WP Force SSL PRO

HTTPS does not stay fixed forever

The day you install the certificate the padlock appears and the matter seems closed. Months later someone pastes an image with an http:// address into a post, the certificate reaches its date without being renewed, or a hosting move changes the configuration. The first warning may be the browser alert in front of a customer.

HTTPS is a state you have to watch, because each new post or hosting move can break it. WP Force SSL PRO, by WebFactory, brings together both halves of the job: getting it right today, with the redirect and the mixed content fix, and checking it again tomorrow, with the content scanner and the built-in tests.

Redirect, scanner, tests and headers in one plugin

• 301 redirect from HTTP to HTTPS, via PHP if your server does not use .htaccess, or via .htaccess if it allows it, to make the redirect faster.
• Content scanner that goes through the entire site looking for mixed content and delivers a report.
• Mixed content fix on the public side and in the admin area.
• Certificate generation from Let's Encrypt with a button in the settings.
• HSTS, so the browser loads the secure version directly and not the HTTP one.
• Secure cookies and headers: Expect-CT, X-XSS, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy.
• Built-in tests covering the certificate, the WordPress addresses, the redirect and write access to .htaccess.

Why a valid certificate does not guarantee the padlock

The certificate covers your domain, but a page is made of many files. If a single image or script is requested over http://, you have mixed content, and the padlock may not appear even though the certificate is perfect. Checking every page by hand is not realistic on a site with years of posts.

The free version includes neither the scanner, the mixed content fix nor certificate generation. It keeps the PHP redirect, HSTS and Expect-CT, among other things, so the step up to PRO covers the finding and fixing part.

For the other risk, run the built-in tests again from time to time: they include checks of the certificate and its expiry date.

What still depends on you and your host

It does not install the certificate for you. It generates it, but automatic installation is not among its features, so that step stays in your hands.

It is not a general security plugin. The headers reinforce what the browser does. Among its features there is no firewall or malware scanner.

It is not something to use once and remove. On 90% of sites the changes are applied on the fly, and disabling the plugin undoes them. The upside is that you can go back. The trade-off is that the plugin has to stay active. If a change has to be permanent, it asks you to confirm twice.

What you need and how to get it working

You need an SSL certificate, whether paid, from your host or generated from the plugin itself.

1. Install the plugin and run the tests to see the starting state.
2. If you have no certificate, generate it from the settings and install it.
3. Turn on the redirect that matches your server.
4. Run the content scanner and review the report.
5. Turn on the mixed content fix and run the tests again.

Other plugins for WordPress SSL and security

Really Simple SSL Pro starts from the same problem, also generates Let's Encrypt certificates and adds a firewall and vulnerability scanning. For anyone running many sites with MainWP, MainWP SSL Monitor checks the certificates of connected sites and emails you when one is close to expiring. And if what you lack is protection against attacks, Wordfence Security Premium brings the application firewall and malware scanner that are absent here.

Questions about WP Force SSL PRO

Do I need to have a certificate already?

You need one to use HTTPS, but the plugin can generate it with Let's Encrypt from its settings. You will then have to install it.

Does it renew the certificate?

It regenerates the certificate every 90 days, but automatic installation is not among its features: you have to install each regenerated certificate yourself.

Does it work for moving a site from HTTP to HTTPS?

Yes. It redirects the content, checks the certificate and adds other security measures.