Flex SSL
Force HTTPS, update site URLs, and add security headers. Supports reverse proxies, certificate checks, and lock-out recovery.
Solid choice
Flex SSL is a solid plugin choice in 2026, with a few things worth checking first. It runs on 50+ sites and was last updated 1 week ago, and scores 68/100 on our health check.
- Actively developed — last update 1 week ago
- Tested with the latest WordPress (7.1)
- Small user base (50+ active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Flex SSL stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| certificate | >100 |
| cloudflare | >100 |
| https | >100 |
| security | >100 |
| ssl | #34 |
Version adoption
Share of active sites per release.
About Flex SSL
From the official readme · v1.2.1Description
Flex SSL is a lightweight WordPress plugin designed to secure your website by enforcing HTTPS across your entire site. Key features include:
- Force HTTPS: Automatically redirect all HTTP requests to HTTPS. Encoded and non-ASCII permalinks are preserved. Alias hosts fall back to the WordPress home URL.
- Auto-Update URLs: Change WordPress site and home URLs from HTTP to HTTPS, with a stored backup you can revert.
- Cloudflare/Proxy Support: Detects HTTPS headers from Cloudflare, Azure, CloudFront, and other reverse proxies to avoid redirect loops.
- Security Headers: Optionally add HSTS (includeSubDomains is optional), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
- Mixed Content Fixer: Rewrites this site’s HTTP URLs to HTTPS in content, excerpts, attachments, srcset, scripts, and styles. External links are left unchanged. Tools can scan the front page for leftovers.
- SSL Status: View certificate expiry, issuer, subject names, trust, and hostname match. Optional admin notices and email before expiry.
- Redirect Options: Choose between 301 (permanent) and 302 (temporary) for GET. Non-GET requests use 307.
- Logs, Tools, and Site Health: Monitor changes, test HTTPS, and see Flex SSL tests in Tools → Site Health.
- Recovery:
FLEX_SSL_DISABLEin wp-config.php, Tools → Revert URLs, andwp flex-ssl disable/wp flex-ssl revert-urls.
On Multisite, settings and URL updates are per site.
License
Flex SSL is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
For more details, see https://www.gnu.org/licenses/gpl-2.0.html.
Installation
- Upload the
flex-sslfolder to your/wp-content/plugins/directory or install via the WordPress plugin installer. - Activate the plugin through the WordPress admin.
- Navigate to Flex SSL → Settings from the admin menu.
- Confirm the site loads over HTTPS (host panel, Cloudflare Full, or similar).
- Turn on Enable SSL, then Force HTTPS and Update Site URL. Use the proxy override if HTTPS is terminated in front of WordPress.
Frequently asked questions
Does Flex SSL work behind Cloudflare?
Yes. Flex SSL supports reverse proxy configurations including Cloudflare’s Flexible and Full SSL modes by detecting proxy headers. For Flexible SSL, enable “HTTPS is terminated at a proxy” before turning on Force HTTPS.
Do I need to modify wp-config.php?
No. Flex SSL works without wp-config.php changes. If you get locked out, add define( 'FLEX_SSL_DISABLE', true ); to stop all Flex SSL runtime hooks.
How do I generate an SSL certificate?
Flex SSL does not issue certificates. Use your host panel, Cloudflare, or Let’s Encrypt on the server, then use this plugin to enforce HTTPS and watch expiry.
What happens if SSL is not installed on my server?
The plugin checks for a certificate and shows a warning. You can still enable features if HTTPS is terminated at a proxy. Force HTTPS to this origin needs a working certificate.
I cannot reach wp-admin after enabling Force HTTPS.
Add define( 'FLEX_SSL_DISABLE', true ); to wp-config.php, or run wp flex-ssl disable and wp flex-ssl revert-urls. Fix HTTPS, then remove the constant.
Changelog
About FLEX now lists every plugin in the FLEX suite.
1.2.1
- About FLEX lists the full suite, including Flex Clone and FLEX SMM & SEO.
1.2.0
- Preserve percent-encoded and non-ASCII URLs on HTTPS redirects.
- Redirect alias hosts to the WordPress home URL instead of wp-admin.
- Use 307 for POST and other non-GET requests; add X-Redirect-By: Flex SSL.
- Detect more reverse-proxy HTTPS headers (Azure, CloudFront, X-Forwarded-SSL).
- Pause Force HTTPS for a visitor after a detected redirect loop.
- HTTPS probe before enabling Force HTTPS or Update Site URL, with a proxy override.
- Remember previous site URLs and restore them from Tools or WP-CLI.
- Kill switch: define( ‘FLEX_SSL_DISABLE’, true ); in wp-config.php.
- Optional HSTS includeSubDomains (existing HSTS users keep it on).
- Align Referrer-Policy with Flex Website Security.
- Certificate issuer, SANs, trust, hostname match, daily expiry notices, and optional email.
- Tools screen: HTTPS test, certificate re-check, mixed content scan, revert URLs.
- Site Health tests and WP-CLI: wp flex-ssl disable|enable|revert-urls|status|probe.
- Removed the Let’s Encrypt “coming soon” promise. Multisite is per site.
1.1.2
- Tested up to WordPress 7.1.
- About FLEX uses current suite names, including Flex SEO and SMM, Flex Website Security, and Flex Maintenance.
1.1.1
- List flexfields and hovoqoch as contributors.
- About FLEX links the full suite, including Flex Shortcodes.
1.1.0
- Admin UI aligned with Flex Redirects: header, pill navigation, stats, and cards.
- Settings, Logs, and Usage are now separate screens.
- Enable SSL is now a master switch for all other features.
- Force HTTPS runs early so wp-admin and wp-login.php are redirected, not only the front end.
- Force SSL Admin uses force_ssl_admin() (the FORCE_SSL_ADMIN constant is already defined before plugins load).
- HSTS is sent only over HTTPS, without preload.
- Mixed content fixer rewrites same-host URLs only, including attachments and srcset.
- Certificate-not-found is a warning, not a lock on the settings.
- Logs record setting changes and rate-limited HTTPS redirects.
- Tested up to WordPress 7.0. Plugin Check cleanup (hidden files, prefixes, sanitization).
1.0.12
- Updated plugin author to FLEX (https://flexible.am/).
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Flex SSL alternatives
All certificate plugins →
FAQ
Flex SSL: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Sep 26, 2026
Is Flex SSL free?
Yes. Flex SSL is free to download and use from the official WordPress.org plugin directory.
Is Flex SSL safe to use in 2026?
Flex SSL is a solid plugin choice in 2026, with a few things worth checking first. It runs on 50+ sites and was last updated 1 week ago, and scores 68/100 on our health check.
How many websites use Flex SSL?
Flex SSL is active on 50+ WordPress websites and has been downloaded 1,512 times since it launched in April 2025. It was downloaded 309 times in the last 30 days.
Does Flex SSL work with WordPress 7.1?
Yes. The developer has tested Flex SSL up to WordPress 7.1.2, the latest release. It requires WordPress 5.1 or newer.
What PHP version does Flex SSL need?
Flex SSL requires PHP 7.0 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Flex SSL last updated?
The latest version, 1.2.1, was released on September 16, 2026 (1 week ago).
Who makes Flex SSL?
Flex SSL is developed and maintained by Flex Plugins.
What are the best alternatives to Flex SSL?
The most popular alternatives to Flex SSL are Certificate customizer for… (1K+ installs), Certificate Verification (1K+ installs) and ValidateCertify Free (900+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
