Auto-Install Free SSL – Generate & Install Free SSL Certificates

Changelog

5.0.0

• [Pro] Feature: GoDaddy DNS Service Provider entries can now use either a classic API Key/Secret pair or a newer Personal Access Token (PAT) for wildcard SSL DNS-01 validation; GoDaddy TXT records are updated in place on renewal instead of being deleted and recreated.
• [Pro] Fix: Wildcard SSL certificate issuance using the DNS-01 challenge (any DNS Service Provider, including cPanel) was completely broken — every wildcard request sent an empty challenge response to Let’s Encrypt™ and was rejected. This is now fixed.
• [Pro] Security: Following a full-codebase security review, closed several cPanel credential-exposure issues: cPanel API debug logging (which could log raw API responses/headers) is now off by default, cPanel credentials were briefly written back into the WordPress options table on every admin page load in cPanel mode (now fixed), and the plugin log’s secret-redaction pattern now also masks base64/base64url tokens (e.g. cPanel/DNS-provider API tokens), not just hex ones.
• Security: The certificate-file download page, the manual HTTP-01 challenge-file handler, and the Log page’s date parameter now require administrator (manage_options) capability and strictly validate their inputs, closing a path-traversal opening that could allow reading or writing files outside the plugin’s own certificate folder.
• Security: Added a missing nonce/capability check to the Force HTTPS override link, and switched the Force HTTPS “revert” link (sent by email) to a timing-safe comparison for its one-time secret.
• [Pro] Security: Added missing nonce/capability checks (CSRF protection) to the Domains and DNS Service Provider “Delete” links and to the Add Cron Job form.
• Security: Hardened output escaping on the Log page, admin notices, and the Generate SSL page’s admin-email field, closing a couple of admin-only XSS opportunities.
• [Pro] Security: Hardened output escaping on the live log stream, the Download SSL Certificates page, and the Domains / DNS Service Provider / Revoke SSL Certificate settings screens, closing a handful of admin-only XSS opportunities.
• [Pro] Security: DNS record values sent to the Namecheap API are now properly URL-encoded, so a value containing “&” or “=” can no longer corrupt the request or drop unrelated DNS records; fixed Cloudflare DNS-01 TXT-record creation failing (or erroring) for subdomains and on API authentication errors, and fixed it creating a duplicate TXT record instead of updating the existing one for a subdomain; the DNS Service Provider list is now limited to the providers this plugin actually supports.
• [Pro] Security: Added an optional shared-secret and a run lock for cron.php when triggered over HTTP (configurable from the Add Cron Job page), and a warning on the cPanel Settings page when TLS certificate verification is left disabled while a verified connection to the same host is confirmed to work.
• [Pro] Reliability: Added connection/response timeouts to all cPanel API calls so an unresponsive cPanel host can no longer hang a cron run or admin request.
• [Pro] Fix: Account-key rollover (during Let’s Encrypt™ key changes) now updates the private and public key files as a single atomic operation, so a failure partway through can no longer leave mismatched key files on disk.
• [Pro] Fix: Fixed wildcard-domain grouping so a domain that didn’t need renewal no longer corrupts the grouping of domains checked afterward, and fixed two logic bugs that could make the plugin miss an existing (or already-issued wildcard) certificate and waste Let’s Encrypt™ rate-limit budget on an unnecessary reissue.
• Fix: Fixed several code paths that could fatal or misbehave with an unwritable log file, a non-array admin-email setting, a corrupt/unparseable SSL certificate in the SSL renewal reminder email, or an undefined array offset on the Generate SSL page on a fresh install.
• [Pro] Fix: Fixed a wide class of fatal PHP 8 errors that could occur on a fresh install, or with a stale/tampered settings URL, across the premium settings screens (Revoke SSL Certificate, Multi-Domain, Add Domain, Add DNS Service Provider), in the main cron/issuance flow when an invalid ACME protocol version was configured, and when building admin notification emails or rendering the Download SSL Certificates page from a corrupt certificate.
• [Pro] Fix: Restored a missing regular-expression match that made converting a certificate from PEM to DER format always produce corrupt output during cPanel SSL installation.
• Reliability: Fixed a dead status check in ACME challenge verification, bounded every previously-unbounded ACME polling loop (challenge verification, certificate fetch) with a maximum attempt count and a time limit so a stuck step now fails cleanly with a log entry instead of hanging indefinitely, and guarded several unchecked ACME server response reads against an unexpected response shape.
• [Pro] Fix: Removed a remaining curl_close() call path for PHP 8.5, where the function is deprecated and cURL handles are garbage-collected automatically.
• [Pro] cPanel: Since cPanel 134 (released 2026-08-24) disables password (HTTP Basic) authentication for its API by default, API Token is now the recommended and default authentication method throughout the plugin: the cPanel Settings page lists API Token before Password, pre-selects it, pre-checks SSL certificate verification for new installs, and shows/hides the relevant cPanel 134+ and TLS-verification warnings as you change your choices; an explicit “Authenticate With” (API Token / Password) choice and a “Clear the stored API token” option make switching between the two reliably take effect instead of a stale stored token silently continuing to be used; and wildcard SSL with cPanel as the DNS Service Provider no longer requires a password at all — DNS-01 TXT records are now added through cPanel’s UAPI (or the legacy ZoneEdit API on older servers), both authenticating with the API Token.
• [Pro] cPanel: When a connection fails and a password was the credential actually used, the cPanel 134+ cause is now clearly explained — with a 2FA-specific hint and guidance toward creating an API Token — at the top of the possible-causes list on the cPanel Settings page, the Exclude Domains page, the dashboard admin notice, the notification email, and the plugin log, instead of as static help text alone.
• [Pro] cPanel: cURL connection errors (including SSL/TLS certificate verification failures) are now always written to the plugin log for troubleshooting, even though the on-screen message stays generic.
• [Pro] cPanel: Added the Let’s Encrypt™ / FreeSSL.tech Terms of Service & Privacy Policy agreement text directly above the cPanel Settings submit button.
• [Pro] cPanel: Fixed DNS-01 wildcard SSL validation creating a duplicate _acme-challenge TXT record in the DNS zone on each renewal, instead of updating the existing record in place.
• [Pro] Fix: The Namecheap DNS Service Provider’s TLD list lookup could fatal error when Namecheap’s API returned an error instead of a TLD list (e.g. from an unrecognized IP address), and could then cache that failed lookup for up to 7 days; both are now fixed.
• [Pro] Fix: Saving a DNS Service Provider with an invalid field (e.g. a blank required API Identifier) appeared to succeed instead of showing the validation error; and switching GoDaddy’s authentication method from Personal Access Token back to Classic API Key no longer leaves the API Identifier field able to be submitted blank.
• Security: HTTPS redirects (Force HTTPS) now always target the site’s configured Home URL host, instead of the requested Host header. This is intentional hardening against Host-header-based redirect abuse; if you intentionally serve this site under multiple hostnames (an alias domain, a staging/preview subdomain, IP-based smoke testing), every HTTP visitor to those hosts is now redirected to the canonical Home URL host.
• Fix: Force HTTPS (activate/deactivate/revert) now detects when WP_SITEURL/WP_HOME is hard-coded in wp-config.php — previously it silently wrote a siteurl/home value to the database that WordPress ignores, while still showing a success message and sending a confirmation email. It now shows one combined notice pointing you to wp-config.php instead of a misleading success message stacked with a separate error.
• [Pro] Exclude Domains: Fixed excluding a domain no longer excluding its cPanel server aliases, which could cause SSL issuance to silently retry an alias domain the admin had explicitly excluded; and fixed the page showing a false “can’t connect to cPanel” error before any cPanel host or credentials had actually been saved.
• [Pro] cPanel: A stale cPanel connection-failure notice on the dashboard now clears as soon as the cPanel Settings form is saved again, instead of persisting indefinitely.
• [Pro] Add Domain: A document root that can’t be verified with realpath()/is_dir() (e.g. under open_basedir restrictions on shared hosting) is now saved with a warning instead of being rejected outright. A document root that does resolve via realpath() but isn’t a directory (e.g. it points at a file) is still rejected outright, since that case is never valid and is not the open_basedir “unverifiable” case above.
• Security: Fixed a bug where, if the plugin could not obtain a fresh ACME nonce after its retries were exhausted, the ACME client could still report a stale HTTP 200 left over from those unrelated nonce-fetch attempts. The account-key-rollover and certificate-revocation code paths trusted that stale status, so a transient nonce failure could make the plugin believe a key rollover or certificate revocation had succeeded — deleting the real account key or a still-valid certificate. The client now invalidates the last response status whenever a signed request is aborted before it’s actually sent.
• Reliability: Fixed a possible unbounded-recursion hang when the ACME server does not return a Replay-Nonce header (e.g. during a Let’s Encrypt™ outage); the plugin now retries a bounded number of times and then fails with a clear error.
• Reliability: Fixed a logging bug where a failed log-directory creation could silently disable all further logging for the rest of a cron run.
• Reliability: ACME HTTP requests blocked by this site’s own WP_HTTP_BLOCK_EXTERNAL setting now log an actionable message naming the ACME hosts to add to WP_ACCESSIBLE_HOSTS, and no longer hard-kill a CLI cron run on the first failed request.
• Security: A PHP build that cannot generate cryptographically secure random values now fails safely (with a clear admin notice and a technical log entry) when saving a cPanel password/API token or DNS provider credential, instead of a raw PHP fatal error or, worse, silently storing unencrypted-looking data.
• Introduced a new capability to log every single Let’s Encrypt™ server response (even those with an unexpected HTTP status code) in JSON format, wrapped inside AI-agent friendly markers to assist AI-based troubleshooting. This can be activated by setting the option ‘aifs_log_all_ca_server_response_array_json’ to true, or by accessing the following URL (login required):
  http://www.example.com/wp-admin/admin.php?page=auto_install_free_ssl&log_all_ca_server_response_array_json=yes (Please replace ‘www.example.com’ with your domain name.)
• Improved minimum system requirement checks: validate PHP, WordPress, OpenSSL, and cURL on activation and in admin; soft-fail cron/SSL actions when requirements are missing, without taking down the public site.
• Update tested compatibility to WordPress 7.1 in readme.txt
• effectiveTLDs.inc.php was updated from the latest Public Suffix List.
• Fix: Force HTTPS (activate/deactivate/revert) now detects when WP_SITEURL/WP_HOME is hard-coded in wp-config.php — previously it silently wrote a siteurl/home value to the database that WordPress ignores, while still showing a success message and sending a confirmation email. It now shows one combined notice pointing you to wp-config.php instead of a misleading success message stacked with a separate error.

4.7.0

• The plugin is now compatible with PHP 5.6 through 8.5.
• [Pro] Compatibility: Fixed a compatibility regression introduced in the previous release that prevented the plugin’s cPanel settings, cron job, and issue SSL option loading on PHP 5.6. Replaced PHP 7.0+ null coalescing syntax with PHP 5.6–safe alternatives in cPanel API error handling.
• Compatibility: Added array guards before count() calls to prevent PHP 7.2+ warnings.
• Compatibility: Replaced strlen() checks on WordPress options and nullable values with !empty() to avoid PHP 8.0+ TypeErrors and PHP 8.1+ deprecations.
• Compatibility: Added explicit property declarations in ACME, DNS API, and cPanel classes to resolve PHP 8.2 dynamic property deprecations.
• Compatibility: Removed redundant curl_close() calls to address PHP 8.5 deprecations.
• Compatibility: Aligned the runtime PHP version check with the declared minimum requirement of PHP 5.6.
• Removed the deprecated indigophp/hash-compat package and updated Composer autoloading accordingly.
• Updated usrflo/registered-domain-libs with the latest Public Suffix List TLD tree, including new TLD entries and structural improvements. Improved registered-domain validation to better support internationalized (UTF-8) domain names.
• Optimized registered-domain parsing by reusing a single regDomain instance per request.
• Updated the Freemius WordPress SDK to version 2.13.4.
• Changed: removed the hard requirement for allow_url_fopen. The plugin uses cURL for ACME and related HTTP requests; allow_url_fopen is only a fallback in legacy cPanel XML-API code when cURL is unavailable.
• Added an explicit WordPress 4.1+ runtime check (including the cron.php fallback path) to match the plugin header and documentation.
• Updated readme.txt minimum requirements to remove allow_url_fopen check.

4.6.3

• Fix: The CA bundle now always includes the root certificate. Previously, only the intermediate certificate was included in the CA bundle, which caused installation failures on hosting servers (including cPanel servers) where the root certificate was not present in the local trust store. This fix also ensures correct handling of Let’s Encrypt’s newer Generation Y chains, which can contain more than three certificates.
• [Pro] Fix: Improved cPanel API error logging to correctly handle all response types. Previously, only the first ‘errors’ was included. The logger now safely handles null, arrays, and any unexpected types, and labels each section of errors, messages, and warnings for easier diagnosis.

4.6.2

• Fixed WordPress 6.7+ translation loading notices by delaying plugin textdomain usage until the init hook.
• Delayed admin class initialization to prevent translation functions from running too early.
• [Pro] Reused the plugin environment check handler in cron.php and removed early translated requirement messages.
• Replaced direct-access translated die() messages with plain text to avoid early translation loading.
• Updated the Freemius WordPress SDK to version 2.13.1.
• Updated readme.txt

4.6.1

• Fixed one line of code that requires PHP 7.0 or later. But this plugin supports PHP 5.6
• Updated the Freemius WordPress SDK to version 2.13.0.
• Updated readme.txt

4.6.0

• Enhanced Error Logging: Enhanced error logging for domain control validation failures using HTTP-01 challenge, now including the challenge URI content for improved debugging and diagnostics.
• Optimized Server IP Detection: Optimized the aifs_ip_of_this_server() function to accurately detect the server’s IP address, ensuring reliable results even when SERVER_ADDR returns false positives.
• Improved Localhost Detection: Improved the is_localhost() function in AutoInstallFreeSSL\FreeSSLAuto\Admin\Factory to accurately determine if the website is hosted on a localhost environment.
• Improved Help Text: Updated help text of the ‘Generate SSL’ page to provide clearer guidance for WordPress installations on localhost and bare IP addresses, enhancing user experience.
• Enhanced UI Functionality: Modified the ‘Generate SSL’ page to disable the ‘Next Step’ button when WordPress is installed on a bare IP address, preventing invalid actions.
• Updated the Freemius WordPress SDK to version 2.12.1.

4.5.1

• Updated the Freemius WordPress SDK to the latest version.

4.5.0

• Updated the Freemius WordPress SDK to version 2.10.1.
• Improved some code.
• Fixed _load_textdomain_just_in_time notice.
• Fixed some minor issues.

4.4.0

• Updated the Freemius WordPress SDK to version 2.9.0.

4.3.0

• Updated the URL of the Let’s Encrypt™ Subscriber Agreement and made it dynamic.
• Updated the Freemius WordPress SDK to version 2.8.1.
• [Pro] Fixed an issue with filtering domain and aliases if the control panel is not cPanel.

4.2.0

• Updated the Freemius WordPress SDK to version 2.7.4.
• [Pro] Added a feature to group all domains by document root, useful for users with multiple aliases (i.e., ServerAlias) for domains sharing the same document root.

4.1.0

• Fixed an issue with the documentroot being passed with the domain and ServerAlias in Step 1 of generating a free SSL certificate.
• Improved error handling in Step 1 of generating a free HTTPS certificate.
• [Pro] Fixed an issue for non-cPanel websites: SSL certificate file path was not loaded correctly during the first time free ssl security certificate generation.
• Improved the function aifs_ip_of_this_server() to support IPv6.
• Added functions to detect if the WordPress website is hosted on localhost or a bare IP address. Displays information and recommendations in the WordPress dashboard, as Let’s Encrypt™ does not issue free HTTPS SSL certificates for localhost and bare IP addresses.
• Updated the Freemius WordPress SDK to version 2.7.3.

4.0.0

• Improved the Generate SSL page.
• [Pro] Improved the main page.
• [Pro] Fixed an bug with automatic SSL installation on cPanel if the plugin generates the SSL certificate for the first time.
• [Pro] Added a page to download SSL certificates if the license is for unlimited sites and multi-domain mode is activated. In any other cases, the users was already able to download the SSL certificate from the plugin’s main page.
• Updated the Freemius WordPress SDK to version 2.7.2.
• Introduced toggle switch option to enable or disable SSL renewal reminders before the expiry.
• Moved Delete plugin data on plugin deactivation option from Log page to Generate Free SSL Certificate page (main page in case of premium).
• Introduced toggle switch option to enable or disable ‘Delete plugin data on plugin deletion’ option.
• Moved Delete plugin data on deactivation logic to Freemius after uninstall action. Now plugin data will be deleted (if enabled) on plugin deletion (i.e., uninstallation) instead of deactivation.
• Added an option to download the fullchain.pem file of the free encryption certificate if the web server software is NGINX.
• Extended the option to exclude domain alias for single domain mode. However, for now, it need to be done through database entry.
• Improved the logic that checks if the domain aliases are online with CURL (in addition to fsockopen).
• Improved minimum system requirement check.
• Moved Schedule daily Cron Job Event logic to the activation hook.

3.6.10

• Updated the Freemius WordPress SDK to version 2.6.2.
• [Pro] Fixed an issue with displaying a log message.

3.6.9

• Updated the Freemius WordPress SDK to version 2.6.1.
• [Pro] Added an existing video documentation in the cPanel settings page.

3.6.8

• Introduced an email field in the first step of the free https certificate generation process to gather the admin email ID. This update ensures a valid email ID is provided for Let’s Encrypt account registration. In previous versions, the WordPress Administration Email Address was used for this purpose. However, certain hosting providers’ systems set an incorrect email as the WordPress Administration Email Address, leading to bounced emails for renewal reminders.

3.6.7

• Updated the Freemius WordPress SDK to version 2.6.0.

3.6.6

• Substituted the deprecated function get_currentuserinfo() with wp_get_current_user().
• Enhanced some instructions for manual SSL generation.
• [Pro] Enhanced the logging code for cases where the ‘.well-known/acme-challenge’ directory is not writable.

3.6.5

• In version 3.6.3, we introduced A record verification for all domain aliases against the server’s IP address to cater to specific use cases. However, this caused issues for some websites to generate free ssl cert, especially those using CDNs. In this update, we’ve adjusted our approach: by default, only the ‘mail.’ alias A record is verified, as was the case in version 3.6.2 and earlier. However, the user can enable A record verification for all domain aliases if needed by setting ‘aifs_verify_ip_for_all_domain_alias’ to true.

3.6.4

• Improved the detection process (and fixed a related bug) of the server’s IPv4 address where the WordPress website is hosted.
• Updated the Freemius WordPress SDK to version 2.5.12.

3.6.3

• Resolved a loading issue with the theme editor in the WordPress 6.3 dashboard when Force HTTPS is activated.
• Enhanced IP address verification logic for all available domain aliases, as opposed to solely the ‘mail.’ alias in previous versions. Now, it filters out the domain alias (when generating the free TLS certificate) if its A record differs from the server’s IP address. Note that if the option ‘aifs_verify_ip_for_mail_dot_domain_alias_only’ is set to true, it will verify the IP address of the ‘mail.’ alias exclusively. However, if the option ‘aifs_selected_verification_method_dns01’ is set to true (making DNS-01 the default method), the above verification will not occur.
• Updated the Freemius WordPress SDK to version 2.5.11.

3.6.2

• Enhanced error handling logic for cases where after submitting a request to the ‘finalize’ URL, the response from Let’s Encrypt contains an empty ‘certificate’ key (location value).
• Resolved an issue where the ‘finalize’ response in the cert free generation process was unintentionally removed from the database.
• Introduced a new capability to activate the option ‘aifs_log_all_ca_server_response’ by accessing the following URL (login required):
  http://www.example.com/wp-admin/admin.php?page=auto_install_free_ssl&log_all_ca_server_response=yes (Please replace ‘www.example.com’ with your domain name.)

3.6.1

• Fixed the issue with character encoding for sending automated email notifications to support multilingual characters.
• Added feature to write Let’s Encrypt free https cert server response details in the log files for every API call (if the option ‘aifs_log_all_ca_server_response’ is set to true). This will be helpful for troubleshooting.
• Removed WordPress translation function __() for some error and exception messages (which are intended for developers) to make those English only.
• Tested up to: 6.3

3.6.0

• Improved the domainsArray() function that filters domain and server alias.
• Created a new function to detect the IPv4 of the server.
• Created a new function to get the confirmed and domain-specific free https ssl certificate directory.
• Improved the function that detects the cPanel host and fixed a premium version-specific issue with it.
• Updated the Freemius WordPress SDK to 2.5.10
• Automatic entry of some initial data has been moved to the activation hook.
• [Pro] Improved the function sslRequiredForFirstTime() called before generating a free web ssl certificate.
• [Pro] Created a new function to detect if the given domains array has at least one Wildcard domain.
• [Pro] Improved some free tls cert generation and installation logic.
• [Pro] Added a feature that detects if the cPanel hostname was changed and updates it automatically.
• [Pro] Added a feature that detects if cPanel credentials were changed and send notifications by email and admin notice.
• [Pro] Improved the functionality to send notifications by email and admin notice if the encryption key was changed.

Please click the following URL for the previous changelog:
https://freessl.tech/aifs_changelog.txt