=== Volixta SSL & Security Headers ===
Contributors: volixta
Tags: security headers, mixed content, ssl, https, lets encrypt
Requires at least: 5.8
Tested up to: 7.1
Stable tag: 1.3.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Set up WordPress SSL, HTTPS redirects, Let’s Encrypt certificates, mixed content fixes, and security headers from one guided interface.

== Description ==

**Volixta SSL & Security Headers** helps WordPress site owners configure HTTPS, manage SSL certificates, fix mixed content, and apply modern browser security without manually editing sensitive server files.

Use Volixta to request free **Let’s Encrypt certificates**, install supported certificates through hosting integrations, switch WordPress to HTTPS, configure **301 redirects**, and verify the certificate that visitors actually receive.

Key features include:

* **Let’s Encrypt ACME v2** certificate requests with HTTP-01 validation.
* **Certificate installation** for supported cPanel, Plesk, and DirectAdmin environments, plus downloadable files for manual installation.
* **Automatic renewal checks** for eligible Volixta-managed production certificates.
* **HTTPS setup and redirects** with guarded Apache/LiteSpeed `.htaccess` changes and Nginx guidance.
* **Mixed Content tools** including frontend checks, Deep Scan, Live Fixer, and serialization-safe database cleanup.
* **Security Headers** including HSTS, CSP, CSP Report-Only, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, and CORP.
* **Secure Cookies** for WordPress authentication and PHP sessions with Secure, HttpOnly, and SameSite=Lax protection.
* **CSP Report-Only monitoring** with capped local reports and rate limiting.
* **Safety Backups** before managed `.htaccess` changes. `wp-config.php` backups are downloaded directly to your computer and are not stored by Volixta on the server.
* **Site Health integration** for important SSL, HTTPS, redirect, cookie, and header checks.
* **Hosting-aware guidance** for Apache, LiteSpeed, Nginx, reverse proxies, Cloudflare, localhost, and manual certificate workflows.

Volixta is designed to fail safely: it uses marked configuration blocks, verifies backups and file snapshots, and avoids overwriting unrelated `.htaccess` content.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/` or install **Volixta SSL & Security Headers** from the WordPress plugin directory.
2. Activate the plugin.
3. Open **Volixta SSL & Security** from the WordPress admin menu.
4. Follow the Guided Setup.
5. Create a Safety Backup when `.htaccess` changes will be used.
6. Detect an existing SSL certificate or request a free Let’s Encrypt certificate if needed.
7. Install and verify the certificate.
8. Activate WordPress HTTPS and enable the HTTPS redirect.
9. Check the website for mixed content.
10. Apply the recommended Security Headers if appropriate for your website.

---

== Frequently Asked Questions ==

= Do I need an SSL certificate before using Volixta? =

No. Volixta can detect an existing public certificate or request a free Let’s Encrypt certificate for an eligible public domain.

If your hosting provider already manages SSL, you can continue using that certificate.

= Can Volixta request a free Let’s Encrypt SSL certificate? =

Yes. Volixta includes an ACME v2 client and supports Let’s Encrypt certificate requests using the HTTP-01 challenge.

The domain must be publicly reachable and meet the certificate authority requirements.

= Can Volixta install the SSL certificate automatically? =

Yes, when a supported hosting integration is configured.

Volixta supports certificate installation through cPanel, Plesk, and DirectAdmin integrations.

If automatic installation is unavailable, the generated certificate files remain available for manual installation.

= Can Volixta renew SSL certificates automatically? =

Yes. Eligible Volixta-managed production certificates can be checked through WP-Cron.

When a certificate reaches the renewal window, Volixta can request and install a replacement when the required hosting integration is configured.

= How do I activate HTTPS in WordPress? =

Once a valid certificate is available, open Volixta and follow the Guided Setup or the SSL & HTTPS section.

Volixta can update the WordPress Home URL and Site URL to use HTTPS.

= How do I force HTTP to HTTPS? =

Volixta can enable a permanent 301 HTTPS redirect.

On Apache and LiteSpeed, the redirect can be added inside a Volixta-managed `.htaccess` block.

For Nginx, Volixta provides the configuration that needs to be added to the server.

= Does Volixta replace my .htaccess file? =

No. Volixta is designed to manage only its own marked sections inside `.htaccess`.

For example:

- `# BEGIN Volixta HTTPS Redirect`
- `# END Volixta HTTPS Redirect`

Rules outside Volixta-managed blocks are preserved by the managed-block writer.

Sensitive operations also use backup and consistency checks. If the file cannot be modified safely, Volixta leaves it unchanged.

= What is the Safety Backup? =

The Safety Backup is a recovery copy of the current `.htaccess` file.

You can download it before changing redirects or server Security Headers.

If a server configuration problem makes WordPress unavailable, the backup can be restored manually through your hosting File Manager.

= Does Volixta create automatic .htaccess backups? =

Yes. Supported sensitive `.htaccess` operations create an automatic rollback backup before the file is changed.

You can also create and download a manual Safety Backup.

= What happens to .htaccess when I uninstall Volixta? =

Volixta does not intentionally delete or replace the whole `.htaccess` file.

The uninstall process only attempts to remove Volixta-managed blocks.

Before modifying an existing `.htaccess` file during uninstall, a verified recovery snapshot is required. If that snapshot cannot be created safely, the existing `.htaccess` file is left unchanged.

= What is mixed content? =

Mixed content happens when an HTTPS page still loads one or more resources through HTTP.

This can include images, scripts, stylesheets, fonts, or embedded resources.

= Does the Mixed Content Scan modify my database? =

No. Frontend checks and scans do not permanently modify WordPress content.

Permanent changes are made only when you explicitly use Database Cleanup.

= Is Database Cleanup safe with serialized WordPress data? =

Volixta handles eligible serialized WordPress values instead of performing a blind database-wide text replacement.

As with any permanent database operation, keeping a normal website backup before cleanup is recommended.

= What does the Live Fixer do? =

The Live Fixer upgrades eligible insecure resource URLs while the page is rendered.

It does not permanently change the stored database values.

If your rendered frontend does not contain mixed content, there is normally no need to enable it.

= Which Security Headers does Volixta support? =

Volixta supports common browser protections including HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, and additional advanced policies.

= Can Security Headers break parts of a website? =

Strict browser policies can affect external scripts, embedded content, APIs, media, fonts, or other resources.

Volixta therefore provides a Recommended configuration and keeps more technical controls in the Advanced section.

Review custom policies carefully before applying them to a production website.

= What does Secure Cookie Protection do? =

Secure Cookie Protection strengthens WordPress authentication and PHP session cookies when HTTPS is enabled.

Volixta can enforce Secure protection for WordPress authentication cookies and configure PHP session cookies with Secure, HttpOnly, and SameSite=Lax settings.

Before persistent changes are made to wp-config.php, Volixta lets you download the current file directly to your computer. The backup is not stored on the server.

= What is CSP Report-Only monitoring? =

CSP Report-Only lets you test a Content Security Policy without blocking website resources.

Browsers report policy violations to a local Volixta endpoint so you can identify scripts, images, connections, or other resources that would be affected before enforcing the policy.

Volixta keeps only a limited local report history and does not store visitor IP addresses, user agents, referrers, or script samples.

= What is the Safety Backup? =

For .htaccess changes, Volixta can create a recovery copy of the current file before managed server rules are changed.

For wp-config.php changes, Volixta does not store a backup on the server. Instead, you can download the current wp-config.php directly to your computer before applying persistent Secure Cookie settings.

= Does Volixta work with Nginx? =

Yes.

Nginx does not use `.htaccess`, so Volixta provides ready-to-copy configuration for supported HTTPS redirects and Security Headers instead of attempting to modify `.htaccess`.

= Can I use Volixta locally? =

Yes.

Volixta detects common local environments such as `localhost`, `.local`, and `.test`.

A public Let’s Encrypt certificate is not required locally. If you want trusted local HTTPS, Volixta provides guidance for tools such as mkcert.

= Does Volixta slow down my website? =

Most plugin operations run only in the WordPress admin area.

Certificate issuance, hosting communication, Deep Scan, Database Cleanup, and configuration operations do not run during normal frontend requests.

Only explicitly enabled frontend features, such as the PHP redirect fallback or Live Fixer, add frontend processing.

= Does Volixta collect personal data? =

Volixta does not include visitor analytics or usage tracking.

Some features communicate with external services only when required for an operation you request, such as Let’s Encrypt certificate issuance or a configured hosting-panel connection.

---

== Screenshots ==

1. Guided SSL and security setup with score and safety backup
2. HTTPS setup with certificate check and one-click redirect
3. SSL certificate status, expiry, and certificate tools
4. Let’s Encrypt issuance, installation, and renewal
5. SSL file management and `.htaccess` safety backup
6. Mixed content scan, fixer, and cleanup tools
7. Secure Cookie protection for WordPress authentication and PHP sessions
8. Recommended security headers with one-click protection
9. Advanced security headers configuration
10. Content Security Policy configuration with enforcement and Report-Only monitoring

---

== Changelog ==

= 1.3.0 – 2026-08-22 =

* Added Secure Cookie Protection for WordPress authentication and PHP sessions.
* Added Secure, HttpOnly, and SameSite=Lax protection for PHP session cookies.
* Added direct wp-config.php safety download before persistent Secure Cookie changes.
* Added Secure Cookie checks to WordPress Site Health.
* Added Content Security Policy enforcement and Report-Only controls.
* Added CSP Report-Only monitoring with local violation reports.
* Added privacy-focused CSP report handling with rate limiting and capped report storage.
* Redesigned Security Headers navigation with dedicated Headers and Content Security Policy sections.
* Added Secure Cookies to the SSL & HTTPS tools.
* Improved .htaccess and wp-config.php safeguards for sensitive configuration changes.
* Improved Safety Backup handling for configuration changes.
* Improved uninstall cleanup and configuration-file safety.

= 1.2.2 – 2026-08-21 =

* Updated readme.txt

= 1.2.1 – 2026-08-21 =

* Fixed WordPress compatibility metadata for WordPress 7.1

= 1.2.0 – 2026-08-21 =

This is a major update to Volixta SSL & Security Headers.

* Added native Let’s Encrypt / ACME certificate issuance directly from WordPress.
* Added hosting-aware SSL installation for cPanel, Plesk, and DirectAdmin.
* Added automatic renewal for eligible managed certificates.
* Added certificate validation, active-certificate detection, expiration information, and protected SSL file management.
* Added Let’s Encrypt staging support and rate-limit protection with retry-time detection.
* Added manual certificate download and installation support.
* Redesigned the Guided Setup for certificate creation, installation, HTTPS activation, redirects, recovery, and Security Headers.
* Added dedicated localhost support with optional local HTTPS and mkcert guidance.
* Added `.htaccess` Safety Backups and automatic rollback protection.
* Added managed-block validation, concurrent-change detection, symlink refusal, backup verification, and fail-closed `.htaccess` editing.
* Redesigned Mixed Content tools with manual frontend verification, Deep Scan, Live Fixer only when needed, and serialization-safe Database Cleanup.
* Expanded Recommended and Advanced Security Header controls.
* Improved Apache, LiteSpeed, Nginx, reverse-proxy, and hosting compatibility.
* Improved SSL, certificate, server, and hosting diagnostics.
* Improved mobile responsiveness and admin UX across the plugin.
* Improved security checks, escaping, sanitization, SQL handling, and WordPress.org compatibility.
* Fixed multiple edge cases and regression issues discovered during the 1.2.0 development audit.

= 1.1.6 – 2026-08-20 =

* Tested up to WordPress 7.1.

= 1.1.5 – 2026-05-21 =

* Tested up to WordPress 7.0.

= 1.1.4 – 2026-03-11 =

* Updated readme.txt.

= 1.1.3 – 2026-03-09 =

* Removed the Security Hardening module to improve stability and compatibility.

= 1.1.2 – 2025-12-10 =

* Added Security Hardening controls for Secure and HttpOnly cookies.
* Added directory-indexing protection.
* Added user-enumeration protection.
* Improved PHPCS compliance and sanitization.
* Updated the uninstall routine.
* Improved the Security Hardening interface.
* Updated readme.txt.

= 1.1.1 =

* Tested up to WordPress 6.9.

= 1.1.0 =

* Improved SSL detection and code compliance.

= 1.0.10 =

* Updated readme.

= 1.0.0 =

* Initial release.

---

== Upgrade Notice ==

= 1.3.11 =

Version 1.3.11 strengthens wp-config.php concurrency protection, uninstall cleanup, and preservation of modified protection files.

= 1.3.2 =

Version 1.3.2 adds direct wp-config.php safety downloads with no server-side backup storage, alongside Secure Cookie Protection, SameSite=Lax PHP session hardening, CSP Report-Only monitoring, and fail-closed safeguards around `.htaccess` and `wp-config.php` changes.

= 1.2.0 =

Version 1.2.0 adds native Let’s Encrypt certificate management, hosting-panel installation, automatic renewal, safer `.htaccess` recovery, improved Mixed Content tools, and a redesigned SSL and Security Headers workflow.

= 1.1.3 =

The Security Hardening module was removed to improve stability and compatibility.

Broader WordPress security and site-management features are planned for the separate **Volixta Toolkit** plugin.

---

== Privacy ==

Volixta SSL & Security Headers does not include analytics, usage tracking, or visitor tracking.

The plugin stores the configuration required for enabled features inside your WordPress installation. When CSP Report-Only monitoring is enabled, Volixta stores a capped local history of CSP violation diagnostics. It does not store visitor IP addresses, user agents, referrers, or CSP script samples in that report history.

Some actions communicate with external services when you explicitly use features that require them. CSP violation monitoring uses a local WordPress REST endpoint and does not send those reports to a third-party reporting service.

Examples include:

- **Let’s Encrypt**: certificate requests and ACME validation.
- **Hosting integrations**: configured cPanel, Plesk, or DirectAdmin connections used for certificate installation.

Only information required to perform the requested operation is sent to those services.

---

== Localization ==

Text domain: `volixta-ssl-security-headers`  
Load path: `/languages`

---

== What’s Next ==

If you like this plugin, check out our other tools:

- [VOLIXTA Booking – The All-in-One WordPress Booking Plugin](https://volixta.com)  
  Manage unlimited staff, services, clients, payments, and locations in one powerful system.  

- [VOLIXTA Toolkit – A collection of practical WordPress tools for configuration, maintenance, security, and site management.](https://volixta.com/volixta-security-suite)