Bluearctic HTTPS Fixer

Bluearctic HTTPS Fixer does three things:

1. HTTPS Redirect Writes a single, clean 301 redirect rule to your .htaccess file using WordPress’s own insert_with_markers() function — the same method WordPress uses for its own permalink rules. It is non-destructive, clearly marked, and trivially removable. Full support for sites behind Cloudflare, CDNs, and load balancers (X-Forwarded-Proto).

2. Mixed Content Fixer (on by default, requires WordPress 6.9+) Rewrites http:// to https:// in your front-end page output before it reaches the browser. This is completely non-destructive — nothing in your database is touched. It works the instant you activate the plugin on an HTTPS site, with zero configuration required. On a site still served over plain HTTP it stays dormant, so activating the plugin before your certificate is ready is completely safe. Only your own domain’s URLs are rewritten; external URLs are never touched.

The rewrite runs on the template enhancement output buffer that WordPress manages itself, added in WordPress 6.9. The plugin never opens an output buffer of its own. On WordPress 6.8 and earlier this feature stays switched off and the Database Scanner below is the way to clear http:// URLs — it is the permanent fix in any case.

3. Database Scanner Scans your database for http:// URLs belonging to your site and lets you replace them with https:// in a controlled, step-by-step process. Every table is scanned read-only first — nothing is changed until you review the results and click Fix. Correctly handles serialized data used by Elementor, Divi, WooCommerce, and other page builders so byte-length annotations stay accurate. Covers posts, post meta, options, comments, term meta, and user meta.

What Bluearctic HTTPS Fixer does not do: – No firewall – No vulnerability scanner – No login protection or 2FA – No upsells or upgrade prompts – No external API calls or phone-home – No automatic database changes

Cloudflare / CDN / Load Balancer support

Enable “CDN / Proxy Mode” in the HTTPS Redirect tab. This adds an X-Forwarded-Proto check to the redirect rule, which prevents infinite redirect loops when SSL is terminated at the proxy level rather than your own server.

The mixed content fixer is on by default — is that safe?

Yes. It rewrites your own domain’s http:// URLs in the HTML before it is sent to the browser, using the output buffer WordPress 6.9 opens and closes around your template. Nothing is written to the database or the filesystem. It only runs once your site is actually serving HTTPS — on a plain-HTTP site it stays dormant, so it can never break a site that has no certificate yet. Deactivate the plugin and it is as if it was never there.

Why does the fixer need WordPress 6.9?

WordPress 6.9 introduced a template output buffer that plugins can filter, so a plugin no longer has to open a PHP output buffer of its own to modify a page. Bluearctic HTTPS Fixer uses only that buffer. That keeps the plugin out of the shared output buffer stack entirely, which is the safest way to do this and avoids conflicts with caching and optimisation plugins. On older WordPress the fixer is simply unavailable — everything else in the plugin works normally.

What about database URLs still set to http://?

On WordPress 6.9+ the fixer handles these transparently at runtime. For a permanent fix on any version, use the Database Scanner tab — it scans every table, shows you exactly what will change with a full preview, and lets you apply the fix in one click. Serialized data (Elementor, WooCommerce, Divi) is handled correctly. Nothing is changed until you review and confirm.