Really Simple SSL Pro

• Security: Fixed a remaining 2FA bypass in XML-RPC authentication.
• Security: Fixed an issue where unauthenticated visitors could bloat the database via the 404 interceptor. Thanks to Naoki Kawahigashi via WPScan for reporting.
• Fixed: A possible error when processing plugins that were no longer available in Other Plugins.
• Changed: Removed SimplyBook.me from onboarding and Other Plugins.
• Changed: Standardized punctuation in task and notice messages.

• Fixed: A JavaScript error on user profile pages when passkeys were disabled.
• Fixed: Users required to use 2FA could extend their own grace period.
• Fixed: A fatal error caused by an invalid author query parameter.
• Fixed: 2FA onboarding after logging in through WooCommerce.
• Fixed: Horizontal scrolling in Content Security Policy and region blocking tables.
• Fixed: The firewall could reference advanced-headers.php when the file did not exist.
• Fixed: Possible fatal errors caused by invalid data in public CSP and 2FA requests.
• Changed: Updated the default Content Security Policy for WordPress 7.1 compatibility.
• Changed: Improved database table checks.

• Security: Prevented unexpected deletion of the login nonce.
• Security: Prevented a bug that incorrectly changed the 2FA status from active to open.
• Security: Prevent XML-RPC logins without 2FA for users with 2FA configured.

• Fixed: Other plugin installation now retrieves the download link correctly.
• Fixed: PHP 8.5 compatibility issues.
• Fixed: The 2FA grace period was not always handled correctly.
• Changed: Improved CAPTCHA handling after failed login attempts.
• Changed: REST API checks are faster and run only when needed.
• Changed: Tested up to WordPress 7.1.

• Fixed: The firewall event log now shows the correct region and country names.
• Fixed: The dashboard now shows the correct number of hardening tasks that still need attention.
• Fixed: Prevented a possible PHP warning during plugin activation.
• Changed: Moved the code for deactivating other Really Simple Security versions.
• Changed: Removed unused code.
• Changed: Removed an empty directory from the plugin ZIP file.
• Changed: Updated the color used for Metricool in the Other Plugins section.

• Fixed: Password expiration now works correctly with 2FA and passkeys.
• Fixed: Button styling in Content Security Policy and Permissions Policy tables.
• Fixed: Alignment of the e-mail validation status icon.
• Fixed: Vulnerability data is included in uninstall cleanup.
• Changed: Updated translations to use the l10n PHP format.
• Changed: User agent blocking now supports wildcard matching.
• Changed: Removed an unused passkey log message.
• Changed: Updated the Other Plugins section in onboarding and settings.

• Fixed: 2FA grace period reminder emails could be sent unexpectedly.
• Fixed: Content Security Policy now follows the setting toggle correctly.
• Fixed: PHP 8.4 deprecation warning.
• Fixed: DNS verification issue in the Let's Encrypt wizard.
• Changed: Vulnerability details now load only for the plugin or theme being activated.
• Changed: Improved rule writing with file locking to avoid race conditions.
• Changed: Uninstall cleanup now removes plugin options and transients more reliably.
• Changed: Added a login page notice for invalid login sessions.
• Changed: Improved 2FA user lookup performance on multisite.
• Changed: Improved license check reliability.
• Changed: Improved DirectAdmin Let's Encrypt certificate generation.
• Changed: Improved several interface texts.
• Changed: Event logs now support larger log tables.
• Changed: Added RSSSL_INFO_LOG for extra debugging details.
• Changed: Added more prerequisite checks before features can be enabled.

• Fixed: fatal error that could occur when a plugin uses admin_enqueue_scripts incorrectly.
• Fixed: a bug where the wrong settings value could be saved.

• Fixed: Undefined variable during cron.
• Changed: Updated 2FA login flow to address inconsistent verification behavior.

• Fixed: An issue that could cause a crash when activating alongside the Perfmatters plugin.
• Fixed: Some styling (CSS) issues to improve compatibility with WordPress 7.0.
• Changed: Removed an unused AJAX callback.
• Changed: Tested up to WordPress 7.0.

• Fixed: A fatal error that could occur when activating Pro in a multisite environment.
• Fixed: An issue where logging in with a username and password on multisite did not trigger a passkey prompt when using a standalone passkey.
• Fixed: Improved and future-proofed the plugin updater.
• Changed: Updated the event log cleanup cron hook.
• Changed: Reworked vulnerability detection and measures logic.

• Fixed: An issue where TOTP codes starting with a 0 were not properly recognized.
• Fixed: Prevent using "Do Not Ask Again" for user roles where 2FA is required.
• Changed: Various improvements to authentication flow.

• Fixed: Resolved an issue where “Prevent login feedback” could show a ghost username on the login retry screen.
• Fixed: Prevented “Failed to send buffer of zlib output compression” notices when using the Mixed Content Fixer with zlib.output_compression enabled.

• Fixed: scenario where users were stuck after an expired 2FA grace period due to missing authentication methods.
• Fixed: Support for wss:// URLs in CSP connect-src.
• Fixed: MemberPress login compatibility with Limit Login Attempts.
• Changed: event logging by generating messages dynamically instead of storing translated text.
• Changed: Email 2FA user experience by making Enter submit the verification code instead of resending it.
• Changed: Simplified service bootstrapping by removing the Provider layer and registering all services directly in the App container.

• Fixed: compromised password check compatibility with Thrive Architect
• Fixed: fatal error on multisite subsite profile pages with passkeys enabled
• Fixed: user role demotion issue on multisite
• Fixed: passkey settings appearing twice on profile page
• Fixed: 2FA users list not displaying all users
• Fixed: Cloudflare cache not clearing after SSL activation
• Fixed: passkey strings not translatable
• Fixed: uploads .htaccess using incorrect Apache syntax for some versions
• Changed: deferred header detection on activation to prevent timeouts
• Changed: improved deactivation process
• Changed: more robust firewall code generation

• Fixed: JavaScript error when using custom roles with 2FA
• Fixed: fatal error caused by hosts class being instantiated twice
• Fixed: Limit Login Attempts now blocks both username and email address
• Fixed: fatal error when upgrading from older plugin versions
• Fixed: security headers set outside the plugin now correctly appear disabled
• Fixed: text domain loaded too early warning when logging in with blocked username
• Fixed: reinstated reset_2fa [id] WP-CLI command
• Fixed: WP-CLI activate_ssl command now works correctly on first attempt
• Changed: removed two unused files from the plugin
• Changed: improved feedback when logging in with a passkey
• Changed: updated readme to align with standards

• Fixed: an edge case where authentication validation could behave unexpectedly

• Fixed: 2FA login error when user has no assigned roles
• Fixed: fatal error when wp-config.php path is empty
• Changed: added file locking to .htaccess and wp-config.php to prevent race conditions
• Changed: login lockout period no longer extends when trying to log in while blocked
• Changed: password login now triggers passkey prompt when passkeys are enabled
• Changed: clarified .htaccess directory indexing comment
• Changed: replaced site_url() with home_url() in the 404 resource check on the homepage
• Changed: security functions now skip cron jobs and CLI environments
• Changed: Let's Encrypt wizard final step now shows only SSL activation button
• Changed: added a license.txt file

• Fixed: Added a fix for WP_CLI commands

• Fixed: blocking a username now blocks both lower- and uppercase variants
• Fixed: readme now displays correctly in WordPress updates screen
• Fixed: added a fallback for when an empty get_user_totp_key was empty
• Fixed: removed an unused translation that could cause a textdomain loaded to early warning
• Fixed: prevent an error when an IP address is undefined
• Fixed: empty sections are now correctly cleared from the firewall
• Fixed: deactivation modal now always displays
• Changed: added a notice when using a custom login URL with plain permalinks
• Changed: added a check if WPFC_SERVE_ONLY_VIA_CACHE is already defined before defining it
• Changed: updated the mixed content notice text
• Changed: refactored the onboarding code

• Fixed: the 2FA reset fix now correctly calls the 2FA reset service

• Fixed: 2FA TypeError when updating from older versions

• Fixed: all users will now appear in the 2FA list
• Fixed: advanced-headers.php and firewall paths update correctly during migration
• Fixed: PHP 8.4 deprecation notices
• Fixed: tasks will now always display on multisite
• Fixed: skip/don't ask again is now hidden for users who already configured passkeys
• Changed: activate_ssl CLI command supports --force to skip confirmation

• Fixed: activating the Pro and Multisite plugin at the same time will no longer throw a fatal error
• Fixed: added a check for the getmyuid function to prevent errors in case this function was missing
• Fixed: Right-To-Left CSS now works correctly when SCRIPT_DEBUG is enabled
• Changed: passkeys can now be used as a stand-alone feature
• Changed: standardized REST namespaces to really-simple-security

• Fixed: Prevent empty content to be written into htaccess

• Fixed: .htaccess protected from empty overwrites, auto-creation requires filter opt-in

• Fixed: removed unnecessary call to install() in firewall constructor
• Fixed: header_length_ok() now uses options instead of transients for caching
• Fixed: user agent and 404 detection are now excluded on cron requests
• Fixed: added a check to prevent a typeError in generating htaccess rules

• Fixed: replaced accidental Dutch word in 2FA datatable with correct English translation.
• Fixed: resolved PHP 8.4 deprecation warnings while maintaining compatibility with PHP 7.4–8.4.
• Fixed: whitelisted LiteSpeed Cache crawler in .htaccess to prevent redirect issues.
• Fixed: corrected 2FA grace period email logic to avoid sending reminders to users with active 2FA.
• Fixed: updated hosting provider name from "XXL Hosting" to "Superspace".
• Changed: reworked .htaccess handling with insert_with_markers and improved WP Rocket integration.
• Changed: moved firewall rules to separate firewall.php with dedicated rule classes.
• Changed: SBOM added to plugin.
• Changed: improved text consistency and updated geopolitical terminology

• Fixed: handled a case where the user ID could be empty in 2FA.
• Fixed: learn more button in vulnerability e-mail link now links to the correct page.
• Fixed: rsssl_user_can_manage undefined error when downloading system status
• Changed: improved compatibility with plain permalinks.
• Changed: handling of user agents in the firewall.
• Changed: auto cleanup 404 watchlist via cron job.
• Changed: updated links in the plugin.
• Changed: made various improvements to CSP learning mode.

• Fixed: changed a constant from uppercase to lowercase.

• Fixed: Adjusted .htaccess redirect requirements for subfolder configurations
• Fixed: re-send e-mail button on the 2FA page will now show a message when the e-mail is sent.
• Fixed: restored SCSS files.
• Fixed: fixed an issue where the plugin kept redirecting to its settings page after activation.
• Changed: limit login attempts will now also trigger on password reset pages.
• Changed: updated the way other plugins are installed via the onboarding and dashboard page.
• Changed: added notice with an option to force verify e-mail address.
• Changed: updated minimum WordPress version to 6.6.

• Fixed: Fixed the feedback when an email is resend during Two-Factor Authentication setup.
• Fixed: Fixed the Single Sign on link to support custom login urls.
• Fixed: Fixed an issue where the composer autoloader was loaded twice.

• Fixed: Validate CIDR ranges before bit-shifting in IP fetcher.
• Fixed: Auto-allow Googlebot IPs in Firewall when blocking the United States.
• Fixed: Adjust plugin initialization timing to prevent a textdomain warning.
• Added: Passkey support for Two-Factor Authentication.
• Added: Include SimplyBook in "onboarding" and "other plugins" sections.
• Changed: More detailed feedback when using CLI commands.
• Changed: On activation, detect EXTENDIFY_PARTNER_ID constant and run wp rsssl activate_recommended_features.
• Changed: Standardize RSS onboarding hoster list to brand names.
• Changed: "Disable user enumeration" now returns 401 Unauthorized (instead of 404 Not Found) for non-authenticated requests to the /wp/v2/users/ endpoint.

• Fixed: moved WooCommerce event listener to wp_loaded
• Fixed: 2FA methods can now be set on profile page
• Fixed: Show correct Project-ID-Version in translation files

• Fixed: Fixed an issue where TOTP codes were not properly validated.
• Fixed: login limits now skip WordPress Cron for better plugin compatibility
• Fixed: Eventlog no longer logs temp blocks for non-blocked IPs
• Fixed: Fixed an issue where Limit Login Attempts, temporary blocks were not correctly cleared.
• Changed: Added a better handling for Ip subnets cidr in Firewall.

• Fixed: Fixed a rare case where the autoloader could cause a Fatal Error due to loading twice
• Changed: Added multiple WP-CLI commands to better align with recent plugin features
• Changed: Added multiple improvements to File Permissions Check
• Changed: Added support for custom/multiple roles in Two Factor Authentication
• Removed: File Change Detection

• Fixed: Properly handle unknown plugins in upgrade requests, preventing unintended behavior.

• Fixed: Removed default checkbox behaviour from configuration settings.
• Fixed: loop when creating password protected page with custom login URL
• Fixed: handle multiple tooltip reasons for disabled select fields
• Fixed: Preventing double lines to occur in the advanced-headers.php file
• Changed: Added filters to customize Let's Encrypt Wizard behaviour

• Fixed: logout error with custom login URL in some cases

• Fixed: Improved user role handling to prevent undefined array key in 2FA.
• Fixed: All instruction links are now correct.
• Fixed: Undefined array key "m" when showing vulnerability details.
• Fixed: Prevent errors when downgrading to free.
• Fixed: Compatibility between 2FA and JetPack "Log in using WordPress.com account" setting
• Added: Create manual CSP entries.
• Changed: generating backup codes only when totp is being configured.
• Changed: Not able to use email needed functions when email is not yet verified.
• Changed: Added better text to verify the action of resending 2fa email.
• Changed: remove email token when login succeeds.
• Changed: Updated LLA database structure for MySQL 5.7 compatibility.

• Fixed: In some situations, header settings were lost after temporarily deactivating the plugin.
• Fixed: In some cases the review notice was not properly dismissible.
• Fixed: Added nonce check to certificate re-check button.
• Added: file change detection for suspicious changes outside of updates
• Changed: limited the number of header test requests for CSP learning mode
• Changed: 404 blocker skips homepage to prevent accidental lockouts
• Changed: Two-Factor Authentication now works with custom login screens.
• Changed: Updated endpoint version.
• Changed: disabling file permissions check will now correctly reset the file permissions list.

• Fixed: 404 blocker will now write the rules to the advanced-headers.php file immediately
• Fixed: fixed the dropdown height for the custom login URL 404 page picker
• Fixed: LLA Username block did not expire
• Fixed: stop showing notice when firewall is enabled.
• Fixed: Reset 2FA attempt counter & notice after successful TOTP login
• Fixed: 2fa sanitising produced a failed login.
• Fixed: password change enforcement uses batches to prevent memory issues
• Changed: do not track 404's for logged in users
• Changed: implemented the rsssl_wpconfig_path filter in all wp-config functions
• Changed: blocking IP no longer blocks associated username after login
• Changed: Faster onboarding completion after clicking Finish button
• Changed: CSS. Shields in user interface on datatables are no longer cut off

• Fixed: Remove duplicate site URL.
• Fixed: ensure rsssl_sanitize_uri_value() function always returns a string, to prevent errors.
• Fixed: multisite 2FA role enforcement fix for users with multiple roles
• Fixed: Skip Onboarding button undefined page with email method
• Changed: Width Vulnerabilities -> configuration
• Changed: 2Fa lockout notice
• Changed: catch use of short init in advanced-headers file
• Changed: string improvements and translator comments
• Changed: Bitnami support for rsssl_find_wordpress_base_path()
• Changed: integrate Site health notifications with Solid Security
• Changed: Enhanced random password generation in Rename Admin User feature
• Changed: Always return string in wpconfig_path() function
• Changed: Removes configuration options for a user in edit user.

• Changed: improved error handling

• Fixed: fixed a bug where the 2FA grace period was kept active after a reset

• Fixed: email login button not working
• Fixed: onboarding and login button did not save the correct configuration.
• Changed: safe-mode.lock file deactivates Firewall, 2FA and LLA for debugging
• Changed: update to system status
• Changed: textual changes
• Changed: Updated instructions URLs
• Changed: Changed site health notices from critical to recommended
• Changed: dropped obsolete react library
• Changed: add a site URL to email warnings regarding suspicious admin account creation
• Changed: Additional feedback if 2FA grace period has expired
• Changed: enforced 2FA users get email reminder 3 days before grace period expires

• Fixed: prevent potential errors with login feedback..
• Fixed: Catch type error when $transients is not an array.
• Fixed: Custom Login URL compatibility with password protected pages.
• Fixed: Prevent potential errors when adding IP addresses to the Firewall allowlist.
• Added: User Agent Blocking.
• Changed: add captcha URL's to default Content Security Policy rules.
• Changed: Auto-removal of Free plugin and translation files when Pro is activated.
• Changed: Resize logo in 2FA e-mails.
• Changed: Allow scanning for security headers via http://scan.really-simple-ssl.com with one click
• Changed: Exclude MPDF library in Complianz from Permission Detection.
• Changed: Remove unnecessary rsssl_update_option calls.

• Fixed: issue with deactivating 2fa

• Fixed: Prevent duplicate DB queries on Firewall settings page
• Fixed: Instructions URL in the Firewall settings.
• Fixed: Block a custom login URL bypass on Multisite
• Fixed: Catch situation where an entry in the MaxMind DB returns null
• Fixed: Fixed incorrect instructions URL
• Fixed: Dismiss notice when dashboard is viewed
• Changed: dropped deprecated X-Frame-Options header in favor of frame-ancestors

• Fixed: Let's Encrypt returning an old certificate on auto-renewed certificates
• Fixed: Multiselect in Limit login attempts
• Security: Login url bypass on multisite
• Security: 2fa bypass fix, props Julio Potier @SecuPress
• Changed: Better UX sync between CSP and frame ancestors
• Changed: save and continue in vulnerabilities overview not working correctly

• Fixed: Issues with the decryption model

• Fixed: Fixed some strings that were not translatable. This has been resolved.
• Fixed: Premium support link did not work. Now links to the correct page.
• Fixed: Links in emails were sometimes not correct. This has been fixed.
• Fixed: Fatal error on permission detection. This has been resolved.
• Added: password security scan detects weak and compromised passwords
• Changed: Disable the cron schedules on deactivation.
• Changed: custom license check header improves hosting compatibility
• Changed: Added option to disable X-powered-by header.
• Changed: New improved encryption method for some settings.

• Fixed: Multisite fix.

• Fixed: reduced advanced-headers file rewrites in dashboard

• Fixed: possibility to bypass hide login url with certain internal URLs.
• Fixed: setting for hide remember me missing
• Fixed: code for two modules loaded even if not enabled.
• Added: 404 blocker and firewall, auto blocking IP's that generate 404 errors
• Added: File Change detection, get notified when files are changed
• Changed: added filter to write to other file than the wp-config.php
• Changed: added option to disable Limit Login Attempts with a constant, if the admin is locked out.
• Changed: added a constant which prevents inserting the .htaccess auto prepend rule
• Changed: admin notices now branded with 'Really Simple Security'

• Fixed: documentation links to website broken
• Changed: some text changes in helptexts
• Changed: x-frame options synced with frame-ancestors
• Changed: new structure to upgrade database tables
• Changed: change login url compatibility with other plugin

• Fixed: Reset user for two step email authentication from the settings page
• Fixed: Not loading cookie expiration change
• Fixed: Visual Composer compatibility icw Enforce Strong Password
• Fixed: Multiple CloudFlare detected notices in onboarding
• Fixed: Checkbox position in onboarding
• Changed: dropdown in onboarding not entirely visible
• Changed: Styling of locked XML RPC overview

• Fixed: WP Rocket compatibility causing an issue when advanced-headers.php does not exist

• Fixed: advanced-headers.php now supports early inclusion

• Fixed: upgrade from <6.0 version to >8.0 causing a fatal error
• Fixed: URL to details of detected vulnerabilities was incorrect
• Added: detection of non-recommended permissions on files
• Added: Configure region restrictions for your site
• Changed: Textual change on premium overlay
• Changed: Upgraded minimum required PHP version to 7.4
• Changed: compatibility with Bitnami
• Changed: compatibility of Limit Login Attempts with Woocommerce
• Changed: remove duplicate X-Really-Simple-SSL-Test from advanced-headers-test.php
• Changed: clear notice about .htaccess writable if do_not_edit_htaccess is enabled

• Fixed: show 'self' as default in Frame Ancestors
• Added: Limit Login Attempts Captcha integration
• Changed: some string corrections
• Changed: catch not existing rsssl_version_compare
• Changed: check for openSSL module existence
• Changed: set default empty array for options, for legacy upgrades
• Changed: disable custom login URL when plain permalinks are enabled
• Changed: drop renamed folder notice, not needed anymore
• Changed: enable advanced headers in onboarding
• Changed: is_object check in updater

• Fixed: enable 2FA during onboarding when not selected by user
• Fixed: upgrading to Pro preserves settings when clear on deactivation enabled
• Fixed: catch several array key not existing errors
• Changed: better CSP defaults

• Added: hide remember me checkbox
• Added: extend blocking of malicious admin creation to multisite
• Changed: drop prefetch-src from Content Security Policy
• Changed: disable two-fa when login protection is disabled

• Fixed: clear cron schedules on deactivation
• Changed: translations update
• Changed: info notice about automatic free and pro plugin merge

• Changed: added integration with FlyingPress and Fastest Cache
• Changed: fix exiting a filter, causing a compatibility issue with BuddyPress

• Fixed: custom 404 pages i.c.w. custom login url
• Added: Added option to limit login cookie expiration time
• Changed: text changes
• Changed: css on login error message
• Changed: header detection improved by always checking the last url in the redirect chain

• Fixed: IP detection header order
• Fixed: table creation on activation of LLA module

• Fixed: PHP warning in Password Security module
• Fixed: change login url feature not working with password protected pages
• Changed: move database table creation to Limit Login Attempts module
• Changed: prevent php error caused by debug.log file hardening feature

• Fixed: CSP data not showing in datatable

• Changed: improved check for PharData class

• Fixed: Config for CSP preventing Learning mode from completing
• Fixed: datatable styling
• Fixed: using deactivate_https with wp-cli did not remove htaccess rules
• Changed: add query parameter to enforce email verification &rsssl_force_verification
• Changed: css for check certificate manually button

• Fixed: changed link to article
• Fixed: remove flags .js file which was added twice, props @adamainsworth
• Fixed: typo in missing advanced-headers.php notice
• Changed: catch php warning when script src is empty when using hide wp version, props @chris-yau
• Changed: new save & continue feedback
• Changed: datatable styling
• Changed: new react based modal
• Changed: menu re-structured
• Changed: re-check vulnerability status after core update
• Changed: vulnerability notification emails now link to specific details

• Fixed: React ErrorBoundary preventing Let's Encrypt generation to complete.

• Fixed: hook change in integrations loader causing modules not to load. props @rami5342

• Fixed: incorrect function usage, props @heutger

• Changed: detection if advanced-headers.php file is running

• Changed: typo update word
• Changed: translatability in several strings.

• Fixed: handling of legacy options in php 8.1
• Fixed: prevent issues with CloudFlare when submitting support form from within the plugin
• Fixed: translations singular/plural for japanese translations @maboroshin
• Changed: modal icon placement in wizard on smaller screens
• Changed: expire cached detected headers five minutes after saving the settings

• Fixed: reverted redirect method to fix non-www site login issues

• Fixed: feedback on hardening features enable action not showing as enabled, props @rtpHarry
• Changed: notice informing about the new free vulnerability detection feature
• Changed: improved the php redirect method
• Changed: make the wp-config.php not writable notice dismissable

• Fixed: fix false positives on some plugins
• Changed: vulnerability notifications in site health, if notifications are enabled.

• Changed: improve matching precision on plugins with vulnerabilities.

• Fixed: REST API ajax fallback now works correctly

• Added: Vulnerability Detection (Beta)
• Changed: move onboarding rest api to do_action rest_route
• Changed: catch several edge situations in SSL Labs api
• Changed: SSL Labs block responsiveness
• Changed: more robust handling of wp-config.php detection

• Changed: added support for the new Let's Encrypt staging environment

• Fixed: capability mismatch in multisite. props @verkkovaraani
• Changed: add warning alert option

• Fixed: catch non array value from notices array, props @kenrichman
• Fixed: typo in documenation link, props @bookman53
• Changed: optionally enable notification emails in onboarding wizard
• Changed: onboarding styling

• Changed: Changed Back-end react to functional components
• Changed: multisite notice should link to network admin page
• Changed: detect existing CAA records to check Let's Encrypt compatibility
• Changed: tested up to wp 6.2
• Changed: UX improvement learning mode

• Fixed: capability mismatch for a non administrator in multisite admin, props @jg-visual

• Fixed: race condition when activating SSL through wp-cli, because of upgrade script
• Fixed: missing disabled state in textarea and checkboxes
• Fixed: some strings not translatable
• Fixed: Let's Encrypt renewal with add on
• Changed: permissions check re-structuring
• Changed: notice on subsite within multisite environment about wildcard updated

• Added: optional email notifications on advanced settings
• Changed: added tooltips
• Changed: added warnings for .htaccess redirect
• Changed: don't send user email change on renaming admin user, as the email doesn't actually change
• Changed: Use BASEPATH only for wp-load.php, so symlinked folders will load based on ABSPATH
• Changed: Improved support for environments where Rest API is blocked

• Fixed: WP-CLI SSL activation fix when site not visited before
• Changed: prevent 'undefined' status showing up in api calls on settings page
• Changed: notice for incompatible Let's Encrypt shell add-on versions

• Fixed: empty menu item visible in Let's Encrypt menu
• Changed: some UX changes
• Changed: Limit number of notices in the dashboard
• Changed: load rest api request url over https if website is loaded over https

• Fixed: settings page when using plain permalinks, props @mvsitecreator, props @doug2son

• Fixed: CSS for blue labels in progress dashboard below 1080px
• Fixed: WPCLI SSL activation not working due to capability checks, props @oolongm
• Fixed: catch invalid account error in Let's Encrypt generation, props @bugsjr
• Fixed: do not block user enumeration for gutenberg
• Changed: improve method of dropping empty menu items in settings dashboard
• Changed: dynamic links in auto installer
• Changed: Let's Encrypt Auto installer not working correctly, props @mirkolofio
• Changed: change rest_api method to core wp apiFetch()
• Changed: scroll highlighted setting into view after clicking "fix" on a task
• Changed: HTTP method tests run in batches to prevent CURL timeouts
• Changed: clean up code-execution.php file after test, props @spinhead
• Changed: notification when DISABLE_FILE_EDITING is set to false
• Changed: drop some unnecessary translations
• Changed: WP version test uses options for better persistence

• Fixed: multisite admin username test uses correct database prefix
• Changed: allow submenu in back-end react application
• Changed: Skip value update when no change has been made
• Changed: no redirect on dismiss of admin notice, props @gangesh, @rtpHarry, @dumel
• Changed: remove obsolete warning
• Changed: qtranslate support on settings page

• Fixed: login check works when HTTP_X_WP_NONCE unavailable
• Fixed: admin notices now dismiss immediately

• Fixed: Apache 2.4 compatibility for upload directory code blocking
• Fixed: Varnish cache compatibility for REST API requests
• Fixed: manage_security capability added for upgraded users
• Fixed: allow for custom rest api prefixes, props @coderevolution
• Fixed: Let's Encrypt DNS verification save and action issues
• Fixed: REST API error handling prevents blank settings page
• Changed: Simplify user enumeration test
• Changed: catch unexpected response in SSL Labs object
• Changed: z-index on on boarding modal on smaller screen sizes, props @rtpHarry
• Changed: hide username field if no admin username is present, props @rtpHarry

• Fixed: incorrectly disabled email field in Let's Encrypt wizard, props @cburgess
• Changed: on rename admin user, catch existing username, and strange characters
• Changed: catch openBaseDir restriction in cpanel detection function, props @alofnur
• Changed: removed 6.0 update notices from subsites

• Changed: Lets Encrypt wizard CSS styling
• Changed: re-add link to article about Let's Encrypt so users can easily find the URL
• Changed: let user choose a new username when selecting "rename admin user"

• Fixed: restricted .htaccess rewrite to prevent plugin conflicts

• Fixed: drop upgrade of .htaccess file in upgrade script

• Fixed: .htaccess race condition with simultaneous updates

• Fixed: .htaccess redirect compatibility with upload code blocking
• Fixed: deactivation now fully removes wp-config.php changes

• Fixed: Rest Optimizer no longer deactivates other plugins

• Fixed: do not show WP_DEBUG_DISPLAY notice if WP_DEBUG is false, props @janv01
• Fixed: empty cron schedule, props @gilvansilvabr
• Fixed: auto installer used function not defined yet
• Fixed: rest api optimizer causing an error in some cases @giorgos93
• Changed: several typo's and string improvements

• Fixed: translations not loading for scripts

• Added: Server Health Check - powered by SSLLabs
• Added: WordPress Hardening Features
• Changed: User Interface
• Changed: Tested up to WordPress 6.1.0

• Improvement: added PHP 8.1 compatibility
• Improvement: updated .htaccess redirect comment
• New: add installation helper
• Improvement: is_writable check in Let's Encrypt
• Improvement: Catch not set subject alternative and common names in cert

• Bumped tested up to 5.9

• Improvement: change text about Google Analytics for a more broader application
• Improvement: prevent duplicate notice
• Improvement: better feedback on failed SSL detection
• Improvement: .htaccess redirect detection with preg_match

• Improvement: changed text on security headers feedback
• Improvement: some resources were not loaded minified on the back-end
• Improvement: dropped one line from tips&tricks to ensure it all fits when translated
• Improvement: improve feedback on the Let's Encrypt terms & conditions checkbox being required
• Improvement: improve feedback on chosen hosting company, if SSL is already available, or not available at all.
• Improvement: updated wp-config needs fixes notice
• Improvement: RTL css update

• Improvement: updated tips & tricks with Let's Encrypt and Cross-Origin resource policy articles
• Improvement: updated setting slider styling
• Improvement: updated WP Config not writable notice and article
• Improvement: recommended headers check now uses cURL for header detection

• Improvement: auto rename force-deactivate.php back to .txt after running
• Improvement: auto flush caches of popular caching plugins
• Improvement: "dismiss all notices" option on multisite network settings menu
• Improvement: add option to disable OCSP stapling in the Let's Encrypt certificate generation, instead of doing this automatically only
• Improvement: added high contrast option to settings for better WCAG compatibility
• Improvement: link in "install manually" on Let's Encrypt certificate renewal should point to certificate download instead of hosting installation url.
• Improvement: recommend headers check now uses cURL for header detection

• Improvement: remove one recommendation from the activate ssl notice, to keep it clean
• Improvement: continue instead of stop when no auto installation possible
• Improvement: add reset option to Let's Encrypt generation wizard, to allow fully resetting Lets Encrypt
• Improvement: saved settings feedback

• Improvement: color of progress bar
• Improvement: make notice about not protected directories dismissible, in case the Let's Encrypt certificate generation process is not completed.
• Improvement: catch not existing fsock open function, props @sitesandsearch
• Improvement: slide out animation on task dismissal

• Improvement: clear keys directory only clearing files
• Improvement: added WP Version and PHP version to system status export
• Improvement: check for duplicate SSL plugins
• Improvement: Catch file writing error in Let's Encrypt setup where the custom_error_handler wasn't able to catch the error successfully
• Improvement: new hosting providers added Let's Encrypt

• Fix: Let's Encrypt SSL certificate download only possible through copy option, and not through downloading the file

• Improvement: make sure plus one notices also get re-counted outside the settings page after cache clears
• Fix: On Multisite a Let's Encrypt specific filter was loaded unnecessarily
• Improvement: also skip challenge directory check in the ACME library, when the user has selected the skip directory check option

• Improvement: move localhost test before subfolder test as the localhost warning won't show otherwise on most localhost setups
• Fix: when using the shell add-on, the action for a failed cpanel installation should be "skip" instead of "stop"
• Fix: drop obsolete arguments in the cron_renew_installation function, props @chulainna

• Fix: check for file existence in has_well_known_needle function, props @libertylink
• Fix: fixed a timeout on SSL settings page on OVH due to failed port check
• Improvement: allow SSL generation when a valid certificate has been found

• Fix: rsssl_server class not loaded on cron

• Fix: cron job for Let's Encrypt generation not loading correct classes

• Fix: php notices when in SSL certificate generation mode, due to wrong class usage
• Improvement: Refresh option in case the certificate was just installed.
• Improvement: catch invalid order during SSL certificate generation

• Improvement: Install SSL notice dismissible, which allows for SSL already installed situations and not detected.
• Fix: WordPress basepath detection in force deactivate function and in system status
• Fix: not dismissible urgent notices were still dismissible
• Improvement: add-on compatibility check
• Improvement: due to bug in Plesk, a "no Order for ID" error could be returned. A second attempt will now automatically be made on the Let's Encrypt SSL certificate generation
• Improvement: allow overriding of SSL detection of SSL was not detected as valid

• Improvement: remove some files to prevent false positive warnings from windows defender
• Improvement: move variable in cpanel integration to prevent php warnings.

• Fix: obsolete variable in function causing php errors on some configurations.

• New: Let's Encrypt SSL certificate generation

• Fix: non hierarchical structured form elements in the template could cause settings not to get saved in some configurations.

• Improvement: when WordPress incorrectly reports that SSL is not possible, correct the resulting site health notice.
• Improvement: don't show the secure cookies notice on subsites of a multisite installation. Show on the network dashboard instead.

• Fixed notice about wp config.php not writable notice even when httpOnly cookie settings already written.

• Added secure cookies
• Improved Right-To-Left text support

• Fixed a bug where users with an older Pro version could get a fatal error call to private function

• Improvement: enable WordPess redirect, disable .htaccess redirect for WP Engine users.
• Improvement: adjust for dropped .htaccess support in WP Engine

• Improvement: some small CSS improvements in the dashboard
• Fix: Switched wp_insert_site hook to wp_initialize_site props @masumm17
• Fix: multisite: after switching from networkwide to per site, or vice versa, the completed notice didn't go away.

• Fix: fixed a bug in the get_certinfo() function where an URL with a double prefix could be checked
• Improvement: Content Security Policy compatibility

• Fix: catch not set certificate info in case of empty array when no certificate is available
• Fix: minor CSS fixes

• Improvement: Improved responsive css for tabbed menu
• Improvement: PHP 8 compatibility
• Improvement: Added links to help article for not writable notices
• Improvement: notice when plugin folder had been renamed
• Improvement: increase php minimum required to 5.6

• Backward compatibility for <4.0 premium versions

• Added Really Simple Plugins logo
• Fix: enable link in task for multisite redirected to subsite
• Fix: exclude plus one count from admin notices

• Fix: sitehealth dismiss not working correctly, props @doffine

• Fix: not translatable string, props @kebbet
• Improvement: clear admin notices cache when SSL activated or reloaded over https
• Fix: removed javascript regex not supported by Safari, causing the dismiss not to work on the progress block
• Improvement: option to dismiss site health notices in the settings

• Fix: fixed a bug where switching between the WP/.htaccess redirect caused a percentage switch
• No SSL detected notice is cached after enabling SSL. props @memery2020
• Fix: deactivating before SSL was activated on a site which was already SSL would revert to http.

• New user interface
• Fix: transient stored with 'WEEK_IN_SECONDS' as string instead of constant
• Improvement: notices dashboard, with dismissable notices
• Improvement: improved naming of settings, and instructions
• Improvement: articles in tips & tricks section

• Fix: prefix review notice dismiss to prevent conflicts with other plugins

• Dismiss review notice now uses get variable to dismiss it

• Added a notice when using Divi theme with a link to knowledge base instructions
• Fixed a CSS issue where the active tab in setting didn't have an active color
• Added an additional option to dismiss the review notice
• Removed review notice capability check
• Fixed a bug on multisite where a plusone was shown when it should only shown on non-multisite
• Added prefix to uses_elementor() function and added checks if function_exists

• Fixed a typo in the backup link
• Added instructions on how to add a free SSL certificate

• Updated SSL activated notice
• Updated readme

• Fixed a bug where the redirect to settings page would abort SSL activation, not writing the wp-config fix on new installs
• Fixed typo in force-deactivate notice

• Added redirect to settings page after activating SSL
• Improved dashboard SSL certificate check by using the is_valid check from rsssl_certificate instead of relying on site_has_ssl
• Updated activation notice
• Updated settings page sidebar styling and links

• Updated switch_to_blog function in to a backwards compatible version for older WP installations
• Updated review notice
• Improved .htaccess not writeable notice for Bitnami installations to show htaccess.conf location
• Updated green lock to secure lock text
• Removed border for dashboard sidebar button
• Activate some security headers by default when pro is enabled

• Optimized plusone count function
• Disabled Javascript redirect by default
• Fixed a bug in the setting highlight function where an undefined setting name could cause a warning

• Fixed typo in trace_log() function call

• Improved and added dashboard notices
• Improved debug logging
• Added option to dismiss all Really Simple Security notices
• Fixed a bug where other plugins buttons had their style reset

• Added right-to-left text support
• Show a plusone behind the notice that generated it
• Added a dismiss text link to dismissible notices
• Added highlighting to .htaccess redirect option after clicking on dashboard link
• Added option to dismiss all notices
• Added site health notice

• Fix: some single sites setup were having issues with multisite files being included.

• Fix: error in regex, cause a fatal error in cases where a plus one already was showing in the settings menu

• Added update counter to Settings/SSL menu item if recommended settings aren't enabled yet
• Added WP-CLI support
• Tweak: made some dashboard items dismissible
• Tweak: added link on multisite networkwide activation notice to switch function hook to fix conversions hanging on 0%
• Tweak: required WordPress version now 4.6 because of get_networks() version

• Fix: fixed a bug where having an open_basedir defined showed PHP warnings when using htaccess.conf

• Tweak: added support for Bitnami/AWS htaccess.conf file
• Tweak: multisite blog count now only counts public sites
• Tweak: changed rewrite rules flush time to 1-5 minutes
• Tweak: improved multisite site count

• Tweak: no longer shows notices on Gutenberg edit screens
• Tweak: updated Google Analytics with link to SSL settings page
• Fix: multisite blog count now only counts public sites

• Tweak: added cool checkboxes
• Tweak: .well-known/acme-challenge/ is excluded from .htaccess https:// redirect
• Tweak: implemented transients for functions that use curl/wp_remote_get()
• Tweak: improved mixed content fixer detection notifications
• Tweak: removed review notice for multisite

• Fix: Multisite network wide activation/deactivation cron not saving settings because user capability not set this early in the process.

• Fix: fixed a bug in certificate detection
• Tweak: added HTTP_X_PROTO as supported header
• Tweak: split HTTP_X_FORWARDED_SSL into a variation which can be either '1' or 'on'
• Tweak: improved certificate detection by stripping domains of subfolders.
• Tweak: Multisite bulk SSL activation now chunked in 200 site blocks, to prevent time out issues on large multisite networks.
• Tweak: a 'leave review' notice for new free users

• Fix: untranslatable string made translatable.

• Fix: removed anonymous function to maintain PHP 5.2 compatibility.

• Tweak: mixed content fixer will no longer fire on XML content
• Tweak: network menu on subsites now always shows to Super Admins
• Tweak: flush rewrite rules upon activation is delayed by one minute to reduce server load

• Fix: fixed an image containing uppercase characters, which can lead to the image not showing on some servers.
• Fix: fixed an issue where the 'data-rsssl=1' marker wasn't inserted when the tag was empty.

• Tweak: Add privacy notice
• Tweak: Set javascript redirect to false by default
• Fix: Hide SSL notice on multisite for all subsites, and show only for "activate_plugins" cap users

• Added a built-in certificate check in the class-certificate.php file that checks if the domain is present in the common names and/or the alternative names section.
• The .htaccess redirect now uses $1 instead of {REQUEST_URI}.
• Added an option to deactivate the plugin while keeping SSL in the SSL settings.
• Added a filter for the Javascript redirect.
• Added a sidebar with recommended plugins.

• Fix: multisite menu not showing when main site is not SSL.
• Fix: the admin_url and site_url filter get an empty blog_id when checking the URL for the current blog.
• Tweak: added comment to encourage backing up to activation notice.
• Tested the plugin with Gutenberg.

• Fix: "switch mixed content fixer hook" option not visible on the multisites settings page
• Tweak: several typo's and uppercasing

• Fix: On multisite, admin_url forced current blog URL's over http even when the current blog was loaded over https. This will now only force http for other blog_urls than the current one, when they are on http and not https.

• Tested up to WP 4.9
• Added secure cookie notice

• Changed mixed content fixer hook back from wp_print_footer_scripts to shutdown

• Fixed double slash in paths to files
• Fixed typo in activation notice.
• Tweak: added option to not flush the rewrite rules
• Fix: prevent forcing admin_url to http when FORCE_SSL_ADMIN is defined

• Tweak: constant RSSSL_DISMISS_ACTIVATE_SSL_NOTICE to allow users to hide notices.
• Tweak: setting to switch the mixed content fixer hook from template_redirect to init.
• Fix: nag in multisite didn't dismiss properly

• Multisite fix: due to a merge admin_url and site_url filters were dropped, re-added them
• Added constant RSSSL_CONTENT_FIXER_ON_INIT so users can keep on using the init hook for the mixed content fixer.

• Tweak: Removed JetPack fix, as it is now incorporated in JetPack.
• Tweak: Moved mixed content fixer hook to template_redirect
• Fix: Changed flush rewrite rules hook from admin_init to shutdown, on activation of SSL.
• Multisite fix: Changed function which checks if admin_url and site_url should return http or https to check for https in home_url.
• Tweak: Explicitly excluded json and xmlrpc requests from the mixed content fixer

• Tweak: Added a function where the home_url and site_url on multisite check if it should be http or https when SSL is enabled on a per site basis.
• Tweak: Added a notice that there will be no network menu when Really Simple Security is activated per site.
• Tweak: Added hook for new multisite site so a new site will be activated as SSL when network wide is activated.
• Tweak: limited the JetPack listen on port 80 tweak to reverse proxy servers.
• Tweak: created a dedicated rest api redirect constant in case users want to prevent the rest api from redirecting to https.
• Fix: dismissal of SSL activated notice on multisite did not work properly

• Reverted wp_safe_redirect to wp_redirect, as wp_safe_redirect causes a redirect to wp-login.php even when the primary url is domain.com and request url www.domain.com

• No functional changes, version change because WordPress was not processing the version update

• Fix: fixed issue in the mixed content fixer where on optimized html the match would match across elements.
• replaced wp_redirect with wp_safe_redirect
• Added force SSL on wp_rest_api

• Tweak: configuration more function

• Added multisite settings page
• Added filter for .htaccess code output
• Increased user capability to "activate_plugins"
• Added SSL_FORWARDED_PROTO = 1 in addition to SSL_FORWARDED_PROTO = on as supported SSL recognition variable.

• Removed curl in favor of wp_remote_get

• Fastest cache compatibility fix

• Multisite tweaks

• Removed automatic insertion of .htaccess redirects. The .htaccess redirects work fine for most people, but can cause issues in some edge cases.
• Added option to explicitly insert .htaccess redirect
• Added safe mode constant RSSSL_SAFE_MODE to enable activating in a minimized way
• Fix: RLRSSSL_DO_NOT_EDIT_HTACCESS constant did not override setting correctly when setting was used before.
• Dropped cache flushing on activation, as this does not always work as expected

• Tweak: changes testurl to the function test_url()

• version nr fix

• Reverted some changes to 2.4.3, as it was causing issues for some users.

fix: Adjusted selection order of .htaccess rules, preventing redirect loops

• Changed .htaccess redirects to use only one condition

• removed file_get_contents function from class_url.php, as in some cases this causes issues.

• Added help tooltips
• Fix: typos in explanations
• Added detected server to debug Log
• Added test folder for CloudFlare
• Added htaccess redirect to use all available server vars for checking SSL.

• Tweak: Improved support for cloudflare
• Tweak: Added support for Cloudfront, thanks to Sharif Alexandre
• Fix: Prevent writing of empty .htaccess redirect
• Tweak: Added option for 301 internal wp redirect
• Tweak: Improved NGINX support
• Tweak: Added support for when only the $_ENV[HTTPS] variable is present
• Fix: Mixed content fixing of escaped URLS

• Removed banner in admin

• Tweak: Added reload over https link for when SSL was not detected
• Fixed: After reloading page when the .htaccess message shows, .htaccess is now rewritten.
• Tweak: Removed Yoast notices
• Tested for WP 4.7
• Fixed: bug where network options were not removed properly on deactivation
• Tweak: Changed mixed content marker to variation without quotes, to prevent issues with scripting etc.

• Tweak: improved HSTS check

• Fixed: added a version check on wp_get_sites / get_sites to get rid of deprecated function notice, and keep backward compatibility.
• Fixed: A bug in multisite where plugin_url returned a malformed url in case of main site containing a trailing slash, and subsite not. Thanks to @gahapati for reporting this bug.
• Tweak: Added button to settings page to enable SSL, for cases where another plugin is blocking admin notices.
• Tweak: Rebuilt the mixed content fixer, for better compatibility
• Tweak: Improved the mixed content marker on the front-end, so it's less noticeable, and won't get removed by minification code.

• Fixed: Clearing of WP Rocket cache after SSL activation causing an error
• Fixed: Clearing of W3TC after SSL activation did not function properly

• Re-inserted Jetpack fix.

• Requires at least changed back to 4.2, as the function that this was meant for didn’t make it in current release yet.

• Improved request method in url class
• Added check if .htaccess actually exists in htaccess_contains_redirect_rules()
• Made activation message more clear.

• Tested for 4.6
• Tweak: changed check for htaccess redirect from checking the RSSSL comments to checking the redirect rule itself
• Fix: htaccess not writable message not shown anymore when SSL not yet enabled
• Tweak: extended mixed content fixer to cover actions in forms, as those should also be http in case of external urls.
• Tweak: added safe domain list for domains that get found but are no threat.
• Tweak: added filter for get_admin_url in multisite situations, where WP always returns an https url, although the site might not be on SSL
• Tweak: htaccess files and wpconfig are rewritten when the settings page is loaded

• Fix: removed internal WordPress redirect as it causes issues for some users.
• Tweak: improved url request method

• Tweak: Fallback redirect changed into internal wp redirect, which is faster
• Tweak: When no .htaccess rules are detected, redirect option is enabled automatically
• Tweak: Url request falls back to file_get_contents when curl does not give a result

• Updated screenshots

• Fixed: missing priority in template_include hook caused not activating mixed content fixer in some themes

• Fixed: javascript redirect insertion

• Tweak: load css stylesheet only on options page and before enabling ssl
• Tweak: mixed content fixer triggered by is_ssl(), which prevents fixing content on http.
• Start detection and configuration only for users with "manage_options" capability

• Fixed bug in force-deactivate script

• Changed SSL detection so test page is only needed when not currently on SSL.
• Some minor bug fixes.

• Removed "activate ssl" option when no ssl is detected.
• Optimized emptying of cache
• Fixed some bugs in deactivation and activation of multisite

• Gave more control over activation process by explicitly asking to enable SSL.
• Added a notice if .htaccess is not writable

Fixed a bug in SSL detection

Changed followlocation in curl to an alternative method, as this gives issues when safemode or open_basedir is enabled. Added dismissable message when redirects cannot be inserted in the .htaccess

Fixed bug in logging of curl detection

Security fixes in ssl-test-page.php

Bugfix with of insecure content fixer.

Added a check if the mixed content fixer is functioning on the front end Fixed a bug where multisite per_site_activation variable wasn't stored networkwide Added clearing of wp_rocket cache thans to Greg for suggesting this Added filter so you can remove the really simple security comment Fixed a bug in the output buffer usage, which resolves several issues. Added code so JetPack will run smoothly on SSL as well, thanks to Konstantin for suggesting this

• To prevent lockouts, it is no longer possible to activate plugin when wp-config.php is not writable. In case of loadbalancers, activating ssl without adding the necessary fix in the wp-config would cause a redirect loop which would lock you out of the admin.
• Moved redirect above the WordPress rewrite rules in the htaccess file.
• Added an option to disable the fallback javascript redirection to https.

Brand new content fixer, which fixes all links on in the source of your website.

• Roll back of mixed content fixer.

Improved the mixed content fixer. Faster and more effective.

Edited the wpconfig define check to prevent warnings when none are needed.

• Extended detection of homeurl and siteurl constants in wp-config.php with regex to allow for spaces in code.
• Changed text domain to make this plugin language packs ready
• Added 404 detection to SSL detection function, so subdomains can get checked properly on subdomain multisite installs

Added slash in redirect rule small bugfixes

documentation update

• Added multisite support for the missing https server variable issue
• Improved curl connection script
• Added French translation thanks to Cedric

• Small bug fixes

• Added per site activation for multisite, but excluded this option for subfolder installs.
• Added script to easily deactivate the plugin when you are locked out of the WordPress admin.
• Added support for a situation where no server variables are given which can indicate SSL, which can cause WordPress to generate errors and redirect loops.
• Removed warning on WooCommerce force SSL after checkout, as only unforce SSL seems to be causing problems
• Added Russian translation, thanks to xsascha
• Improved redirect rules in the .htaccess
• Added option te disable the plugin from editing the .htaccess in the settings
• Fixed a bug where multisite would not deactivate correctly
• Fixed a bug where insecure content scan would not scan custom post types

• Made WooCommerce warning dismissable, as it does not seem to cause issues
• Fixed a bug caused by WP native plugin_dir_url() returning relative path, resulting in no SSL messages

• Fixed a bug where example .htaccess rewrite rules weren't generated correctly
• Added WooCommerce to the plugin conflicts handler, as some settings conflict with this plugin, and are superfluous when you force your site to SSL anyway.
• Excluded transients from mixed content scan results

• Fixed a bug where script would fail because curl function was not installed.
• Added debug messages
• Improved FAQ, removed typos
• Replaced screenshots

• Improved user interface with tabs
• Changed function to test SSL test page from file_get_contents to curl, as this improves response time, which might prevent "no SSL messages"
• Extended the mixed content fixer to replace src="http:// links, as these should always be https on an SSL site.
• Added an error message in case of force rewrite titles in Yoast SEO plugin is used, as this prevents the plugin from fixing mixed content

• Added support for loadbalancer and is_ssl() returning false: in that case a wp-config fix is needed.
• Improved performance
• Added debugging option, so a trace log can be viewed
• Fixed a bug where the rlrsssl_replace_url_args filter was not applied correctly.

• Fixed an issue where in some configurations the replace url filter did not fire

• Added the force SSL option, in cases where SSL could not be detected for some reason.
• Added a test to check if the proposed .htaccess rules will work in the current environment.
• Readded HSTS to the htaccess rules, but now as an option. Adding this should be done only when you are sure you do not want to revert back to http.

• Improved instructions regarding uninstalling when locked out of back-end

• Removed HSTS headers, because it is difficult to roll back.

• Added the possibility to prevent htaccess from being edited, in case of redirect loop.

• Refined SSL detection
• Bugfix on deactivation of plugin

• Fixed an SSL detection issue which could lead to redirect loop

• Improved redirect rules for .htaccess

• Now plugin only changes .htaccess when one of three preprogrammed ssl types was recognized.
• Simplified filter use to add your own urls to replace, see f.a.q.
• Default javascript redirect when .htaccess redirect does not succeed

• Fixed bug where number of options with mixed content was not displayed correctly

• limited the number of files, posts and options that can be show at once in the mixed content scan.

• Added version control to the .htaccess rules, so the .htaccess gets updated as well.
• Added detection of loadbalancer and cdn so .htaccess rules can be adapted accordingly. Fixes some redirect loop issues.
• Added the possibility to disable the auto replace of insecure links
• Added a scan to scan the website for insecure links
• Added detection of in wp-config.php defined siteurl and homeurl, which could prevent from successful url change.
• Dropped the force ssl option (used when not ssl detected)
• Thanks to Peter Tak, PTA security for mentioning the owasp security best practice https://www.owasp.org/index.php/HTTP_Strict_Transport_Security in .htaccess,

• Added 301 redirect to .htaccess for seo purposes

• Fixed some typos in readme
• added screenshots
• fixed a bug where on deactivation the https wasn't removed from siturl and homeurl

• Added SSL detection by opening a page in the plugin directory over https
• Added https redirection in .htaccess, when possible
• Added warnings and messages to improve user experience
• Added automatic change of siteurl and homeurl to https, to make backend ssl proof.
• Added caching flush support for WP fastest cache, Zen Cache and W3TC
• Fixed bug where siteurl was used as url to fix instead of homeurl
• Fixed issue where url was not replaced on front end, when used url in content is different from home url (e.g. http://www.domain.com as homeurl and http://domain.com in content)
• Added filter so you can add cdn urls to the replacement script
• Added googleapis.com/ajax cdn to standard replacement script, as it is often used without https.

• Improved installation instructions