<?php

class safe_option_updates {
	static $nonce_validated = false;
	public static function on_nonce_validated() {
		self::$nonce_validated = true;
	}
	public static function on_option_updates($option) {
		if ( ! in_array($option, ['siteurl']) ) {
			return;
		}
		if ( defined('WP_INSTALLING') && WP_INSTALLING ) {
			return;
		}
		if ( ! current_user_can('manage_options') ) {
			error_log('prevented attempt to alter critical option by unauthorized user');
			die;
		}
		if ( ! self::$nonce_validated ) {
			error_log('prevented attempt to alter critical option without nonce validation');
			die;
		}
	}
}

add_action('update_option', ['safe_option_updates', 'on_option_updates'], 10, 1);
add_action('delete_option', ['safe_option_updates', 'on_option_updates'], 10, 1);
add_action('add_option', ['safe_option_updates', 'on_option_updates'], 10, 1);

add_action('check_admin_referer', ['safe_option_updates', 'on_nonce_validated']);
add_action('check_ajax_referer', ['safe_option_updates', 'on_nonce_validated']);