22 lines (17 loc) · 1.22 KB

Changelog

All notable changes to this project will be documented in this file.

[1.4.1] - 2026-06-19

Changed

$_SERVER['HTTP_X_FORWARDED_PROTO'] is now unslashed and sanitized before use, following WPCS input-handling conventions (no functional or security impact — the value was only used in a string comparison; behavior is identical to v1.4.0)
Flipped four comparisons to Yoda condition style (no behavior change)
Added missing @package docblock tag and corrected docblock spacing (code-style only)

[1.4] - 2026-06-19

Fixed

HTTPS detection no longer uses a hostname-based heuristic (checking for a dot in HTTP_HOST). It now relies exclusively on a genuine X-Forwarded-Proto: https header, preventing false HTTPS detection on direct, non-proxied connections.
home_url() and site_url() filters are now gated on the detected HTTPS state, so URLs are only rewritten to https:// when HTTPS has actually been detected. Previously the rewrite was unconditional, which forced HTTPS URLs even on plain-HTTP paths.

[1.3] - 2025-09-11

Added

Initial public release
Enforces HTTPS detection behind reverse proxies
Corrects REST API resolution for Rank Math
Skips enforcement during WP-CLI operations