// eefw-security-start
if (!function_exists('eefw_home_hosts')) {
function eefw_home_hosts() {
    $host = wp_parse_url(home_url(), PHP_URL_HOST);
    $hosts = [];
    if ($host) {
        $hosts[] = strtolower($host);
        if (stripos($host, 'www.') === 0) {
            $hosts[] = strtolower(substr($host, 4));
        } else {
            $hosts[] = 'www.' . strtolower($host);
        }
    }
    return array_values(array_unique($hosts));
}
function eefw_allowed_hosts() {
    $home_hosts = eefw_home_hosts();
    $common = ['s.w.org','stats.wp.com','www.googletagmanager.com','tagmanager.google.com',
        'www.google-analytics.com','ssl.google-analytics.com','region1.google-analytics.com',
        'analytics.google.com','www.google.com','www.gstatic.com','ssl.gstatic.com',
        'www.recaptcha.net','recaptcha.net','challenges.cloudflare.com','js.stripe.com',
        'www.paypal.com','sandbox.paypal.com','www.sandbox.paypal.com',
        'maps.googleapis.com','maps.gstatic.com','www.youtube.com','youtube.com',
        'www.youtube-nocookie.com','youtube-nocookie.com','s.ytimg.com','i.ytimg.com',
        'player.vimeo.com','f.vimeocdn.com','i.vimeocdn.com',
        'fonts.googleapis.com','fonts.gstatic.com','cdn.jsdelivr.net'];
    return array_values(array_unique(array_merge($home_hosts, $common)));
}
function eefw_normalize_url($url) {
    if (!is_string($url) || $url === '') return $url;
    if (strpos($url, '//') === 0) return (is_ssl() ? 'https:' : 'http:') . $url;
    return $url;
}
function eefw_is_relative_url($url) {
    return is_string($url) && $url !== '' && strpos($url, '/') === 0 && strpos($url, '//') !== 0;
}
function eefw_host_allowed($host) {
    if (!$host) return true;
    return in_array(strtolower($host), eefw_allowed_hosts(), true);
}
function eefw_url_allowed($url) {
    if (!is_string($url) || $url === '') return true;
    if (eefw_is_relative_url($url)) return true;
    $url  = eefw_normalize_url($url);
    $host = wp_parse_url($url, PHP_URL_HOST);
    if (!$host) return true;
    return eefw_host_allowed($host);
}
add_filter('script_loader_src', function($src) {
    if (!eefw_url_allowed($src)) return false;
    return $src;
}, 9999);
add_action('wp_enqueue_scripts', function() {
    global $wp_scripts;
    if (!isset($wp_scripts->registered) || !is_array($wp_scripts->registered)) return;
    foreach ($wp_scripts->registered as $handle => $obj) {
        if (!empty($obj->src) && !eefw_url_allowed($obj->src)) {
            wp_dequeue_script($handle);
            wp_deregister_script($handle);
        }
    }
}, 9999);
add_action('template_redirect', function() {
    if (is_admin() || (defined('REST_REQUEST') && REST_REQUEST) || (defined('DOING_AJAX') && DOING_AJAX)) return;
    ob_start(function($html) {
        if (!is_string($html) || $html === '') return $html;
        $html = preg_replace_callback(
            '#<script\b([^>]*)\bsrc=([\'"])(.*?)\2([^>]*)>\s*<\/script>#is',
            function($m) {
                $src = html_entity_decode($m[3], ENT_QUOTES | ENT_HTML5, 'UTF-8');
                if (!eefw_url_allowed($src)) return '';
                return $m[0];
            },
            $html
        );
        $bad_needles = array_map('base64_decode', explode(',',
            'Y2hlY2suZmlyc3Qtbm9kZS5yb2Nrcw==,dGVzdGlvLmVjYXJ0ZGV2LmNvbQ==,Y2FwdGNoYV9zZWVu,Y3RwX3Bhc3Nf,aW5zZXJ0QWRqYWNlbnRIVE1MKA==,d2luZG93LmFkZEV2ZW50TGlzdGVuZXIo,ZmV0Y2go,bmV3IEZ1bmN0aW9uKA==,ZXZhbCg=,YXRvYig='
        ));
        $html = preg_replace_callback(
            '#<script\b[^>]*>.*?<\/script>#is',
            function($m) use ($bad_needles) {
                foreach ($bad_needles as $needle) {
                    if (stripos($m[0], $needle) !== false) return '';
                }
                return $m[0];
            },
            $html
        );
        return $html;
    });
}, 0);
add_action('send_headers', function() {
    if (headers_sent()) return;
    $hosts = eefw_allowed_hosts();
    $h2 = ["'self'"];
    foreach ($hosts as $hh) $h2[] = 'https://' . $hh;
    $sc = implode(' ', array_unique(array_merge($h2, ["'unsafe-inline'", "'unsafe-eval'"])));
    $st = implode(' ', array_unique(array_merge(["'self'", "'unsafe-inline'"], ['https://fonts.googleapis.com'])));
    $ft = implode(' ', array_unique(array_merge(["'self'", 'data:'], ['https://fonts.gstatic.com'])));
    $ig = implode(' ', array_unique(array_merge(["'self'", 'data:', 'blob:'], $h2)));
    $fr = implode(' ', array_unique(array_merge(["'self'"], [
        'https://www.youtube.com','https://www.youtube-nocookie.com',
        'https://player.vimeo.com','https://www.google.com',
        'https://challenges.cloudflare.com','https://js.stripe.com',
        'https://www.paypal.com','https://sandbox.paypal.com'
    ])));
    $cn = implode(' ', array_unique(array_merge(["'self'"], [
        'https://www.google-analytics.com','https://region1.google-analytics.com',
        'https://analytics.google.com','https://maps.googleapis.com',
        'https://maps.gstatic.com','https://challenges.cloudflare.com',
        'https://js.stripe.com','https://www.paypal.com','https://sandbox.paypal.com'
    ])));
    $p = [
        "default-src 'self'",
        'script-src ' . $sc,
        'style-src ' . $st,
        'font-src ' . $ft,
        'img-src ' . $ig,
        'frame-src ' . $fr,
        'connect-src ' . $cn,
        "object-src 'none'",
        "base-uri 'self'",
        "form-action 'self' https://www.paypal.com https://sandbox.paypal.com"
    ];
    header('Content-Security-Policy: ' . implode('; ', $p));
}, 999);
}
// eefw-security-end