About this plugin
Volixta SSL & Security Headers helps WordPress site owners configure HTTPS, manage SSL certificates, fix mixed content, and apply modern browser security without manually editing sensitive server files.
Use Volixta to request free Let’s Encrypt certificates, install supported certificates through hosting integrations, switch WordPress to HTTPS, configure 301 redirects, and verify the certificate that visitors actually receive.
Key features include:
- Guided Setup Wizard that checks your site first, then guides you step by step through SSL certificate setup, HTTPS activation, redirects, Security Headers, optional alerts, and a final status review.
- Beginner-first Overview with advanced certificate, DNS, HSTS, CSP, Secure Cookies, Mixed Content, file, backup, and recovery tools available when needed.
- WordPress Dashboard security widget showing a compact HTTPS, public Security Headers and certificate-expiry overview after an administrator-requested check, with a link to Volixta Ecosystem.
- Free SSL certificates with Let’s Encrypt ACME v2 using automatic HTTP-01 or manual DNS-01 validation, including wildcard certificates.
- Automatic SSL installation for supported cPanel, Plesk, and DirectAdmin environments, with hosting account connection directly from the Setup Wizard and downloadable certificate files for manual installation.
- Automatic renewal checks for eligible HTTP-01 Volixta-managed production certificates, with clear renewal status and guidance for manual DNS-01 certificates.
- HTTPS setup and redirects with guarded Apache/LiteSpeed.htaccess changes and clear Nginx guidance.
- Mixed Content tools including frontend checks, Deep Scan, Live Fixer, and serialization-safe database cleanup.
- Security Headers including HSTS, CSP, CSP Report-Only, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, and CORP.
- Secure Cookies for WordPress authentication and PHP sessions with Secure, HttpOnly, and SameSite=Lax protection.
- Safety Backups before managed.htaccess changes. wp-config.php backups are downloaded directly to your computer and are not stored by Volixta on the server.
- Certificate and protection alerts for upcoming certificate expiry, recent renewal failures, and protection regressions.
- HSTS preload assistant that verifies the public Strict-Transport-Security response before reporting preload readiness, without submitting your domain to an external preload service.
- Hosting-aware guidance for Apache, LiteSpeed, Nginx, reverse proxies, Cloudflare, localhost, and manual certificate workflows.
- Local development support with a simplified Setup Wizard that avoids unsupported production-only actions while keeping compatible local HTTPS workflows available.
htaccess content.
Volixta Ecosystem
Open Volixta Ecosystem from the main plugin navigation or the WordPress admin submenu to discover compatible Volixta products, including Analytics Lite, Support, Task Manager Lite and Database Manager. org plugins, or open installed plugins. Volixta Booking links to its external website.
All additional plugins are optional.
External Services
Volixta does not send telemetry or usage analytics. External connections happen only when an administrator explicitly uses a feature that requires them.
- Let’s Encrypt / ISRG — used when you request or renew a certificate. The requested domain names and ACME protocol data are sent to Let’s Encrypt. The ACME contact email you provide is sent to ISRG with the account request. See https://letsencrypt.org/repository/ and https://letsencrypt.org/privacy/.
- Hosting control panels — cPanel, Plesk, or DirectAdmin are contacted only after you explicitly configure the integration and request certificate installation. Certificate/private-key material is sent only to the hosting endpoint you configured or that Volixta safely detected.
- Your own public website/DNS — certificate, HTTP-01, DNS-01, HTTPS, header, and Mixed Content checks may connect to the site/domain you are administering. These checks do not send data to Volixta.
Privacy
Volixta SSL & Security Headers does not include analytics, usage tracking, or visitor tracking.
The plugin stores the configuration required for enabled features inside your WordPress installation.
Some actions communicate with external services when you explicitly use features that require them.
Examples include:
- Let’s Encrypt: certificate requests and ACME validation.
- Hosting integrations: configured cPanel, Plesk, or DirectAdmin connections used for certificate installation.
Only information required to perform the requested operation is sent to those services.
Localization
Text domain: volixta-ssl-security-headers
Load path: /languages
What’s Next
If you like this plugin, explore more WordPress tools from Volixta:
- Volixta Booking — Manage appointments, services, staff, customers, payments and locations.
- Volixta Analytics Lite — Privacy-focused website analytics with visitor tracking and traffic insights.
- Volixta Support — Manage customer support tickets, conversations, support plans and private customer portals.
- Volixta Task Manager Lite — Organize projects and tasks with customizable Kanban boards, calendars, reminders and Volixta Support integration.
- Volixta Database Manager — Browse database tables, manage options and clean up unnecessary records.