=== Volixta SSL & Security Headers ===
Contributors: volixta
Tags: ssl, https, security headers, mixed content, redirect
Requires at least: 5.8
Tested up to: 6.8
Stable tag: 1.0.2
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Easily enable SSL/HTTPS in WordPress, force 301 redirects, fix mixed content, and apply modern security headers (HSTS, CSP, X-Frame-Options). Safe, admin-only toolkit.

== Description ==

Is your WordPress site still serving pages over **HTTP** instead of **HTTPS**?  
Do you see browser warnings like *"Not Secure"* even though you installed SSL?  
Are you getting **mixed content errors** in Chrome or Firefox after enabling HTTPS?  
Or is your Site Health report complaining about missing **security headers**?

👉 **Volixta SSL & Security Headers fixes all of these in a few clicks.**

---

### 🔐 What does Volixta do?
- **Activate SSL automatically**: safely update your WordPress `home` and `siteurl` to use `https://`.
- **Force HTTPS with 301 redirect**: adds a safe `.htaccess` block on Apache/LiteSpeed, or falls back to a PHP redirect if needed.
- **Fix mixed content**: scans your posts, postmeta, and options for `http://` links and replaces them with `https://` (serialization-safe).
- **Apply modern HTTP Security Headers**: HSTS, Content-Security-Policy (`upgrade-insecure-requests`), X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP. All values are editable before applying.
- **Nginx friendly**: when `.htaccess` is not available, Volixta shows ready-to-use Nginx snippets for redirects and headers.
- **Site Health integration**: new tests for SSL validity, HTTPS redirect, and security headers presence.

---

### ✅ Why choose Volixta?
- **Safe by design**:  
  Nothing is applied automatically. You choose what to enable. Each `.htaccess` write creates a timestamped backup.  
- **Serialization-safe mixed content fixer**: no risk of breaking complex data in `postmeta` or `options`.  
- **Admin-only**: no runtime overhead on the frontend (except optional PHP redirect).  
- **Localhost aware**: detects local environments (`localhost`, `.local`, `.test`) and shows guided instructions with [mkcert](https://github.com/FiloSottile/mkcert).  

---

### 🔎 Typical problems solved
- *“I installed an SSL certificate but Chrome still shows my site as insecure.”*  
  → Enable SSL + 301 redirect with Volixta.  

- *“My Site Health report says ‘No security headers detected’.”*  
  → Apply recommended headers (HSTS, X-Frame-Options, CSP, etc.) in one click.  

- *“After moving to HTTPS, some images/scripts still load over HTTP.”*  
  → Run the Mixed Content Scan + Fixer to update them safely.  

- *“I’m on Nginx, so .htaccess doesn’t work.”*  
  → Copy/paste the Nginx-ready snippets provided by Volixta.  

---

== Installation ==
1. Upload to `/wp-content/plugins/` or install directly from the directory.
2. Activate the plugin.
3. Open **Volixta SSL & Security** in the admin menu.
4. With a valid SSL certificate:
   - Click **Activate SSL** (updates WP URLs to `https://`).
   - Click **Enable HTTPS Redirect** (tries `.htaccess`, otherwise PHP fallback).
   - Click **Apply Security Headers** (safe `.htaccess` block with backup).

---

== Frequently Asked Questions ==

= Does it modify .htaccess? =
Yes, but only when you click an action. Blocks are wrapped clearly:  
- `# BEGIN Volixta HTTPS Redirect`  
- `# END Volixta HTTPS Redirect`  
A backup `.htaccess.bak-YYYYMMDD-HHMMSS` is created each time.

= Will it work on Nginx? =
Yes. `.htaccess` is Apache/LiteSpeed only, but Volixta shows ready-to-copy Nginx snippets for redirects and headers. The HTTPS redirect can also use PHP fallback.

= Does it slow down my site? =
No. Everything runs only in the admin panel. On the frontend, only the optional PHP redirect adds minimal overhead.

= Can I use it locally? =
Yes. Local environments are auto-detected. Volixta shows a “Local HTTPS” section with instructions to set up a trusted certificate using `mkcert`.  
No `.htaccess` or redirects are applied on localhost.

= Where are settings stored? =
Only a few options in `wp_options`:
- Headers configuration  
- PHP redirect flag  
- Last mixed-content scan result  

---

== Screenshots ==
1. Dashboard showing SSL, redirect, headers, and server checks
2. One-click SSL activation and HTTPS redirect (301)
3. Mixed Content scan + fixer with serialization-safe DB replace
4. Security headers panel with custom header configuration

---

== Changelog ==
= 1.0.2 =
* Updated readme.txt (corrected description)

= 1.0.1 =
* Updated readme.txt (improved description, SEO, FAQ)

= 1.0.0 =
* Initial public release
* SSL activation, HTTPS redirect (301)
* Security headers with editable values
* Mixed content scanner & fixer
* Nginx snippets for headers/redirects
* Site Health checks
* Automatic `.htaccess` backups

---

== Upgrade Notice ==
= 1.0.0 =
Review headers configuration before applying. A backup of `.htaccess` is always created.

---

== Privacy ==
This plugin does not collect, store, or transmit personal data. Only saves minimal config in `wp_options`.

---

== Localization ==
Text domain: `volixta-ssl-security-headers`  
Load path: `/languages` (WP.org language packs auto-loaded)

---

== What’s Next ==

If you like this plugin, then consider checking out our other plugins:

- [VOLIXTA Booking – The All-in-One WordPress Booking Plugin](https://volixta.com)  
  Manage unlimited staff, services, clients, payments, and locations in one powerful system.  

- [VOLIXTA Security Suite – Advanced WordPress Security Made Simple](https://volixta.com/volixta-security-suite)