Site Health: The "insecure registration" test shows its warning label when it passes

[ravipatel]

WP_Site_Health::get_test_insecure_registration() (added in #43936, 7.0) sets its label once, for the default "good" result:

'label' => __( 'Open Registration with privileged default role' ),
'status' => 'good',

The critical branch changes the status and description but never the label. So on a correctly configured site, Tools > Site Health > Passed tests lists "Open Registration with privileged default role", which reads like a warning.

The critical description is also not wrapped in <p>, unlike the "good" description and other Site Health results.

Steps to reproduce

1. Keep "Anyone can register" unticked (the default), or tick it with the default role set to Subscriber.
2. Go to Tools > Site Health and expand "Passed tests".
3. The passing result is labelled "Open Registration with privileged default role".

Proposed fix

• Give the passing result its own label, for example "New users are not given a privileged role".
• Set "Open registration with a privileged default role" (sentence case, like other Site Health labels) only in the critical branch.
• Wrap the critical description in <p>.
• Add unit tests: there is currently no test coverage for this check.

AI assistance: Yes
Tool(s): Claude Code
Used for: Finding the issue during 7.2-beta1 testing, and drafting the fix, tests and this description. I reviewed and ran the tests.

WP_Site_Health::get_test_insecure_registration() set the label for its critical result as the default, so a site with safe registration settings listed "Open Registration with privileged default role" under Passed tests, which reads like a warning.

• The passing result now reads "New users are not given a privileged role".
• The critical result sets its own label, "Open registration with a privileged default role", in sentence case like other Site Health labels.
• The critical description is wrapped in <p>, like the passing description and other Site Health results.
• Adds the first tests for this check: each combination of open or closed registration and default role, plus the label, description markup and action link. On multisite, the tests set the network registration option, because users_can_register follows it there.

Two translatable strings change; 7.2 is in beta, before the RC1 string freeze.

Testing Instructions

1. Keep "Anyone can register" unticked, or tick it with the default role set to Subscriber.
2. Go to Tools > Site Health and expand "Passed tests".
3. Before: "Open Registration with privileged default role". After: "New users are not given a privileged role".
4. Tick "Anyone can register" and set the default role to Administrator. The critical result reads "Open registration with a privileged default role".

Unit tests: npm run test:php -- --group 66359. On trunk, the label and markup tests fail; with this PR, all 9 pass on single site and multisite.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Used for: Finding the issue during 7.2-beta1 testing, and drafting the fix, tests and this description. I reviewed the changes and ran the tests.

[ravipatel]

PR: ​https://github.com/WordPress/wordpress-develop/pull/14669

The new tests fail on trunk for the label and the description markup, and all 9 pass with the PR on single site and multisite (npm run test:php -- --group 66359).