=== Flex SSL ===
Contributors: flexfields
Tags: ssl, https, cloudflare, certificate, security
Requires at least: 5.0
Tested up to: 7.0
Requires PHP: 7.0
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enables SSL & forces HTTPS on WordPress, updating URLs & adding security headers. Supports reverse proxies & soon integrates Let's Encrypt.

== Description ==

Flex SSL is a lightweight WordPress plugin designed to secure your website by enforcing HTTPS across your entire site. Key features include:

* **Force HTTPS:** Automatically redirect all HTTP requests to HTTPS.
* **Auto-Update URLs:** Change WordPress site and home URLs from HTTP to HTTPS.
* **Cloudflare/Proxy Support:** Detects HTTPS headers from Cloudflare or other reverse proxies to avoid redirect loops.
* **Security Headers:** Optionally add HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Force SSL Admin when HTTPS is in use.
* **Mixed Content Fixer:** Rewrites this site’s HTTP URLs to HTTPS in content, excerpts, attachments, srcset, scripts, and styles. External links are left unchanged.
* **SSL Status:** View current SSL status and certificate expiry date.
* **Redirect Options:** Choose between 301 (permanent) and 302 (temporary) redirects.
* **Logs & Reports:** Monitor changes and events in a log system.
* **Let's Encrypt Integration (Coming Soon):** Plan to automatically generate and renew SSL certificates.

== Installation ==

1. Upload the `flex-ssl` folder to your `/wp-content/plugins/` directory or install via the WordPress plugin installer.
2. Activate the plugin through the WordPress admin.
3. Navigate to Flex SSL → Settings from the admin menu.
4. Configure the desired settings:
   - Enable SSL.
   - Force HTTPS.
   - Auto-update WordPress site URLs to HTTPS.
   - Enable security headers and mixed content fixer.
5. (Coming Soon) Use the upcoming Let's Encrypt integration to generate SSL certificates automatically.

== Frequently Asked Questions ==

= Does Flex SSL work behind Cloudflare? =
Yes. Flex SSL supports reverse proxy configurations including Cloudflare’s Flexible and Full SSL modes by detecting proxy headers.

= Do I need to modify wp-config.php? =
No. Flex SSL is designed to work out-of-the-box without requiring changes to wp-config.php.

= How do I generate an SSL certificate? =
Let's Encrypt integration is marked as “Coming Soon.” Future versions will allow you to generate and renew SSL certificates directly from the plugin.

= What happens if SSL is not installed on my server? =
The plugin checks for a certificate and shows a warning. You can still enable features if HTTPS is terminated at a proxy. Force HTTPS to the origin server needs a working certificate.

== Screenshots ==

1. **Settings** – SSL status, Force HTTPS, mixed content, and security options.
2. **Logs** – View and clear recent SSL events.
3. **Usage** – Short guide to HTTPS, headers, and proxies.

== Changelog ==

= 1.1.0 =
* Admin UI aligned with Flex Redirects: header, pill navigation, stats, and cards.
* Settings, Logs, and Usage are now separate screens.
* Enable SSL is now a master switch for all other features.
* Force HTTPS runs early so wp-admin and wp-login.php are redirected, not only the front end.
* Force SSL Admin uses force_ssl_admin() (the FORCE_SSL_ADMIN constant is already defined before plugins load).
* HSTS is sent only over HTTPS, without preload.
* Mixed content fixer rewrites same-host URLs only, including attachments and srcset.
* Certificate-not-found is a warning, not a lock on the settings.
* Logs record setting changes and rate-limited HTTPS redirects.
* Tested up to WordPress 7.0. Plugin Check cleanup (hidden files, prefixes, sanitization).

= 1.0.12 =
* Updated plugin author to FLEX (https://flexible.am/).

= 1.0.11 =
* Limit readme tags to 5 for WordPress.org.

= 1.0.10 =
* Cleaned plugin icon top border and cropped banner footer for sharper WordPress.org assets.

= 1.0.9 =
* Updated WordPress.org banner and icons to the Flex family branding.

= 1.0.8 =
* WordPress.org compatibility: Tested up to 6.8.
* Ensure all output strings use esc_html, esc_attr, esc_url (Recent Logs, Clear Logs, About link, nav-tab class).
* uninstall.php and index.php already present (confirmed).

= 1.0.7 =
* UX: Added labels for all checkboxes (accessibility).
* UX: Added short help text for Update Site URL, HSTS, WooCommerce Safe Mode, and other options.
* UX: SSL certificate expiry now shows relative text (e.g. "Expires in 30 days").

= 1.0.6 =
* Added load_plugin_textdomain for i18n (plugins_loaded).
* Added index.php in plugin root for security.
* Added uninstall.php to remove options on uninstall.
* Replaced Clear Logs location.reload with wp_safe_redirect (handler moved to admin_init).

= 1.0.5 =
* Fixed tab redirect after save: add flex_ssl_active_tab and flex_ssl_nonce hidden fields to forms; use wp_redirect filter.

= 1.0.4 =
* Mixed Content Fixer: Extended to the_excerpt, post_thumbnail_url, script_loader_src, style_loader_src, content_url, home_url.

= 1.0.3 =
* Performance: Cache is_ssl_available() result (1 hour transient) to avoid repeated socket connections.
* Performance: Site URL updates run at most once per 24 hours; transient invalidated when option is changed.

= 1.0.2 =
* Security: Validate Host header to prevent header injection (redirects, SSL checks).
* FORCE_SSL_ADMIN is now optional and only set when SSL is in use.
* Removed deprecated X-XSS-Protection header (modern browsers deprecate it).

= 1.0.1 =
* Fixed option typo: `flex_ssl_flex_ssl_woo_safe_mode` renamed to `flex_ssl_woo_safe_mode`.
* WooCommerce Safe Mode now respects the setting (was always redirecting).
* Fixed logs option: custom sanitizer for array storage (was incorrectly using wp_kses_post).
* Added Logs tab to settings page (logs_settings existed but tab was missing).

= 1.0.0 =
* Initial release of Flex SSL.
* Force HTTPS on front-end.
* Auto-update site URLs to HTTPS.
* Cloudflare and reverse proxy support.
* Security headers and mixed content fixer.
* SSL status and logs.
* (Coming Soon) Let's Encrypt integration for automatic SSL generation.

== Upgrade Notice ==

= 1.1.0 =
Admin screens now match the Flex Redirects UI. HTTPS redirects, HSTS, and mixed content handling are safer and actually honor the settings.

= 1.0.12 =
Updated author branding to FLEX.

= 1.0.8 =
WordPress.org compatibility: escaping fixes, Tested up to 6.8.

= 1.0.7 =
UX improvements: checkbox labels, help text for options, relative SSL expiry display.

= 1.0.6 =
Code quality: i18n, index.php, uninstall.php, proper redirect for Clear Logs.

= 1.0.5 =
Fixed tab redirect after saving settings; stay on the active tab.

= 1.0.4 =
Mixed Content Fixer now covers excerpts, thumbnails, scripts, styles, content_url, and home_url.

= 1.0.3 =
Performance improvements: SSL availability and site URL update checks are now cached.

= 1.0.2 =
Security improvements: Host header validation, configurable FORCE_SSL_ADMIN, removed deprecated X-XSS-Protection header.

= 1.0.1 =
Bug fixes: WooCommerce Safe Mode setting, option typo, logs tab, and array sanitization.

= 1.0.0 =
Initial release. Enjoy enhanced security and hassle-free HTTPS enforcement on your WordPress site.

== License ==

Flex SSL is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.

For more details, see https://www.gnu.org/licenses/gpl-2.0.html.
