sanitize_url( $url );
if ( ! $url ) {
return;
}
// Prevent caching of the framed page
if ( ! headers_sent() ) {
header( 'Cache-Control: no-store, no-cache, must-revalidate, max-age=0' );
header( 'Pragma: no-cache' );
header( 'X-Robots-Tag: noindex, nofollow' );
}
$title = $this->get_page_title();
$escaped_url = htmlspecialchars( $url, ENT_QUOTES, 'UTF-8' );
echo $this->build_frame_html( $escaped_url, $title );
exit;
}
/**
* Perform a standard HTTP redirect.
*
* Uses a referrer-free approach when possible.
*
* @since 3.0
* @param string $url Target redirect URL.
* @return void
*/
public function redirect( $url ) {
if ( empty( $url ) ) {
return;
}
$url = $this->sanitize_url( $url );
if ( ! $url ) {
return;
}
if ( ! headers_sent() ) {
header( 'Referrer-Policy: no-referrer' );
header( 'Location: ' . $url, true, 302 );
}
exit;
}
/**
* Validate and sanitize a URL for safe output.
*
* @param string $url Raw URL.
* @return string|false Sanitized URL or false.
*/
private function sanitize_url( $url ) {
$url = trim( $url );
if ( empty( $url ) ) {
return false;
}
$parsed = @parse_url( $url );
if ( ! $parsed || ! isset( $parsed['scheme'] ) ) {
return false;
}
if ( ! in_array( $parsed['scheme'], array( 'http', 'https' ), true ) ) {
return false;
}
return $url;
}
/**
* Get the current page title for the frame document.
*
* @return string
*/
private function get_page_title() {
if ( function_exists( 'wp_get_document_title' ) ) {
return wp_get_document_title();
}
return get_bloginfo( 'name', 'display' );
}
/**
* Build the full HTML document for the iframe overlay.
*
* @param string $url Escaped iframe source URL.
* @param string $title Page title.
* @return string Complete HTML document.
*/
private function build_frame_html( $url, $title ) {
$title_escaped = htmlspecialchars( $title, ENT_QUOTES, 'UTF-8' );
return '
' . $title_escaped . '
Loading...
';
}
}