=== Volixta SSL & Security Headers === Contributors: volixta Tags: security headers, mixed content, ssl, https Requires at least: 5.8 Tested up to: 6.9 Stable tag: 1.1.2 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Add modern security headers, enable SSL/HTTPS, fix mixed content, harden WordPress, and force 301 redirects. Fast and safe. == Description == Is your WordPress site still serving pages over **HTTP** instead of **HTTPS**? Do you see browser warnings like *"Not Secure"* even though you installed SSL? Are you getting **mixed content errors** in Chrome or Firefox after enabling HTTPS? Is your Site Health report complaining about missing **security headers** or weak security settings? Are bots scanning your site with **?author=1** to enumerate users? 👉 **Volixta SSL & Security Headers fixes all of these in a few clicks.** Easily **activate SSL**, **force 301 redirects**, repair **mixed content**, enable **security hardening**, and apply recommended **WordPress security headers** like HSTS, CSP, and X-Frame-Options. --- ### 🔐 What does Volixta do? - **Activate SSL automatically**: safely update your WordPress `home` and `siteurl` to use `https://`. - **Force HTTPS with 301 redirect**: adds a safe `.htaccess` block on Apache/LiteSpeed, or falls back to a PHP redirect if needed. - **Fix mixed content**: scans your posts, postmeta, and options for `http://` links and replaces them with `https://` (serialization-safe). - **Apply modern HTTP Security Headers**: HSTS, Content-Security-Policy (`upgrade-insecure-requests`), X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP. - **Security hardening options**: - ✔️ **Secure cookies**: add `COOKIE_SECURE` and `COOKIE_HTTPONLY` to protect authentication cookies - ✔️ **Disable directory indexing**: adds “Options -Indexes” to `.htaccess` - ✔️ **Block user enumeration**: blocks `?author=ID` scans and hides `/wp-json/wp/v2/users` from visitors - **Nginx friendly**: when `.htaccess` is not available, Volixta shows ready-to-copy Nginx rules. - **Site Health integration**: checks for SSL, redirects, security headers, and hardening status. --- ### ✅ Why choose Volixta? - **Safe by design**: Nothing is applied automatically. You choose what to enable. Each `.htaccess` write creates a timestamped backup. - **Serialization-safe mixed content fixer**: no risk of breaking complex data in `postmeta` or `options`. - **Admin-only**: no runtime overhead on the frontend (except optional PHP redirect). - **Localhost aware**: detects local environments (`localhost`, `.local`, `.test`) and shows guided instructions with [mkcert](https://github.com/FiloSottile/mkcert). --- ### 🔎 Typical problems solved - *“How do I activate SSL in WordPress?”* → One click in Volixta updates your site to HTTPS safely. - *“How do I force HTTPS with 301 redirects?”* → Volixta inserts a safe `.htaccess` 301 redirect or a PHP fallback. - *“My Site Health report says ‘No security headers detected’.”* → Apply missing **security headers** (HSTS, CSP, X-Frame-Options, Referrer-Policy, etc.) in one click. - *“How can I add WordPress security headers without editing code?”* → Use Volixta’s panel to configure and apply headers safely. - *“After enabling SSL, my site still shows mixed content errors.”* → Run the Mixed Content Scan + Fixer to repair unsafe links automatically. - *“I’m on Nginx, so .htaccess doesn’t work.”* → Copy/paste the Nginx-ready snippets Volixta provides for HTTPS redirects and headers. --- == Installation == 1. Upload to `/wp-content/plugins/` or install directly from the directory. 2. Activate the plugin. 3. Open **Volixta SSL & Security** in the admin menu. 4. With a valid SSL certificate: - Click **Activate SSL** (updates WP URLs to `https://`). - Click **Enable HTTPS Redirect** (tries `.htaccess`, otherwise PHP fallback). - Click **Apply Security Headers** (safe `.htaccess` block with backup). --- == Frequently Asked Questions == = How do I activate SSL in WordPress? = Open Volixta → click **Activate SSL**. The plugin updates your WordPress and Site URL to use HTTPS, then you can force **301 redirects** to ensure all traffic goes over SSL. = How do I add security headers in WordPress? = Go to Volixta → Security Headers panel → select headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, etc.) → click Apply. Volixta safely writes headers to `.htaccess` or provides Nginx snippets. = Does it modify .htaccess? = Yes, but only when you click an action. Blocks are wrapped clearly: - `# BEGIN Volixta HTTPS Redirect` - `# END Volixta HTTPS Redirect` A backup `.htaccess.bak-YYYYMMDD-HHMMSS` is created each time. = Will it work on Nginx? = Yes. `.htaccess` is Apache/LiteSpeed only, but Volixta shows ready-to-copy Nginx snippets for redirects and headers. The HTTPS redirect can also use PHP fallback. = Does it slow down my site? = No. Everything runs only in the admin panel. On the frontend, only the optional PHP redirect adds minimal overhead. = Can I use it locally? = Yes. Local environments are auto-detected. Volixta shows a “Local HTTPS” section with instructions to set up a trusted certificate using `mkcert`. No `.htaccess` or redirects are applied on localhost. = Where are settings stored? = Only a few options in `wp_options`: - Headers configuration - PHP redirect flag - Last mixed-content scan result --- == Screenshots == 1. Dashboard showing SSL, redirect, headers, and server checks 2. One-click SSL activation and HTTPS redirect (301) 3. Mixed Content scan + fixer with serialization-safe DB replace 4. Security headers panel with custom header configuration --- == Changelog == = 1.1.2 – 2025-12-10 = - Added new Hardening module: * Secure & HttpOnly cookies (adds COOKIE_SECURE and COOKIE_HTTPONLY to wp-config.php) * Disable directory indexing by inserting “Options -Indexes” into .htaccess * Block user enumeration (?author=ID and REST API `/wp/v2/users`) - Improved PHPCS compliance and sanitization for user enumeration blocking - Updated uninstall routine to remove new hardening options - UI enhancements for Security Hardening settings panel - Updated readme.txt = 1.1.1 – 2025-12-07 = - Tested up to: 6.9 = 1.1.0 – 2025-11-08 = - Improved code compliance: added PHPCS annotations for dynamic SQL clauses to avoid false warnings. - Ensured all SQL queries remain fully prepared and secure. - Improved SSL detection to recognize valid certificates even when the site still uses HTTP. - Added admin notice suggesting HTTPS activation when a valid SSL is detected. - Updated UI for clearer SSL and security headers status display. - Internal cleanup for plugin review and coding standards validation. = 1.0.10 = * Updated readme.txt = 1.0.0 = * Initial public release * SSL activation, HTTPS redirect (301) * Security headers with editable values * Mixed content scanner & fixer * Nginx snippets for headers/redirects * Site Health checks * Automatic `.htaccess` backups --- == Upgrade Notice == = 1.1.2 = This update introduces new security hardening features (secure cookies, disable indexing, block user enumeration). Review the new Hardening panel and enable the protections you need. = 1.1.0 = This update improves SSL detection and coding standards compliance. No action required, but review the new HTTPS recommendation notice in the admin panel. = 1.0.10 = Minor update: updated readme.txt. No action needed. = 1.0.0 = Initial release. Review headers configuration before applying. A backup of `.htaccess` is always created. --- == Privacy == This plugin does not collect, store, or transmit personal data. Only saves minimal config in `wp_options`. --- == Localization == Text domain: `volixta-ssl-security-headers` Load path: `/languages` (WP.org language packs auto-loaded) --- == What’s Next == If you like this plugin, then consider checking out our other plugins: - [VOLIXTA Booking – The All-in-One WordPress Booking Plugin](https://volixta.com) Manage unlimited staff, services, clients, payments, and locations in one powerful system. - [VOLIXTA Security Suite – Advanced WordPress Security Made Simple](https://volixta.com/volixta-security-suite)