VOLIXTA TEAM

Is your WordPress site still serving pages over HTTP instead of HTTPS? 
Do you see browser warnings like “Not Secure” even though you installed SSL? 
Are you getting mixed content errors in Chrome or Firefox after enabling HTTPS? 
Is your Site Health report complaining about missing security headers?
👉 Volixta SSL & Security Headers fixes all of these in a few clicks.
Easily activate SSL, force 301 redirects, repair mixed content, and apply recommended WordPress security headers like HSTS, CSP, and X-Frame-Options.
<h3>🔐 What does Volixta do?</h3>
<ul>
<li>Activate SSL automatically: safely update your WordPress <code>home</code> and <code>siteurl</code> to use <code>https://</code>.</li>
<li>Force HTTPS with 301 redirect: adds a safe <code>.htaccess</code> block on Apache/LiteSpeed, or falls back to a PHP redirect if needed.</li>
<li>Fix mixed content: scans your posts, postmeta, and options for <code>http://</code> links and replaces them with <code>https://</code> (serialization-safe).</li>
<li>Apply modern HTTP Security Headers: HSTS, Content-Security-Policy (<code>upgrade-insecure-requests</code>), X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP.</li>
<li>Nginx friendly: when <code>.htaccess</code> is not available, Volixta shows ready-to-copy Nginx rules.</li>
<li>Site Health integration: checks for SSL, redirects, and security headers.</li>
</ul>
<h3>✅ Why choose Volixta?</h3>
<ul>
<li>
Safe by design 
Nothing is applied automatically. You choose what to enable. Each <code>.htaccess</code> modification creates a timestamped backup.
</li>
<li>
Serialization-safe mixed content fixer 
No risk of breaking complex serialized data in <code>postmeta</code> or <code>options</code>.
</li>
<li>
Admin-only processing 
Everything runs in the admin area. The frontend only uses the optional PHP redirect when required.
</li>
<li>
Localhost aware 
Detects local environments (<code>localhost</code>, <code>.local</code>, <code>.test</code>) and provides instructions for enabling trusted HTTPS locally with <a href="https://github.com/FiloSottile/mkcert" rel="nofollow ugc">mkcert</a>.
</li>
</ul>
<h3>🔎 Typical problems solved</h3>
How do I activate SSL in WordPress? 
→ One click in Volixta updates your site to HTTPS safely.
How do I force HTTPS with 301 redirects? 
→ Volixta inserts a safe <code>.htaccess</code> redirect or uses a PHP fallback.
My Site Health report says “No security headers detected”. 
→ Apply modern security headers in one click.
How can I add WordPress security headers without editing code? 
→ Configure and apply headers from the plugin interface.
After enabling SSL, my site still shows mixed content errors. 
→ Run the Mixed Content Scan + Fixer.
I’m on Nginx, so .htaccess doesn’t work. 
→ Volixta provides ready-to-copy Nginx configuration snippets.
<h3>Privacy</h3>
This plugin does not collect, store, or transmit personal data.
<h3>Localization</h3>
Text domain: <code>volixta-ssl-security-headers</code> 
Load path: <code>/languages</code>
<h3>What’s Next</h3>
If you like this plugin, check out our other tools:
<ul>
<li>
<a href="https://volixta.com" rel="nofollow ugc">VOLIXTA Booking – The All-in-One WordPress Booking Plugin</a> 
Manage unlimited staff, services, clients, payments, and locations in one powerful system.
</li>
<li>
<a href="https://volixta.com/volixta-security-suite" rel="nofollow ugc">VOLIXTA Security Suite – Advanced WordPress Security Made Simple</a>
</li>
</ul>

Volixta SSL & Security Headers

Add modern security headers, enable SSL/HTTPS, fix mixed content, and force 301 redirects for WordPress. Fast, safe, and easy to use.

Aaditya Sharma

Webtaru Site Options and Login Security is a comprehensive toolkit for WordPress administrators to manage essential site information, business hours, and visual branding, while simultaneously hardening your site’s security by allowing you to change the default login URL and add CAPTCHA protection.
<h3>Features</h3>
<h4>Security & Privacy</h4>
<ul>
<li>File & Malware Scanner: Scan your active plugins, themes, and database options for known malware signatures, injected scripts, and hidden backdoors. Includes a 1-Click Auto-Clean feature.</li>
<li>Geo-Blocking: Restrict access to your login page or entire site based on the visitor’s country using lightweight IP lookups.</li>
<li>Secure Login Customization: Change your WordPress login URL to a custom slug to prevent brute-force attacks. Includes a secret key cache-bypass query string for cached environments.</li>
<li>CAPTCHA Integration: Support for Google reCAPTCHA v3 and Cloudflare Turnstile to protect your login forms.</li>
<li>Login Attempt Limiter: Prevent brute-force attacks by limiting failed login attempts. Unlock locked-out IPs directly from the dashboard.</li>
<li>Email-Based 2FA: Intercept logins and require verification codes sent via email for administrators or selected roles.</li>
<li>Inactivity Auto-Logout: Monitor idle times and automatically log out inactive users with an elegant countdown warning overlay.</li>
<li>Login Email Alerts: Receive instant email notifications with user, IP, User Agent, Time, and Site URL upon successful logins.</li>
<li>Advanced XSS Protection: Add basic or advanced security headers to protect your site from script injections.</li>
<li>Basic Security Firewall: Automatically block common malicious query strings, SQL injections, and malware patterns.</li>
<li>REST API Restriction: Restrict WP REST API access for unauthorized users to prevent data enumeration.</li>
<li>Disable Common Usernames: Prevent user registration and logins for weak usernames like “admin” to harden security.</li>
<li>Site Hardening: Restrict author archives to prevent username enumeration and improve overall site safety.</li>
<li>Disable XML-RPC: Disable XML-RPC requests to protect against DDoS and external credential verification exploits.</li>
<li>Content Protection: Protect your content by disabling Right-Click, Text Selection, and Copy-Paste globally.</li>
</ul>
<h4>UI & UX Enhancements</h4>
<ul>
<li>Admin Bar Zen Mode: Instantly declutter the admin bar by removing distracting logos, comments, updates, and notices.</li>
<li>Admin Bar Cleanup: Declutter your dashboard by selectively hiding top-level and third-party admin bar nodes.</li>
<li>Dashboard Widgets: Agency-ready dashboard widget showcasing customized business contact and operational details.</li>
<li>Sticky WhatsApp Button: Add a floating WhatsApp contact bubble with customizable placement, numbers, display conditions, and greeting messages.</li>
<li>Sticky Vertical Button: Add a customizable floating side button (e.g. for Feedback or Contact) with customizable styles, IDs, and positions.</li>
<li>Mobile Navigation Bar: Add fixed bottom action navigation buttons specifically optimized for mobile visitors.</li>
<li>Back to Top Button: Smooth scrolling back-to-top button with customizable background/icon colors, shapes, and sizes.</li>
<li>Smooth Inertia Scrolling: Enable customizable fluid mousewheel scrolling speeds and smoothness globally.</li>
</ul>
<h4>Identity & Branding</h4>
<ul>
<li>Advanced Custom Login Page Designer: Elevate your login experience with premium templates like Split-Screen Layouts and modern Glassmorphism aesthetics.</li>
<li>Logo Management: Manage separate Light and Dark versions of your website logo, and support custom SVG uploads.</li>
<li>Login Page Aesthetics: Completely customize the login page with a custom logo, background image, styling overrides, and a custom error message.</li>
<li>Contact & Social Info: Centralized control of primary and secondary phone numbers, email addresses, fax, maps, and social profiles.</li>
<li>Agency Mode / White-Labeling: White-label the plugin for your clients by renaming the menu page and hiding the default brand icon.</li>
</ul>
<h4>SEO & Communication</h4>
<ul>
<li>Business Hours Scheduler: Manage daily business hours and display them dynamically with “Open/Closed” indicator shortcodes.</li>
<li>Schema.org JSON-LD: Automatically generate local SEO-optimized LocalBusiness Schema JSON-LD markup based on your options.</li>
<li>SMTP Integration: Route all outgoing WordPress emails through a secure SMTP configuration (host, port, security, authorization) and test it with a built-in email tool.</li>
<li>Maintenance Mode: Toggle a professional maintenance page with custom headings, messages, SVG status cogs, contact details, and bypass cookies.</li>
<li>Auto-Alt Text: Automatically fill missing image Alt tags with image titles for improved image search SEO.</li>
</ul>
<h4>Content & Media Management</h4>
<ul>
<li>AJAX Media Replacement: Overwrite and replace media files directly from the attachment details panel or list view while preserving the original URLs and file names.</li>
<li>Post & Page Duplicator: Clone or duplicate posts, pages, or custom post types in one click from dashboard list tables.</li>
<li>Duplicate Menu: Duplicate navigation menus with a single click in the WordPress Menu Editor screen.</li>
<li>External Links Control: Force all external links in post content to open in a new tab (<code>target="_blank"</code>) automatically.</li>
<li>Shortcodes & Page Builder Widgets: Built-in Elementor Widget and WPBakery Page Builder element for drag-and-drop dynamic contact info placement.</li>
</ul>
<h4>Admin Workflow & Optimizations</h4>
<ul>
<li>Gutenberg Editor Control: Disable the Gutenberg Block Editor and easily restore the classic visual/text editor interface.</li>
<li>Disable Comments Sitewide: Disable commenting features and references sitewide for posts, pages, and media attachment files.</li>
<li>Disable Theme/Plugin File Editor: Turn off the default theme and plugin editor to protect source code from unauthorized modifications.</li>
<li>Hide Admin Sidebar Menus: Hide specific sidebar menus for non-administrators or standard users.</li>
<li>One-Click Cache Flushing: Flush cache across WP Rocket, LiteSpeed Cache, SG Optimizer, and WP Engine on settings save.</li>
<li>Remove Query Strings: Remove version query strings (<code>?ver=</code>) from CSS and JS files for improved page speed scores.</li>
<li>Copyright Year Shortcode: <code>[wtols_copyright]</code> shortcode that automatically displays and updates the current calendar year.</li>
<li>Custom CSS & JS Injector: Inject custom scripts/styles in the header/footer of front-end pages.</li>
<li>404 Redirection: Redirect all 404 Not Found errors to the home page with temporary 302 redirects to preserve SEO rankings.</li>
</ul>
<h4>Database & Redirection Manager</h4>
<ul>
<li>301/302 Redirect Manager: Create, update, and bulk-delete custom source-to-target URL redirects. Supports importing and exporting redirects via JSON.</li>
<li>Database Optimization: Run database cleanup tasks to purge revisions, drafts, transients, and orphan metadata.</li>
<li>Backup & Restore settings: Export your site options configuration as a JSON file and restore it on any site.</li>
</ul>
<h3>External services</h3>
This plugin supports the following third-party services to enhance site security:
<ul>
<li>
Google reCAPTCHA (v3): Used to protect the login form from automated bot attacks.
<ul>
<li>Service: Google reCAPTCHA</li>
<li>Usage: Verification of human users during login.</li>
<li>Data Sent: User’s IP address and browser interaction signals.</li>
<li>Privacy Policy: https://policies.google.com/privacy</li>
<li>Terms of Service: https://policies.google.com/terms</li>
</ul>
</li>
<li>
Cloudflare Turnstile: A privacy-focused alternative to CAPTCHA for protecting login forms.
<ul>
<li>Service: Cloudflare Turnstile</li>
<li>Usage: Verification of human users during login.</li>
<li>Data Sent: Browser and device telemetry.</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
</li>
</ul>
<h3>Shortcodes</h3>
<ul>
<li><code>[wtols_phone]</code> – Display primary phone.</li>
<li><code>[wtols_email]</code> – Display primary email.</li>
<li><code>[wtols_address]</code> – Display business address.</li>
<li><code>[wtols_logo]</code> – Display light/dark logo.</li>
<li><code>[wtols_map]</code> – Display embedded map.</li>
<li><code>[wtols_social_links]</code> – Display social icons.</li>
<li><code>[wtols_hours]</code> – Display business hours or open/closed status.</li>
<li><code>[wtols_contact_card]</code> – Display a complete contact info block.</li>
</ul>

Webtaru Site Options and Login Security

Manage contact info, business hours, schema SEO, and harden login security with custom slugs and CAPTCHA from a single premium admin panel.

Volixta SSL & Security Headers vs Webtaru Site Options and Login Security