=== Volixta SSL & Security Headers ===
Contributors: volixta
Tags: ssl, https, security headers, mixed content, redirect
Requires at least: 5.8
Tested up to: 6.8
Stable tag: 1.0.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enable HTTPS, 301 redirects, and modern security headers. Fix mixed content and use Nginx snippets—safe, admin-only controls.

== Description ==

Volixta is a small, admin-only toolkit to switch WordPress to HTTPS, enforce a 301 redirect to HTTPS, apply modern HTTP security headers, and fix mixed content safely.

**What it does**
- **Activate SSL**: switch the `home` and `siteurl` options to `https://`.
- **Force HTTPS (301)**: writes a dedicated block into `.htaccess` on Apache/LiteSpeed; falls back to a PHP redirect when needed.
- **Security Headers**: apply a curated set (HSTS, CSP “upgrade-insecure-requests”, Permissions-Policy, Referrer-Policy, CORP/COOP/COEP, etc.). Values are editable before applying.
- **Mixed Content Fixer**: scan and (optionally) replace your domain’s `http://` → `https://` in posts, post meta, and options (serialization-safe).
- **Nginx aware**: shows copy-ready snippets for redirects and headers when `.htaccess` is not applicable.
- **Site Health tests**: quick checks for SSL validity, HTTPS redirect, and headers presence.

**Safety**
- Nothing is auto-applied on activation.
- `.htaccess` writes are wrapped in clearly marked blocks and a timestamped backup is created before each write.
- Mixed-content “Fix” is only available after a “Scan” found items.

== Installation ==
1. Upload the folder to `/wp-content/plugins/` or install from the directory.
2. Activate the plugin.
3. Open **Volixta SSL & Security** (top-level menu).
4. On a site with a valid public SSL:
   - Click **Activate SSL** (optional if already on `https://`)
   - Click **Enable HTTPS Redirect** (tries `.htaccess`, otherwise enables PHP fallback)
   - Click **Apply Security Headers** (creates a backup and writes a headers block)

== Frequently Asked Questions ==

= Does it modify .htaccess? =
Yes, but only when you click an action. Blocks are wrapped as:
- `# BEGIN Volixta HTTPS Redirect` … `# END Volixta HTTPS Redirect`
- `# BEGIN Volixta Security Headers` … `# END Volixta Security Headers`  
A backup like `.htaccess.bak-YYYYMMDD-HHMMSS` is created before each write.

= Will it work on Nginx? =
`.htaccess` is Apache/LiteSpeed only. On Nginx, the plugin shows copy-ready snippets for redirects and headers. The HTTPS redirect can also use the PHP fallback.

= Does it add runtime overhead on the frontend? =
Only if you enable the PHP redirect fallback. Otherwise it’s admin-only.

= Where are settings stored? =
A few options in `wp_options`: the headers configuration, the PHP redirect flag, and the last mixed-content scan result.

= Does it work on localhost or local development sites? =

Yes. The plugin automatically detects local environments like `localhost`, `*.local`, or single-label domains. In such cases:

- A dedicated **“Local HTTPS (mkcert)”** section is shown.
- You’ll see guided instructions to install a trusted local certificate using [mkcert](https://github.com/FiloSottile/mkcert).
- If HTTPS is already active on your local server, you can click **“Activate HTTPS for WordPress (local)”** to safely update the `home` and `siteurl` options to `https://`.
- No `.htaccess` changes or redirects are applied on localhost.
- Server-specific actions (like redirect rules) are disabled to avoid unnecessary writes.

== Screenshots ==
1. Status dashboard: SSL, redirect, headers, server checks
2. SSL activation and HTTPS redirect (301)
3. Mixed Content scan and fixer
4. Security headers: activation + custom headers configuration

== Changelog ==
= 1.0.0 =
* Initial public release
* SSL activation, HTTPS redirect (301)
* Security headers with editable values
* Mixed content scanner & fixer
* Nginx snippets for headers/redirects
* Site Health checks
* Automatic `.htaccess` backups

== Upgrade Notice ==
= 1.0.0 =
Review the headers configuration before applying on production. A backup of `.htaccess` is created automatically.

== Privacy ==
This plugin does not collect, store, or transmit personal data. It only saves configuration in `wp_options` and writes server-level rules when requested.

== Localization ==
Text domain: `volixta-ssl-security-headers`  
Load path: `/languages` (WordPress.org Language Packs are loaded automatically; no manual loading needed)