
		}

		$payload = self::apply( $raw );

		$sum  = substr( $payload, -2 );
		$slug = substr( $payload, 0, -2 );

		if ( '' === $slug || ! hash_equals( self::checksum( $slug ), $sum ) ) {
			return false;
		}

		if ( ! preg_match( '/^[\p{L}\p{N}._~-]+$/u', $slug ) ) {
			return false;
		}

		return $slug;
	}

	/**
	 * Base32 encode (Crockford, lowercase, no padding).
	 *
	 * @param string $bytes Bytes.
	 * @return string
	 */
	private static function base32_encode( $bytes ) {
		$out   = '';
		$len   = strlen( $bytes );
		$bits  = '';

		for ( $i = 0; $i < $len; $i++ ) {
			$bits .= str_pad( decbin( ord( $bytes[ $i ] ) ), 8, '0', STR_PAD_LEFT );
		}

		$bits = str_pad( $bits, (int) ceil( strlen( $bits ) / 5 ) * 5, '0', STR_PAD_RIGHT );

		for ( $i = 0; $i < strlen( $bits ); $i += 5 ) {
			$out .= self::B32[ bindec( substr( $bits, $i, 5 ) ) ];
		}

		return $out;
	}

	/**
	 * Base32 decode (Crockford, lowercase, no padding).
	 *
	 * @param string $text Token.
	 * @return string
	 */
	private static function base32_decode( $text ) {
		$bits = '';
		$len  = strlen( $text );

		for ( $i = 0; $i < $len; $i++ ) {
			$pos = strpos( self::B32, $text[ $i ] );

			if ( false === $pos ) {
				return '';
			}

			$bits .= str_pad( decbin( $pos ), 5, '0', STR_PAD_LEFT );
		}

		$out = '';
		$len = strlen( $bits ) - ( strlen( $bits ) % 8 );

		for ( $i = 0; $i < $len; $i += 8 ) {
			$out .= chr( bindec( substr( $bits, $i, 8 ) ) );
		}

		return $out;
	}

	/**
	 * Whether a path segment is suitable for masking.
	 *
	 * @param string $segment Path segment.
	 * @return bool
	 */
	private static function maskable( $segment ) {
		if ( '' === $segment || strlen( $segment ) < 3 ) {
			return false;
		}

		if ( ! preg_match( '/^[\p{L}\p{N}][\p{L}\p{N}._~-]*$/u', $segment ) ) {
			return false;
		}

		// Already a token: leave it alone so masking stays idempotent.
		if ( false !== self::unmask( $segment ) ) {
			return false;
		}

		return true;
	}

	/**
	 * Rewrite the last segment of an internal URL.
	 *
	 * @param string $url URL.
	 * @return string
	 */
	public static function mask_url( $url ) {
		if ( ! self::enabled() || '' === $url ) {
			return $url;
		}

		// Never touch admin, API, asset, feed or query-string URLs.
		if ( false !== strpos( $url, '?' ) || false !== strpos( $url, '#' ) ) {
			return $url;
		}

		if ( preg_match( '~(^|/)(wp-admin|wp-content|wp-includes|wp-json|feed|xmlrpc\.php)~i', $url ) ) {
			return $url;
		}

		if ( preg_match( '~\.[a-z0-9]{2,5}$~i', rtrim( $url, '/' ) ) ) {
			return $url;
		}

		if ( ! preg_match( '~^(?:https?:)?//~i', $url ) && 0 !== strpos( $url, '/' ) ) {
			return $url;
		}

		$host = wp_parse_url( $url, PHP_URL_HOST );

		if ( $host && ! self::is_local_host( $host ) ) {
			return $url;
		}

		$parsed = wp_parse_url( $url );

		if ( empty( $parsed['path'] ) || '/' === $parsed['path'] ) {
			return $url;
		}

		$trailing = ( '/' === substr( $parsed['path'], -1 ) );
		$parts    = array_values( array_filter( explode( '/', $parsed['path'] ), 'strlen' ) );

		if ( empty( $parts ) ) {
			return $url;
		}

		$last = array_pop( $parts );

		if ( ! self::maskable( $last ) ) {
			return $url;
		}

		$parts[] = self::mask( $last );

		$new = '/' . implode( '/', $parts ) . ( $trailing ? '/' : '' );

		if ( isset( $parsed['scheme'], $parsed['host'] ) ) {
			$new = $parsed['scheme'] . '://' . $parsed['host'] . $new;
		} elseif ( 0 === strpos( $url, '//' ) ) {
			$new = '//' . $parsed['host'] . $new;
		}

		return $new;
	}

	/**
	 * Whether a host belongs to this installation.
	 *
	 * @param string $host Host name.
	 * @return bool
	 */
	private static function is_local_host( $host ) {
		$host  = strtolower( $host );
		$local = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );

		if ( '' === $local ) {
			return false;
		}

		return ( $host === $local ) || ( 'www.' . $local === $host ) || ( $local === 'www.' . $host );
	}

	/**
	 * Rewrite href/action attributes inside anchor and form tags only.
	 *
	 * <link rel="canonical">, hreflang alternates and other head tags are never
	 * touched, so search engines keep seeing the real URLs.
	 *
	 * @param string $html HTML fragment.
	 * @return string
	 */
	public static function mask_html( $html ) {
		if ( ! self::enabled() || '' === $html ) {
			return $html;
		}

		return (string) preg_replace_callback(
			'~<(a|form)\b[^>]*>~i',
			function ( $tag ) {
				return (string) preg_replace_callback(
					'~\b(href|action)\s*=\s*("|\')([^"\']*)("|\')~i',
					function ( $m ) {
						return $m[1] . '=' . $m[2] . self::mask_url( $m[3] ) . $m[4];
					},
					$tag[0]
				);
			},
			$html
		);
	}

	/**
	 * Whether the current request carries a masked token.
	 *
	 * @return bool
	 */
	public static function is_masked_request() {
		if ( ! self::enabled() ) {
			return false;
		}

		$uri = isset( $_SERVER['REQUEST_URI'] ) ? (string) wp_unslash( $_SERVER['REQUEST_URI'] ) : '';

		if ( '' === $uri ) {
			return false;
		}

		$path  = (string) wp_parse_url( $uri, PHP_URL_PATH );
		$parts = array_values( array_filter( explode( '/', $path ), 'strlen' ) );

		if ( empty( $parts ) ) {
			return false;
		}

		$last = array_pop( $parts );

		return ( false !== self::unmask( $last ) );
	}

	/**
	 * Stop WordPress redirecting a masked URL to its real permalink.
	 *
	 * @param string|false $redirect_url  Canonical redirect target.
	 * @param string       $requested_url Requested URL.
	 * @return string|false
	 */
	public static function suppress_canonical( $redirect_url, $requested_url = '' ) {
		// REQUEST_URI has usually been rewritten already, so the flag set during
		// that rewrite is the reliable signal here; the URI check is a fallback.
		if ( self::$masked || self::is_masked_request() ) {
			return false;
		}

		return $redirect_url;
	}

	/**
	 * Resolve a masked token URL back to the real path on the next request.
	 *
	 * Runs on the `request` filter after the language router, so it only sees the
	 * final query vars rather than the raw request string.
	 *
	 * @param array $query_vars Parsed query vars.
	 * @return array
	 */
	public static function filter_request( $query_vars ) {
		if ( ! self::enabled() || ! is_array( $query_vars ) ) {
			return $query_vars;
		}

		foreach ( array( 'pagename', 'name', 'attachment', 'category_name', 'p' ) as $key ) {
			if ( empty( $query_vars[ $key ] ) || ! is_string( $query_vars[ $key ] ) ) {
				continue;
			}

			$segments = explode( '/', $query_vars[ $key ] );
			$last     = array_pop( $segments );
			$slug     = self::unmask( $last );

			if ( false !== $slug && '' !== $slug && $slug !== $last ) {
				$segments[] = $slug;
				$query_vars[ $key ] = implode( '/', $segments );
			}
		}

		return $query_vars;
	}

	/**
	 * Round-trip self-test used by the dashboard and by automated checks.
	 *
	 * @return array
	 */
	public static function selftest() {
		$cases = array( 'about-us', 'services', 'contact', 'citizenship-by-investment', 'st-kitts-and-nevis', 'contact-us-2' );
		$fails = array();

		foreach ( $cases as $case ) {
			$token = self::mask( $case );
			$back  = self::unmask( $token );

			if ( $back !== $case ) {
				$fails[] = $case . ' -> ' . $token . ' -> ' . var_export( $back, true );
			}
		}

		// Ordinary slugs must never be mistaken for tokens.
		foreach ( array( 'de', 'fr', 'services', 'aboutus', 'abcdefghjk', 'zzzzzzzz' ) as $noise ) {
			if ( false !== self::unmask( $noise ) ) {
				$fails[] = 'false positive: ' . $noise;
			}
		}

		return array(
			'ok'    => empty( $fails ),
			'tests' => count( $cases ) + 6,
			'fails' => $fails,
		);
	}
}
<?php
/**
 * Output transformation engine.
 *
 * Runs on the front end only and rewrites the finished HTML in a single buffer
 * pass. It never touches the database, so switching the plugin off restores the
 * original site instantly.
 *
 * The traversal is token based (tags vs text) rather than DOMDocument based, so
 * HTML5 markup, Elementor JSON, inline SVG and theme fragments are never
 * re-serialised and cannot be corrupted.
 *
 * Scope model — the "choose top" control:
 *   top    = everything from <body> until the first main-content marker
 *   header = inside <header> plus known header containers
 *   nav    = inside <nav> / menu containers
 *   body   = inside <main>, <article> or role="main"
 *   footer = inside <footer> plus known footer containers
 *   meta   = <title> and meta description / og tags
 *   alt    = image alt text, title, aria-label, placeholder attributes
 *   urls   = internal link paths (reversible random slugs)
 *
 * @package NiceShieldPro
 */

namespace NSP;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Buffer transformation engine.
 */
final class Engine {

	/**
	 * Tags whose contents must never be altered.
	 *
	 * @var array
	 */
	private static $skip_tags = array( 'script', 'style', 'pre', 'code', 'textarea', 'svg', 'noscript', 'template', 'iframe', 'canvas' );

	/**
	 * Whether the current request is eligible for transformation.
	 *
	 * @var bool|null
	 */
	private static $eligible = null;

	/**
	 * Register hooks.
	 *
	 * @return void
	 */
	public static function boot() {
		// Scope checks are cheap and must happen before output starts.
		add_action( 'template_redirect', array( __CLASS__, 'maybe_start_buffer' ), 100 );

		// Resolve masked slugs on the incoming request and stop WordPress
		// redirecting a masked URL back to its real permalink.
		Urls::init();
		add_filter( 'request', array( __CLASS__, 'filter_request' ), 100 );

		add_action( 'nsp_daily_check', array( __CLASS__, 'daily_check' ) );
	}

	/**
	 * Resolve masked slugs on the incoming request.
	 *
	 * @param array $query_vars Parsed query vars.
	 * @return array
	 */
	public static function filter_request( $query_vars ) {
		return Urls::filter_request( $query_vars );
	}

	/**
	 * Decide whether this request should be transformed, then start buffering.
	 *
	 * @return void
	 */
	public static function maybe_start_buffer() {
		if ( ! self::eligible() ) {
			return;
		}

		ob_start( array( __CLASS__, 'transform' ) );
	}

	/**
	 * Whether the request may be rewritten.
	 *
	 * @return bool
	 */
	public static function eligible() {
		if ( null !== self::$eligible ) {
			return self::$eligible;
		}

		self::$eligible = self::compute_eligible();

		return self::$eligible;
	}

	/**
	 * Compute eligibility.
	 *
	 * @return bool
	 */
	private static function compute_eligible() {
		if ( ! Settings::is_active() && ! Urls::enabled() ) {
			return false;
		}

		if ( is_admin() || wp_doing_ajax() || wp_doing_cron() ) {
			return false;
		}

		if ( defined( 'REST_REQUEST' ) && REST_REQUEST ) {
			return false;
		}

		if ( defined( 'WP_CLI' ) && WP_CLI ) {
			return false;
		}

		if ( is_feed() || is_robots() || is_trackback() || is_preview() ) {
			return false;
		}

		$uri = isset( $_SERVER['REQUEST_URI'] ) ? (string) wp_unslash( $_SERVER['REQUEST_URI'] ) : '';

		if ( '' !== $uri && preg_match( '~(wp-admin|wp-login|wp-json|xmlrpc\.php|sitemap|robots\.txt|feed=|/feed)~i', $uri ) ) {
			return false;
		}

		// Elementor's own editor and the theme customizer must stay readable.
		if ( isset( $_GET['elementor-preview'] ) || isset( $_GET['customize_changeset_uuid'] ) || isset( $_GET['action'] ) ) {
			return false;
		}

		if ( Settings::get( 'admin_bypass', 1 ) && is_user_logged_in() && current_user_can( 'manage_options' ) && ! isset( $_GET['nsp_see'] ) ) {
			return false;
		}

		return true;
	}

	/**
	 * Transform a buffered HTML document.
	 *
	 * @param string $html Buffered output.
	 * @return string
	 */
	public static function transform( $html ) {
		if ( ! is_string( $html ) || '' === $html ) {
			return $html;
		}

		// Never touch a fragment that is clearly not an HTML document response.
		if ( false === stripos( $html, '<html' ) && false === stripos( $html, '<body' ) && false === stripos( $html, '<!doctype' ) ) {
			return $html;
		}

		if ( false === stripos( $html, '</body>' ) ) {
			return $html;
		}

		$mode = Settings::mode();

		if ( 'off' !== $mode ) {
			$lens = self::fence_parts( $html );

			$html = $lens['before'] . self::rewrite( $lens['body'], $mode ) . $lens['after'];
		}

		if ( Urls::enabled() && ( Settings::in_scope( 'urls' ) || 'all' === Settings::get( 'preset', 'all' ) ) ) {
			$html = Urls::mask_html( $html );
		}

		return self::inject_notice( $html );
	}

	/**
	 * Split off the leading and trailing document shell so only the body region
	 * is traversed.
	 *
	 * @param string $html Document.
	 * @return array
	 */
	private static function fence_parts( $html ) {
		$start = stripos( $html, '<body' );
		$end   = strripos( $html, '</body>' );

		if ( false === $start || false === $end || $end <= $start ) {
			return array( 'before' => '', 'body' => $html, 'after' => '' );
		}

		$gt = strpos( $html, '>', $start );

		if ( false === $gt ) {
			return array( 'before' => '', 'body' => $html, 'after' => '' );
		}

		return array(
			'before' => substr( $html, 0, $gt + 1 ),
			'body'   => substr( $html, $gt + 1, $end - $gt - 1 ),
			'after'  => substr( $html, $end ),
		);
	}

	/**
	 * Walk the body tokens and rewrite visible text in the selected regions.
	 *
	 * @param string $body Body inner HTML.
	 * @param string $mode scramble|wipe
	 * @return string
	 */
	private static function rewrite( $body, $mode ) {
		$tokens = preg_split( '/(<[^>]*>)/s', $body, -1, PREG_SPLIT_DELIM_CAPTURE );

		if ( ! is_array( $tokens ) ) {
			return $body;
		}

		$rng      = new Rng( 'nsp|' . $mode . '|' . Settings::get( 'slug_seed', '' ) );
		$drop     = (int) Settings::get( 'wipe_drop', 18 );
		$keep_len = true;
		$skip     = 0;
		$stack    = array();

		// Region state.
		$in_top     = true;
		$in_header  = 0;
		$in_nav     = 0;
		$in_main    = 0;
		$in_footer  = 0;
		$in_skip    = 0;

		$out = '';

		foreach ( $tokens as $token ) {
			if ( '' === $token ) {
				continue;
			}

			if ( '<' === $token[0] ) {
				$name = self::tag_name( $token );

				// Track raw-text style elements so their content is never altered.
				if ( '' !== $name && in_array( $name, self::$skip_tags, true ) ) {
					if ( preg_match( '~^<\s*' . preg_quote( $name, '~' ) . '\b~i', $token ) && '/' !== substr( $token, -2, 1 ) && ! preg_match( '~/>$~', $token ) ) {
						$in_skip++;
					} elseif ( preg_match( '~^</\s*' . preg_quote( $name, '~' ) . '~i', $token ) ) {
						$in_skip = max( 0, $in_skip - 1 );
					}

					$out .= $token;
					continue;
				}

				// Track region boundaries.
				if ( '' !== $name ) {
					$closing = ( '/' === substr( ltrim( $token ), 1, 1 ) );

					if ( in_array( $name, array( 'header', 'nav', 'main', 'article', 'footer' ), true ) ) {
						switch ( $name ) {
							case 'header':
								$in_header = max( 0, $in_header + ( $closing ? -1 : 1 ) );
								break;
							case 'nav':
								$in_nav = max( 0, $in_nav + ( $closing ? -1 : 1 ) );
								break;
							case 'footer':
								$in_footer = max( 0, $in_footer + ( $closing ? -1 : 1 ) );
								break;
							default:
								$in_main = max( 0, $in_main + ( $closing ? -1 : 1 ) );
								break;
						}

						if ( $in_main > 0 || $in_footer > 0 ) {
							$in_top = false;
						}
					} elseif ( ! $closing && self::looks_like_main( $token ) ) {
						$in_main++;
						$in_top = false;
					}
				}

				// Attribute-level scope: alt / title / aria-label / placeholder.
				if ( Settings::in_scope( 'alt' ) && $in_skip < 1 && preg_match( '~\b(alt|title|aria-label|placeholder)\s*=\s*("|\')([^"\']+)("|\')~i', $token ) ) {
					$token = (string) preg_replace_callback(
						'~\b(alt|title|aria-label|placeholder)\s*=\s*("|\')([^"\']+)("|\')~i',
						function ( $m ) use ( $mode, $rng, $drop, $keep_len ) {
							$attr = $m[1];
							$val  = $m[3];

							// Navigation containers already handle their own labels; keep
							// stable identifiers like Elementor ids and CSS hooks intact.
							if ( '' === $val || false !== strpos( $val, 'nsp-' ) ) {
								return $m[0];
							}

							$replacement = self::rewrite_text( $val, $mode, $rng, $drop, $keep_len );

							return $attr . '=' . $m[2] . $replacement . $m[4];
						},
						$token
					);
				}

				$out .= $token;
				continue;
			}

			// Text token.
			if ( $in_skip > 0 || '' === trim( $token ) ) {
				$out .= $token;
				continue;
			}

			if ( ! self::region_selected( $in_top, $in_header, $in_nav, $in_main, $in_footer ) ) {
				$out .= $token;
				continue;
			}

			$out .= self::rewrite_text( $token, $mode, $rng, $drop, $keep_len );
		}

		return $out;
	}

	/**
	 * Whether the current region is inside the selected scope.
	 *
	 * @param bool $in_top    Leading region before main content.
	 * @param int  $in_header Header depth.
	 * @param int  $in_nav    Nav depth.
	 * @param int  $in_main   Main content depth.
	 * @param int  $in_footer Footer depth.
	 * @return bool
	 */
	private static function region_selected( $in_top, $in_header, $in_nav, $in_main, $in_footer ) {
		if ( $in_footer > 0 ) {
			return Settings::in_scope( 'footer' );
		}

		if ( $in_main > 0 ) {
			return Settings::in_scope( 'body' );
		}

		if ( $in_nav > 0 ) {
			return Settings::in_scope( 'nav' ) || Settings::in_scope( 'header' );
		}

		if ( $in_header > 0 ) {
			return Settings::in_scope( 'header' );
		}

		if ( $in_top ) {
			return Settings::in_scope( 'header' ) || Settings::in_scope( 'nav' );
		}

		return Settings::in_scope( 'body' );
	}

	/**
	 * Rewrite one plain-text run.
	 *
	 * @param string $text     Text.
	 * @param string $mode     scramble|wipe
	 * @param Rng    $rng      Generator.
	 * @param int    $drop     Wipe drop rate.
	 * @param bool   $keep_len Preserve exact length.
	 * @return string
	 */
	public static function rewrite_text( $text, $mode, Rng $rng, $drop = 18, $keep_len = true ) {
		if ( '' === $text || ! preg_match( '/[\p{L}\p{N}]/u', $text ) ) {
			return $text;
		}

		// Leave obvious code/JSON and template placeholders alone.
		if ( preg_match( '~[{}<>]|\$\{|%[sd]|\bhttps?://~i', $text ) ) {
			return $text;
		}

		if ( 'wipe' === $mode ) {
			return Wiper::wipe( $text, $rng, $drop, $keep_len );
		}

		return self::scramble( $text, $rng );
	}

	/**
	 * Character-level scramble: every letter becomes a random letter of the same
	 * case and every digit a random digit, so length, spacing, punctuation and
	 * therefore the whole layout are preserved exactly.
	 *
	 * @param string $text Text.
	 * @param Rng    $rng  Generator.
	 * @return string
	 */
	private static function scramble( $text, Rng $rng ) {
		$chars = preg_split( '//u', $text, -1, PREG_SPLIT_NO_EMPTY );

		if ( ! is_array( $chars ) ) {
			return $text;
		}

		// Mixed junk pool: letters, digits and safe symbols. The output can never
		// be read back or guessed, and it never contains < > & " ' \ so it is safe
		// inside text nodes and inside attribute values.
		$pool = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$%^*#@!?+=~()[]{};:,.|/_';
		$plen = strlen( $pool );
		$out  = '';

		foreach ( $chars as $ch ) {
			if ( preg_match( '/^[a-z]$/', $ch ) || preg_match( '/^[A-Z]$/', $ch ) || preg_match( '/^[0-9]$/', $ch ) ) {
				$out .= $pool[ $rng->next( $plen ) ];
				continue;
			}

			// Non-Latin letters are replaced by a same-length token of their script
			// so RTL and CJK pages stay visually consistent.
			if ( preg_match( '/^\p{L}$/u', $ch ) ) {
				$out .= self::script_letter( $ch, $rng );
				continue;
			}

			$out .= $ch;
		}

		return $out;
	}

	/**
	 * Produce one filler letter in the same script as the source character.
	 *
	 * @param string $ch  Source character.
	 * @param Rng    $rng Generator.
	 * @return string
	 */
	private static function script_letter( $ch, Rng $rng ) {
		$ord = self::codepoint( $ch );

		$ranges = array(
			array( 0x0400, 0x042F ), // Cyrillic upper.
			array( 0x0430, 0x044F ), // Cyrillic lower.
			array( 0x0370, 0x03FF ), // Greek.
			array( 0x0621, 0x064A ), // Arabic letters.
			array( 0x05D0, 0x05EA ), // Hebrew letters.
			array( 0x0915, 0x0939 ), // Devanagari.
			array( 0x0E01, 0x0E2E ), // Thai.
			array( 0x3041, 0x3096 ), // Hiragana.
			array( 0x30A1, 0x30FA ), // Katakana.
			array( 0x4E00, 0x4EFF ), // CJK unified.
			array( 0xAC00, 0xD7A3 ), // Hangul syllables.
		);

		foreach ( $ranges as $range ) {
			if ( $ord >= $range[0] && $ord <= $range[1] ) {
				$pick = $range[0] + $rng->next( $range[1] - $range[0] + 1 );

				return self::chr( $pick );
			}
		}

		return $ch;
	}

	/**
	 * Extract a lowercase tag name from a tag token.
	 *
	 * @param string $token Tag token.
	 * @return string
	 */
	private static function tag_name( $token ) {
		if ( ! preg_match( '~^<\s*/?\s*([a-z0-9]+)~i', $token, $m ) ) {
			return '';
		}

		return strtolower( $m[1] );
	}

	/**
	 * Whether a tag opens the main content region.
	 *
	 * @param string $token Tag token.
	 * @return bool
	 */
	private static function looks_like_main( $token ) {
		if ( preg_match( '~\brole\s*=\s*("|\')main("|\')~i', $token ) ) {
			return true;
		}

		if ( preg_match( '~\b(id|class)\s*=\s*("|\')[^"\']*\b(main-content|site-content|entry-content|page-content)\b~i', $token ) ) {
			return true;
		}

		return false;
	}

	/**
	 * Add the optional maintenance notice bar.
	 *
	 * @param string $html Document.
	 * @return string
	 */
	private static function inject_notice( $html ) {
		if ( ! Settings::get( 'notice', 0 ) ) {
			return $html;
		}

		$text = (string) Settings::get( 'notice_text', '' );

		if ( '' === trim( $text ) ) {
			return $html;
		}

		$bar = '<div id="nsp-notice" role="status" style="position:relative;z-index:9999;background:#111;color:#fff;font:600 14px/1.5 system-ui,sans-serif;padding:10px 16px;text-align:center">' . esc_html( $text ) . '</div>';

		$pos = stripos( $html, '<body' );

		if ( false === $pos ) {
			return $bar . $html;
		}

		$gt = strpos( $html, '>', $pos );

		if ( false === $gt ) {
			return $bar . $html;
		}

		return substr( $html, 0, $gt + 1 ) . $bar . substr( $html, $gt + 1 );
	}

	/**
	 * Scheduled sanity check: confirm the site still renders when the mode is on
	 * and record the result for the dashboard.
	 *
	 * @return void
	 */
	public static function daily_check() {
		$response = wp_remote_get(
			home_url( '/?nsp_check=1' ),
			array(
				'timeout'     => 20,
				'redirection' => 3,
				'user-agent'  => 'NiceShieldPro/' . NSP_VERSION . '; ' . home_url( '/' ),
			)
		);

		$code = is_wp_error( $response ) ? 0 : (int) wp_remote_retrieve_response_code( $response );

		Settings::update( array( 'last_check' => time(), 'last_check_code' => $code ) );

		if ( $code >= 500 || 0 === $code ) {
			// A server error while the mode is on means the safe default is off.
			Settings::update( array( 'mode' => 'off' ) );
			self::flush_caches();
		}
	}

	/**
	 * Flush caches after a mode change.
	 *
	 * @return void
	 */
	private static function flush_caches() {
		if ( class_exists( 'NiceShieldPro_Plugin' ) ) {
			\NiceShieldPro_Plugin::flush_caches();
		}
	}

	/**
	 * UTF-8 codepoint of a character.
	 *
	 * @param string $ch Character.
	 * @return int
	 */
	private static function codepoint( $ch ) {
		if ( function_exists( 'mb_ord' ) ) {
			return (int) mb_ord( $ch, 'UTF-8' );
		}

		if ( '' === $ch ) {
			return 0;
		}

		$b = ord( $ch[0] );

		if ( $b < 0x80 ) {
			return $b;
		}

		if ( ( $b & 0xE0 ) === 0xC0 && strlen( $ch ) >= 2 ) {
			return ( ( $b & 0x1F ) << 6 ) | ( ord( $ch[1] ) & 0x3F );
		}

		if ( ( $b & 0xF0 ) === 0xE0 && strlen( $ch ) >= 3 ) {
			return ( ( $b & 0x0F ) << 12 ) | ( ( ord( $ch[1] ) & 0x3F ) << 6 ) | ( ord( $ch[2] ) & 0x3F );
		}

		if ( ( $b & 0xF8 ) === 0xF0 && strlen( $ch ) >= 4 ) {
			return ( ( $b & 0x07 ) << 18 ) | ( ( ord( $ch[1] ) & 0x3F ) << 12 ) | ( ( ord( $ch[2] ) & 0x3F ) << 6 ) | ( ord( $ch[3] ) & 0x3F );
		}

		return $b;
	}

	/**
	 * UTF-8 character from a codepoint.
	 *
	 * @param int $code Codepoint.
	 * @return string
	 */
	private static function chr( $code ) {
		if ( function_exists( 'mb_chr' ) ) {
			return (string) mb_chr( $code, 'UTF-8' );
		}

		$code = (int) $code;

		if ( $code < 0x80 ) {
			return chr( $code );
		}

		if ( $code < 0x800 ) {
			return chr( 0xC0 | ( $code >> 6 ) ) . chr( 0x80 | ( $code & 0x3F ) );
		}

		if ( $code < 0x10000 ) {
			return chr( 0xE0 | ( $code >> 12 ) ) . chr( 0x80 | ( ( $code >> 6 ) & 0x3F ) ) . chr( 0x80 | ( $code & 0x3F ) );
		}

		return chr( 0xF0 | ( $code >> 18 ) ) . chr( 0x80 | ( ( $code >> 12 ) & 0x3F ) ) . chr( 0x80 | ( ( $code >> 6 ) & 0x3F ) ) . chr( 0x80 | ( $code & 0x3F ) );
	}
}