Yes. The plugin follows WordPress.org requirements, including proper nonce usage, sanitization and escaping, user-initiated actions only, no silent database modifications, and no external tracking or monetization.
No. Elliot SSL Enforcer does not track usage, does not send telemetry, does not contact external servers, and does not include ads, upsells, or licensing systems.
When deactivated, no redirects are enforced and no scans or fixes run. When uninstalled, content changes remain because they are permanent improvements. Any server-level rules added by the plugin should be reviewed or removed manually if used.
It depends. Redirect enforcement requires the plugin to remain active if you rely on it. Internal link fixes are permanent, so the plugin is not required to remain active after links are corrected.
You may see a summary showing zero rows scanned or changed. This usually means your content is already secure, which is expected and desirable.
Yes. Internal links pointing to your site’s subdomains (for example, docs.yoursite.com) are included when fixing links.
No. Only links that belong to your site, including subdomains, are eligible for fixing. External third-party URLs are ignored.
Yes. The plugin detects common proxy headers and works with Cloudflare and similar CDNs. For best results, Cloudflare should be set to Full (Strict) SSL mode.
Only one redirect enforcement method should be active. If your host or CDN already forces HTTPS correctly, you may not need the redirect feature. You can still use the diagnostics and internal link fixer independently.
The plugin is designed to prevent common redirect loops by respecting proxy headers and avoiding duplicate enforcement. Redirect loops can still occur if HTTPS is forced in multiple places at once, such as your host panel, CDN, manual .htaccess rules, and the plugin simultaneously.