<h2>File Contents: /home/planet5/public_html/wp-content/plugins/broken-link-checker/legacy/modules/checkers/http.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-content/plugins/broken-link-checker/legacy/modules/checkers/http.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php

/*
Plugin Name: Basic HTTP
Description: Check all links that have the HTTP/HTTPS protocol.
Version: 1.0
Author: Janis Elsts

ModuleID: http
ModuleCategory: checker
ModuleContext: on-demand
ModuleLazyInit: true
ModuleClassName: blcHttpChecker
ModulePriority: -1
*/

require_once BLC_DIRECTORY_LEGACY . &#039;/includes/token-bucket.php&#039;;

// TODO: Rewrite sub-classes as transports, not stand-alone checkers
class blcHttpChecker extends blcChecker {
	/* @var blcChecker */
	var $implementation = null;

	/** @var  blcTokenBucketList */
	private $token_bucket_list;

	function init() {
		parent::init();

		$conf                    = blc_get_configuration();
		$this-&gt;token_bucket_list = new blcTokenBucketList(
			$conf-&gt;get( &#039;http_throttle_rate&#039;, 3 ),
			$conf-&gt;get( &#039;http_throttle_period&#039;, 15 ),
			$conf-&gt;get( &#039;http_throttle_min_interval&#039;, 2 )
		);

		if ( apply_filters( &#039;wpmudev_blc_local_use_curl&#039;, function_exists( &#039;curl_init&#039; ) || is_callable( &#039;curl_init&#039; ) )  ) {
			$this-&gt;implementation = new blcCurlHttp(
				$this-&gt;module_id,
				$this-&gt;cached_header,
				$this-&gt;plugin_conf,
				$this-&gt;module_manager
			);
		} else {
			// try and use wp request method
			$this-&gt;implementation = new blcWPHttp(
				$this-&gt;module_id,
				$this-&gt;cached_header,
				$this-&gt;plugin_conf,
				$this-&gt;module_manager
			);
		}
	}

	function can_check( $url, $parsed ) {
		if ( isset( $this-&gt;implementation ) ) {
			return $this-&gt;implementation-&gt;can_check( $url, $parsed );
		} else {
			return false;
		}
	}

	function check( $url, $use_get = false ) {
		global $blclog;

		// Throttle requests based on the domain name.
		$domain = @parse_url( $url, PHP_URL_HOST );
		if ( $domain ) {
			$this-&gt;token_bucket_list-&gt;takeToken( $domain );
		}

		$blclog-&gt;debug( &#039;HTTP module checking &quot;&#039; . $url . &#039;&quot;&#039; );
		return $this-&gt;implementation-&gt;check( $url, $use_get );
	}
}


/**
 * Base class for checkers that deal with HTTP(S) URLs.
 *
 * @package Broken Link Checker
 * @access public
 */
class blcHttpCheckerBase extends blcChecker {

	function clean_url( $url ) {
		$url = html_entity_decode( $url );

		$ltrm = preg_quote( json_decode( &#039;&quot;\u200E&quot;&#039; ), &#039;/&#039; );
		$url  = preg_replace(
			array(
				&#039;/([\?&amp;]PHPSESSID=\w+)$/i&#039;, // remove session ID
				&#039;/(#[^\/]*)$/&#039;,             // and anchors/fragments
				&#039;/&amp;amp;/&#039;,                  // convert improper HTML entities
				&#039;/([\?&amp;]sid=\w+)$/i&#039;,       // remove another flavour of session ID
				&#039;/&#039; . $ltrm . &#039;/&#039;,          // remove Left-to-Right marks that can show up when copying from Word.
			),
			array( &#039;&#039;, &#039;&#039;, &#039;&amp;&#039;, &#039;&#039;, &#039;&#039; ),
			$url
		);
		$url  = trim( $url );

		return $url;
	}

	function is_error_code( $http_code ) {
		/*
		&quot;Good&quot; response codes are anything in the 2XX range (e.g &quot;200 OK&quot;) and redirects  - the 3XX range.
		  HTTP 401 Unauthorized is a special case that is considered OK as well. Other errors - the 4XX range -
		  are treated as such. */
		$good_code = ( ( $http_code &gt;= 200 ) &amp;&amp; ( $http_code &lt; 400 ) ) || ( 401 === $http_code );
		return ! $good_code;
	}

	/**
	 * This checker only accepts HTTP(s) links.
	 *
	 * @param string     $url
	 * @param array|bool $parsed
	 * @return bool
	 */
	function can_check( $url, $parsed ) {
		if ( ! isset( $parsed[&#039;scheme&#039;] ) ) {
			return false;
		}

		return in_array( strtolower( $parsed[&#039;scheme&#039;] ), array( &#039;http&#039;, &#039;https&#039; ) );
	}

	/**
	 * Takes an URL and replaces spaces and some other non-alphanumeric characters with their urlencoded equivalents.
	 *
	 * @param string $url
	 * @return string
	 */
	function urlencodefix( $url ) {
		// TODO: Remove/fix this. Probably not a good idea to &quot;fix&quot; invalid URLs like that.
		return preg_replace_callback(
			&#039;|[^a-z0-9\+\-\/\\#:.,;=?!&amp;%@()$\|*~_]|i&#039;,
			function( $str ) {
				return rawurlencode( $str[0] );
			},
			$url
		);
	}

	/**
	 * IP ranges a link check must never be allowed to reach.
	 *
	 * wp_http_validate_url() performs a similar check, but the set of ranges it
	 * covers has grown over time: the IANA special-purpose ranges (link-local,
	 * CGNAT, TEST-NET, multicast, reserved) were added to WordPress core
	 * comparatively recently, while this plugin still supports considerably
	 * older versions. Delegating the whole boundary to core would therefore
	 * leave cloud metadata endpoints such as 169.254.169.254 reachable on the
	 * older versions we support, so the ranges are restated here and enforced
	 * by the plugin regardless of which core version happens to be running.
	 *
	 * @var string[]
	 */
	const BLOCKED_IP_RANGES = array(
		// IPv4.
		&#039;0.0.0.0/8&#039;,        // &quot;This network&quot;.
		&#039;10.0.0.0/8&#039;,       // Private.
		&#039;100.64.0.0/10&#039;,    // Carrier-grade NAT.
		&#039;127.0.0.0/8&#039;,      // Loopback.
		&#039;169.254.0.0/16&#039;,   // Link-local, includes the cloud metadata endpoints.
		&#039;172.16.0.0/12&#039;,    // Private.
		&#039;192.0.0.0/24&#039;,     // IETF protocol assignments.
		&#039;192.0.2.0/24&#039;,     // TEST-NET-1.
		&#039;192.88.99.0/24&#039;,   // 6to4 relay anycast.
		&#039;192.168.0.0/16&#039;,   // Private.
		&#039;198.18.0.0/15&#039;,    // Benchmarking.
		&#039;198.51.100.0/24&#039;,  // TEST-NET-2.
		&#039;203.0.113.0/24&#039;,   // TEST-NET-3.
		&#039;224.0.0.0/4&#039;,      // Multicast.
		&#039;240.0.0.0/4&#039;,      // Reserved, includes the 255.255.255.255 broadcast address.

		// IPv6.
		&#039;::/128&#039;,           // Unspecified.
		&#039;::1/128&#039;,          // Loopback.
		&#039;::ffff:0:0/96&#039;,    // IPv4-mapped.
		&#039;64:ff9b::/96&#039;,     // IPv4/IPv6 translation.
		&#039;100::/64&#039;,         // Discard-only.
		&#039;2001:db8::/32&#039;,    // Documentation.
		&#039;fc00::/7&#039;,         // Unique local.
		&#039;fe80::/10&#039;,        // Link-local.
		&#039;ff00::/8&#039;,         // Multicast.
	);

	/**
	 * Determine whether an IP address falls inside a CIDR range.
	 *
	 * Compares the packed representations so that both address families are
	 * handled without the caller having to know which one it is looking at.
	 *
	 * @param string $ip   IP address in presentation format.
	 * @param string $cidr Range in CIDR notation.
	 * @return bool
	 */
	protected function ip_in_cidr( $ip, $cidr ) {
		if ( false === strpos( $cidr, &#039;/&#039; ) ) {
			return false;
		}

		list( $subnet, $prefix ) = explode( &#039;/&#039;, $cidr, 2 );

		$packed_ip     = @inet_pton( $ip );
		$packed_subnet = @inet_pton( $subnet );

		// Differing lengths mean the two belong to different address families.
		if ( false === $packed_ip || false === $packed_subnet || strlen( $packed_ip ) !== strlen( $packed_subnet ) ) {
			return false;
		}

		$prefix = (int) $prefix;
		if ( $prefix &lt; 0 || $prefix &gt; strlen( $packed_ip ) * 8 ) {
			return false;
		}

		$whole_bytes    = intdiv( $prefix, 8 );
		$remaining_bits = $prefix % 8;

		if ( $whole_bytes &gt; 0 &amp;&amp; 0 !== strncmp( $packed_ip, $packed_subnet, $whole_bytes ) ) {
			return false;
		}

		if ( 0 === $remaining_bits ) {
			return true;
		}

		$mask = chr( ( 0xFF &lt;&lt; ( 8 - $remaining_bits ) ) &amp; 0xFF );

		return ( $packed_ip[ $whole_bytes ] &amp; $mask ) === ( $packed_subnet[ $whole_bytes ] &amp; $mask );
	}

	/**
	 * Determine whether an IP address is one the plugin must not connect to.
	 *
	 * @param string $ip IP address in presentation format.
	 * @return bool
	 */
	public function is_blocked_ip( $ip ) {
		// Anything that will not parse as an address is not something we can vouch for.
		if ( ! filter_var( $ip, FILTER_VALIDATE_IP ) ) {
			return true;
		}

		foreach ( self::BLOCKED_IP_RANGES as $range ) {
			if ( $this-&gt;ip_in_cidr( $ip, $range ) ) {
				return true;
			}
		}

		return false;
	}

	/**
	 * Resolve a host name to every address it currently answers with.
	 *
	 * Both address families are looked up. wp_http_validate_url() consults only
	 * gethostbyname(), which is IPv4-only, so a host answering with an innocuous
	 * A record and a loopback AAAA record would otherwise pass validation and
	 * then be reached over IPv6.
	 *
	 * @param string $host Host name, or an IP address literal.
	 * @return string[] Addresses in presentation format, empty when the host does not resolve.
	 */
	protected function resolve_host( $host ) {
		if ( filter_var( $host, FILTER_VALIDATE_IP ) ) {
			return array( $host );
		}

		$addresses = array();

		$records = @dns_get_record( $host, DNS_A | DNS_AAAA );
		if ( is_array( $records ) ) {
			foreach ( $records as $record ) {
				if ( ! empty( $record[&#039;ip&#039;] ) ) {
					$addresses[] = $record[&#039;ip&#039;];
				} elseif ( ! empty( $record[&#039;ipv6&#039;] ) ) {
					$addresses[] = $record[&#039;ipv6&#039;];
				}
			}
		}

		// dns_get_record() is neither available nor useful on every host, so fall
		// back to the same lookup core performs.
		if ( empty( $addresses ) ) {
			$resolved = @gethostbyname( $host );
			if ( ! empty( $resolved ) &amp;&amp; $resolved !== $host ) {
				$addresses[] = $resolved;
			}
		}

		return $addresses;
	}

	/**
	 * Determine whether the plugin is allowed to request a URL.
	 *
	 * This has to be applied to every URL the checker is about to request,
	 * each redirect target included, and not only to the URL a check started
	 * with.
	 *
	 * @param string $url URL to test.
	 * @return bool
	 */
	public function is_safe_url( $url ) {
		if ( ! wp_http_validate_url( $url ) ) {
			return false;
		}

		$host = @parse_url( $url, PHP_URL_HOST );
		if ( empty( $host ) ) {
			return false;
		}

		$host = trim( $host, &#039;.&#039; );

		// Links pointing back at the site itself are legitimate even when the site
		// is served from a private address, which is the case on a great many
		// intranet and staging installs. Core makes the same exemption, and the
		// port allow-list still applies to these URLs.
		$home = @parse_url( get_option( &#039;home&#039; ), PHP_URL_HOST );
		if ( ! empty( $home ) &amp;&amp; strtolower( $home ) === strtolower( $host ) ) {
			return true;
		}

		$addresses = $this-&gt;resolve_host( $host );

		// A host we cannot resolve is a host we cannot clear.
		if ( empty( $addresses ) ) {
			return false;
		}

		foreach ( $addresses as $address ) {
			if ( $this-&gt;is_blocked_ip( $address ) ) {
				return false;
			}
		}

		return true;
	}

}

class blcCurlHttp extends blcHttpCheckerBase {

	var $last_headers = &#039;&#039;;

	function check( $url, $use_get = false ) {
		global $blclog;
		$blclog-&gt;info( __CLASS__ . &#039; Checking link&#039;, $url );

		$log                = &#039;&#039;;
		$this-&gt;last_headers = &#039;&#039;;
		$result             = array(
			&#039;broken&#039;  =&gt; false,
			&#039;timeout&#039; =&gt; false,
			&#039;warning&#039; =&gt; false,
		);

		/*
		 * Normalise first and validate afterwards, so the string that gets checked
		 * is the string that ultimately gets requested. clean_url() runs
		 * html_entity_decode(), so validating ahead of it would leave the two free
		 * to disagree about where the URL actually points.
		 */
		$url = wp_kses_bad_protocol( $this-&gt;clean_url( $url ), array( &#039;http&#039;, &#039;https&#039;, &#039;ssl&#039; ) );
		$url = wp_http_validate_url( $url );

		if ( empty( $url ) || ! $this-&gt;is_safe_url( $url ) ) {
			$blclog-&gt;error( __CLASS__ . &#039; Invalid URL:&#039;, $url );

			$result = array(
				&#039;warning&#039;     =&gt; true,
				&#039;log&#039;         =&gt; &quot;Invalid URL.\nURL fails to pass validation for safe use in the HTTP API.&quot;,
				&#039;status_text&#039; =&gt; __( &#039;Invalid URL&#039;, &#039;broken-link-checker&#039; ),
				&#039;error_code&#039;  =&gt; &#039;invalid_url&#039;,
				&#039;status_code&#039; =&gt; BLC_LINK_STATUS_WARNING,
			);

			return $result;
		}

		$blclog-&gt;debug( __CLASS__ . &#039; Clean URL:&#039;, $url );

		// Get the BLC configuration. It&#039;s used below to set the right timeout values and such.
		$conf = blc_get_configuration();

		$nobody = ! $use_get; // Whether to send a HEAD request (the default) or a GET request

		/*
		 * Walk the redirect chain here rather than handing it to cURL, so that every
		 * hop can be validated before it is requested. CURLOPT_FOLLOWLOCATION was
		 * used previously, which meant only the URL the check started with was ever
		 * validated: a Location header pointing at a loopback, private or link-local
		 * address was followed without question.
		 *
		 * Driving the chain ourselves also means redirects are now followed on hosts
		 * with open_basedir enabled, where cURL refuses to follow them at all.
		 */
		$max_redirects  = 10;
		$redirect_count = 0;
		$request_url    = $url;
		$final_url      = $url;
		$blocked_url    = &#039;&#039;;

		// Durations are accumulated across every hop, because cURL used to report
		// the time for the whole chain and the timeout heuristic below is tuned
		// against that.
		$total_duration          = 0;
		$total_measured_duration = 0;

		while ( true ) {
			$response  = $this-&gt;perform_request( $request_url, $nobody, $conf, $use_get );
			$final_url = $request_url;
			$http_code = intval( $response[&#039;info&#039;][&#039;http_code&#039;] );

			$total_duration          += empty( $response[&#039;info&#039;][&#039;total_time&#039;] ) ? 0 : $response[&#039;info&#039;][&#039;total_time&#039;];
			$total_measured_duration += $response[&#039;measured_duration&#039;];

			// Anything that is not a redirect is the end of the chain.
			if ( $http_code &lt; 300 || $http_code &gt;= 400 ) {
				break;
			}

			// With redirect following disabled, cURL resolves the target for us.
			$next_url = empty( $response[&#039;info&#039;][&#039;redirect_url&#039;] ) ? &#039;&#039; : $response[&#039;info&#039;][&#039;redirect_url&#039;];
			if ( &#039;&#039; === $next_url ) {
				break;
			}

			if ( $redirect_count &gt;= $max_redirects ) {
				$log .= sprintf( &quot;[Warning] Stopped following redirects after %d hops.\n&quot;, $max_redirects );
				break;
			}

			if ( ! $this-&gt;is_safe_url( $next_url ) ) {
				$blocked_url = $next_url;
				break;
			}

			$request_url = $next_url;
			++$redirect_count;
		}

		$content                   = $response[&#039;content&#039;];
		$info                      = $response[&#039;info&#039;];
		$measured_request_duration = $total_measured_duration;

		// Store the results
		$result[&#039;http_code&#039;]        = intval( $info[&#039;http_code&#039;] );
		$result[&#039;final_url&#039;]        = $final_url;
		$result[&#039;request_duration&#039;] = $total_duration;
		$result[&#039;redirect_count&#039;]   = $redirect_count;

		/*
		 * The chain ended at a target we are not allowed to request. Report the link
		 * as unverified instead of following it, and deliberately do not expose the
		 * blocked target: a non-zero redirect_count paired with a final_url is what
		 * the &quot;Fix redirect&quot; action rewrites post content to, and we have not
		 * established where this chain actually ends. Only the host is logged, and
		 * it is escaped at write time like the rest of the log.
		 */
		if ( &#039;&#039; !== $blocked_url ) {
			$blocked_host = @parse_url( $blocked_url, PHP_URL_HOST );

			$result[&#039;final_url&#039;]      = $url;
			$result[&#039;redirect_count&#039;] = 0;
			$result[&#039;broken&#039;]         = false;
			$result[&#039;warning&#039;]        = true;
			$result[&#039;status_code&#039;]    = BLC_LINK_STATUS_WARNING;
			$result[&#039;status_text&#039;]    = __( &#039;Unsafe Redirect&#039;, &#039;broken-link-checker&#039; );
			$result[&#039;error_code&#039;]     = &#039;unsafe_redirect&#039;;

			$log .= sprintf(
				/* translators: %s: host name of the redirect target that was refused. */
				__( &#039;Refused to follow a redirect to &quot;%s&quot; because it resolves to a private, loopback or otherwise reserved address.&#039;, &#039;broken-link-checker&#039; ),
				esc_html( (string) $blocked_host )
			) . &quot;\n&quot;;

			$blclog-&gt;error( __CLASS__ . &#039; Refused an unsafe redirect for:&#039;, $url );

			$result[&#039;log&#039;] = $log;

			$result[&#039;result_hash&#039;] = implode(
				&#039;|&#039;,
				array(
					$result[&#039;http_code&#039;],
					&#039;0&#039;,
					&#039;0&#039;,
					blcLink::remove_query_string( $result[&#039;final_url&#039;] ),
				)
			);

			return $result;
		}

		// CURL doesn&#039;t return a request duration when a timeout happens, so we measure it ourselves.
		// It is useful to see how long the plugin waited for the server to respond before assuming it timed out.
		if ( empty( $result[&#039;request_duration&#039;] ) ) {
			$result[&#039;request_duration&#039;] = $measured_request_duration;
		}

		// Preserve the final destination&#039;s HTTP code for broken-link detection.
		// $result[&#039;http_code&#039;] may be overridden below with the redirect code for display.
		$final_http_code = $result[&#039;http_code&#039;];

		// If at least one redirect occurred, extract the first redirect status code
		// from the accumulated response headers so the Status column displays 301/302.
		if ( $result[&#039;redirect_count&#039;] &gt; 0 ) {
			if ( preg_match( &#039;/^HTTP\/\S+\s+(\d+)/m&#039;, $this-&gt;last_headers, $matches ) ) {
				$redirect_code = intval( $matches[1] );
				if ( $redirect_code &gt;= 300 &amp;&amp; $redirect_code &lt; 400 ) {
					$result[&#039;http_code&#039;] = $redirect_code;
				}
			}
		}

		// Determine if the link counts as &quot;broken&quot;
		if ( 0 === absint( $final_http_code ) ) {
			$result[&#039;broken&#039;] = true;

			$error_code = $response[&#039;errno&#039;];
			$log       .= sprintf( &quot;%s [Error #%d]\n&quot;, $response[&#039;error&#039;], $error_code );

			// We only handle a couple of CURL error codes; most are highly esoteric.
			// libcurl &quot;CURLE_&quot; constants can&#039;t be used here because some of them have
			// different names or values in PHP.
			switch ( $error_code ) {
				case 6: // CURLE_COULDNT_RESOLVE_HOST
					$result[&#039;status_code&#039;] = BLC_LINK_STATUS_WARNING;
					$result[&#039;status_text&#039;] = __( &#039;Server Not Found&#039;, &#039;broken-link-checker&#039; );
					$result[&#039;error_code&#039;]  = &#039;couldnt_resolve_host&#039;;
					break;

				case 28: // CURLE_OPERATION_TIMEDOUT
					$result[&#039;timeout&#039;] = true;
					break;

				case 7: // CURLE_COULDNT_CONNECT
					// More often than not, this error code indicates that the connection attempt
					// timed out. This heuristic tries to distinguish between connections that fail
					// due to timeouts and those that fail due to other causes.
					if ( $result[&#039;request_duration&#039;] &gt;= 0.9 * $conf-&gt;options[&#039;timeout&#039;] ) {
						$result[&#039;timeout&#039;] = true;
					} else {
						$result[&#039;status_code&#039;] = BLC_LINK_STATUS_WARNING;
						$result[&#039;status_text&#039;] = __( &#039;Connection Failed&#039;, &#039;broken-link-checker&#039; );
						$result[&#039;error_code&#039;]  = &#039;connection_failed&#039;;
					}
					break;

				default:
					$result[&#039;status_code&#039;] = BLC_LINK_STATUS_WARNING;
					$result[&#039;status_text&#039;] = __( &#039;Unknown Error&#039;, &#039;broken-link-checker&#039; );
			}
		} elseif ( 999 === $final_http_code ) {
			$result[&#039;status_code&#039;] = BLC_LINK_STATUS_WARNING;
			$result[&#039;status_text&#039;] = __( &#039;Unknown Error&#039;, &#039;broken-link-checker&#039; );
			$result[&#039;warning&#039;]     = true;
		} else {
			$result[&#039;broken&#039;] = $this-&gt;is_error_code( $final_http_code );
		}

		$blclog-&gt;info(
			sprintf(
				&#039;HTTP response: %d, duration: %.2f seconds, status text: &quot;%s&quot;&#039;,
				$result[&#039;http_code&#039;],
				$result[&#039;request_duration&#039;],
				isset( $result[&#039;status_text&#039;] ) ? $result[&#039;status_text&#039;] : &#039;N/A&#039;
			)
		);

		$use_get = apply_filters( &#039;blc_use_get_checker&#039;, false, $result );

		if ( $nobody &amp;&amp; ! $result[&#039;timeout&#039;] &amp;&amp; ! $use_get &amp;&amp; ( $result[&#039;broken&#039;] || $result[&#039;redirect_count&#039;] == 1 ) ) {
			// The site in question might be expecting GET instead of HEAD, so lets retry the request
			// using the GET verb...but not in cases of timeout, or where we&#039;ve already done it.
			return $this-&gt;check( $url, true );

			// Note : normally a server that doesn&#039;t allow HEAD requests on a specific resource *should*
			// return &quot;405 Method Not Allowed&quot;. Unfortunately, there are sites that return 404 or
			// another, even more general, error code instead. So just checking for 405 wouldn&#039;t be enough.
		}

		// A redirect we did not follow - one with no usable Location header, or one
		// that hit the hop limit - still reads as a redirect in the Status column.
		if ( ( 0 === absint( $result[&#039;redirect_count&#039;] ) ) &amp;&amp; ( in_array( $result[&#039;http_code&#039;], array( 301, 302, 303, 307 ) ) ) ) {
			$result[&#039;redirect_count&#039;] = 1;
		}

		// Build the log from HTTP code and headers.
		$log .= &#039;=== &#039;;
		if ( $result[&#039;http_code&#039;] ) {
			$log .= sprintf( __( &#039;HTTP code : %d&#039;, &#039;broken-link-checker&#039; ), $result[&#039;http_code&#039;] );
		} else {
			$log .= __( &#039;(No response)&#039;, &#039;broken-link-checker&#039; );
		}
		$log .= &quot; ===\n\n&quot;;

		$log .= &quot;Response headers\n&quot; . str_repeat( &#039;=&#039;, 16 ) . &quot;\n&quot;;
		$log .= htmlentities( $this-&gt;last_headers );

		if ( isset( $info[&#039;request_header&#039;] ) ) {
			$log .= &quot;Request headers\n&quot; . str_repeat( &#039;=&#039;, 16 ) . &quot;\n&quot;;
			$log .= htmlentities( $info[&#039;request_header&#039;] );
		}

		if ( ! $nobody &amp;&amp; ( false !== $content ) &amp;&amp; $result[&#039;broken&#039;] ) {
			$log .= &quot;Response HTML\n&quot; . str_repeat( &#039;=&#039;, 16 ) . &quot;\n&quot;;
			$log .= htmlentities( substr( $content, 0, 2048 ) );
		}

		if ( ! empty( $result[&#039;broken&#039;] ) &amp;&amp; ! empty( $result[&#039;timeout&#039;] ) ) {
			$log .= &quot;\n(&quot; . __( &quot;Most likely the connection timed out or the domain doesn&#039;t exist.&quot;, &#039;broken-link-checker&#039; ) . &#039;)&#039;;
		}

		$result[&#039;log&#039;] = $log;

		// The hash should contain info about all pieces of data that pertain to determining if the
		// link is working.
		$result[&#039;result_hash&#039;] = implode(
			&#039;|&#039;,
			array(
				$result[&#039;http_code&#039;],
				! empty( $result[&#039;broken&#039;] ) ? &#039;broken&#039; : &#039;0&#039;,
				! empty( $result[&#039;timeout&#039;] ) ? &#039;timeout&#039; : &#039;0&#039;,
				blcLink::remove_query_string( $result[&#039;final_url&#039;] ),
			)
		);

		return $result;
	}

	/**
	 * Pin the transport options that must not be negotiable.
	 *
	 * These are applied after the &#039;broken-link-checker-curl-options&#039; filter on
	 * purpose. That filter is public, and anything switching redirect following
	 * back on through it would hand the redirect chain to cURL again and quietly
	 * undo the per-hop validation check() performs.
	 *
	 * @param resource|\CurlHandle $ch cURL handle.
	 */
	protected function apply_transport_restrictions( $ch ) {
		// check() walks the redirect chain itself, clearing every hop before it is
		// requested. cURL must never follow one on its own.
		curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, false );
		curl_setopt( $ch, CURLOPT_MAXREDIRS, 0 );

		/*
		 * Hold the transport to the two schemes this checker claims to handle.
		 * CURLOPT_PROTOCOLS is deprecated in newer libcurl builds in favour of the
		 * string form, so use whichever one the running version provides.
		 */
		if ( defined( &#039;CURLOPT_PROTOCOLS_STR&#039; ) ) {
			curl_setopt( $ch, CURLOPT_PROTOCOLS_STR, &#039;http,https&#039; );
		} elseif ( defined( &#039;CURLPROTO_HTTP&#039; ) &amp;&amp; defined( &#039;CURLPROTO_HTTPS&#039; ) ) {
			curl_setopt( $ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS );
		}
	}

	/**
	 * Perform a single HTTP request, without following redirects.
	 *
	 * Redirect following is deliberately left off. check() drives the redirect
	 * chain itself so every hop can be validated before it is requested, which
	 * is what stops an attacker-supplied Location header from reaching hosts the
	 * plugin is not allowed to talk to.
	 *
	 * @param string $url     URL to request. Must already have been cleared by is_safe_url().
	 * @param bool   $nobody  Whether to send a HEAD request rather than a GET.
	 * @param object $conf    Plugin configuration.
	 * @param bool   $use_get Whether this is the GET retry. Passed to the user agent filter.
	 * @return array {
	 *     @type string|false $content           Response body, or false when the request failed.
	 *     @type array        $info              curl_getinfo() output.
	 *     @type int          $errno             cURL error number.
	 *     @type string       $error             cURL error message.
	 *     @type float        $measured_duration Wall-clock duration of the request.
	 * }
	 */
	protected function perform_request( $url, $nobody, $conf, $use_get ) {
		// Init curl.
		$ch              = curl_init();
		$request_headers = array();
		curl_setopt( $ch, CURLOPT_URL, $this-&gt;urlencodefix( $url ) );
		curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );

		// Masquerade as a recent version of Chrome
		//$ua = &#039;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.34 Safari/537.36&#039;;
		// Use a custom user agent string.
		$ua = apply_filters( &#039;wpmudev_blc_local_ua&#039;, &#039;WPMU DEV Broken Link Checker Local Engine&#039;, $url, $use_get );
		curl_setopt( $ch, CURLOPT_USERAGENT, $ua );

		// Close the connection after the request (disables keep-alive). The plugin rate-limits requests,
		// so it&#039;s likely we&#039;d overrun the keep-alive timeout anyway.
		curl_setopt( $ch, CURLOPT_FORBID_REUSE, true );
		$request_headers[] = &#039;Connection: close&#039;;

		// Add a semi-plausible referer header to avoid tripping up some bot traps
		curl_setopt( $ch, CURLOPT_REFERER, home_url() );

		// Set the timeout
		curl_setopt( $ch, CURLOPT_TIMEOUT, $conf-&gt;options[&#039;timeout&#039;] );
		curl_setopt( $ch, CURLOPT_CONNECTTIMEOUT, $conf-&gt;options[&#039;timeout&#039;] );

		// Set the proxy configuration. The user can provide this in wp-config.php
		if ( defined( &#039;WP_PROXY_HOST&#039; ) ) {
			curl_setopt( $ch, CURLOPT_PROXY, WP_PROXY_HOST );
		}
		if ( defined( &#039;WP_PROXY_PORT&#039; ) ) {
			curl_setopt( $ch, CURLOPT_PROXYPORT, WP_PROXY_PORT );
		}
		if ( defined( &#039;WP_PROXY_USERNAME&#039; ) ) {
			$auth = WP_PROXY_USERNAME;
			if ( defined( &#039;WP_PROXY_PASSWORD&#039; ) ) {
				$auth .= &#039;:&#039; . WP_PROXY_PASSWORD;
			}
			curl_setopt( $ch, CURLOPT_PROXYUSERPWD, $auth );
		}

		// Make CURL return a valid result even if it gets a 404 or other error.
		curl_setopt( $ch, CURLOPT_FAILONERROR, false );

		$parts = @parse_url( $url );
		if ( ! empty( $parts[&#039;scheme&#039;] ) &amp;&amp; &#039;https&#039; === $parts[&#039;scheme&#039;] ) {
			curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false ); // Required to make HTTPS URLs work.
			curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, false );
		}

		if ( $nobody ) {
			// If possible, use HEAD requests for speed.
			curl_setopt( $ch, CURLOPT_NOBODY, true );
		} else {
			// If we must use GET at least limit the amount of downloaded data.
			$request_headers[] = &#039;Range: bytes=0-2048&#039;; // 2 KB
		}

		// Set request headers.
		if ( ! empty( $request_headers ) ) {
			curl_setopt( $ch, CURLOPT_HTTPHEADER, $request_headers );
		}

		// Register a callback function which will process the HTTP header(s).
		curl_setopt( $ch, CURLOPT_HEADERFUNCTION, array( $this, &#039;read_header&#039; ) );

		// Record request headers.
		if ( defined( &#039;CURLINFO_HEADER_OUT&#039; ) ) {
			curl_setopt( $ch, CURLINFO_HEADER_OUT, true );
		}

		if (  apply_filters( &#039;wpmudev_blc_local_accept_encoding_header&#039;, true ) ) {
			curl_setopt( $ch, CURLOPT_ENCODING, &#039;&#039; );
		}

		// Apply filter for additional options
		curl_setopt_array( $ch, apply_filters( &#039;broken-link-checker-curl-options&#039;, array() ) );

		// Applied last, after the public filter above, so the boundary cannot be
		// negotiated away by third-party code.
		$this-&gt;apply_transport_restrictions( $ch );

		// Execute the request
		$start_time                = microtime_float();
		$content                   = curl_exec( $ch );
		$measured_request_duration = microtime_float() - $start_time;

		$info  = curl_getinfo( $ch );
		$errno = curl_errno( $ch );
		$error = curl_error( $ch );

		// Apply filter before curl closes. This now runs once per hop rather than
		// once per check, because each hop is a request in its own right.
		apply_filters( &#039;broken-link-checker-curl-before-close&#039;, $ch, $content, $this-&gt;last_headers );

		curl_close( $ch );

		return array(
			&#039;content&#039;           =&gt; $content,
			&#039;info&#039;              =&gt; $info,
			&#039;errno&#039;             =&gt; $errno,
			&#039;error&#039;             =&gt; $error,
			&#039;measured_duration&#039; =&gt; $measured_request_duration,
		);
	}

	function read_header( /** @noinspection PhpUnusedParameterInspection */ $ch, $header ) {
		$this-&gt;last_headers .= $header;
		return strlen( $header );
	}

}

class blcWPHttp extends blcHttpCheckerBase {

	function check( $url ) {

		// $url = $this-&gt;clean_url( $url );
		// Note : Snoopy doesn&#039;t work too well with HTTPS URLs.

		$result = array(
			&#039;broken&#039;  =&gt; false,
			&#039;timeout&#039; =&gt; false,
		);
		$log    = &#039;&#039;;

		// Get the timeout setting from the BLC configuration.
		$conf    = blc_get_configuration();
		$timeout = $conf-&gt;options[&#039;timeout&#039;];

		$start_time = microtime_float();

		// Fetch the URL with WP_Http. Try HEAD first to avoid downloading the body.
		$request_args = array(
			&#039;timeout&#039;    =&gt; $timeout,
			&#039;user-agent&#039; =&gt; &#039;Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#039;, // masquerade as IE 7
			&#039;aa&#039;         =&gt; 1024 * 5,
		);

		$request   = wp_safe_remote_head( $this-&gt;urlencodefix( $url ), $request_args );
		$http_code = is_wp_error( $request ) ? 0 : (int) wp_remote_retrieve_response_code( $request );

		// Fall back to GET if the server rejected HEAD (405 Method Not Allowed) or returned nothing.
		if ( in_array( $http_code, array( 0, 405 ), true ) ) {
			$request = wp_safe_remote_get( $this-&gt;urlencodefix( $url ), $request_args );
		}

		// request timeout results in WP ERROR
		if ( is_wp_error( $request ) ) {
			$result[&#039;http_code&#039;] = 0;
			$result[&#039;timeout&#039;]   = true;
			$result[&#039;message&#039;]   = $request-&gt;get_error_message();
		} else {
			$result[&#039;http_code&#039;] = wp_remote_retrieve_response_code( $request ); // HTTP status code
			$result[&#039;message&#039;]   = wp_remote_retrieve_response_message( $request );
		}

		// Build the log
		$log .= &#039;=== &#039;;
		if ( $result[&#039;http_code&#039;] ) {
			$log .= sprintf( __( &#039;HTTP code : %d&#039;, &#039;broken-link-checker&#039; ), $result[&#039;http_code&#039;] );
		} else {
			$log .= __( &#039;(No response)&#039;, &#039;broken-link-checker&#039; );
		}
		$log .= &quot; ===\n\n&quot;;

		if ( $result[&#039;message&#039;] ) {
			$log .= esc_html( $result[&#039;message&#039;] ) . &quot;\n&quot;;
		}

		if ( is_wp_error( $request ) ) {
			$log              .= __( &#039;Request timed out.&#039;, &#039;broken-link-checker&#039; ) . &quot;\n&quot;;
			$result[&#039;timeout&#039;] = true;
		}

		// Determine if the link counts as &quot;broken&quot;
		$result[&#039;broken&#039;] = $this-&gt;is_error_code( $result[&#039;http_code&#039;] ) || $result[&#039;timeout&#039;];

		$log          .= &#039;&lt;em&gt;(&#039; . __( &#039;Using WP HTTP&#039;, &#039;broken-link-checker&#039; ) . &#039;)&lt;/em&gt;&#039;;
		$result[&#039;log&#039;] = $log;

		$result[&#039;final_url&#039;] = $url;

		// The hash should contain info about all pieces of data that pertain to determining if the
		// link is working.
		$result[&#039;result_hash&#039;] = implode(
			&#039;|&#039;,
			array(
				$result[&#039;http_code&#039;],
				$result[&#039;broken&#039;] ? &#039;broken&#039; : &#039;0&#039;,
				$result[&#039;timeout&#039;] ? &#039;timeout&#039; : &#039;0&#039;,
				blcLink::remove_query_string( $result[&#039;final_url&#039;] ),
			)
		);

		return $result;
	}

}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-content%2Fplugins%2Fbroken-link-checker%2Flegacy%2Fmodules%2Fcheckers'>⬅ Back to Directory</a>