WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security

83 Quality Score

Active Installs

21/30

At roughly 50,000 active installs, it is a solidly mid-tier plugin, far behind category leaders like Really Simple Security at three million installs.

Update Freshness

25/25

A perfect score here is backed by a recent update within the last release cycle and clearly maintained changelogs.

User Rating

15/15

A 98 out of 100 from 1,139 reviewers is exceptional and indicates very few negative experiences among actual users.

Support Health

8/15

Only three resolved support threads total makes the 100 percent resolution rate statistically thin, so support responsiveness is hard to verify at scale.

WP Compatibility

15/15

Full marks for being tested up to WordPress 7.0.1 and supporting PHP 7.0, which covers a very wide range of modern hosting setups.

Scores higher than 91% of indexed plugins

About

Lifetime SSL solution - Free SSL certificate & HTTPS redirect, fix insecure site / SSL errors, Security headers, Login Security & Passkey.

Active Installs 50k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-10 1:59pm GMT

Requires WordPress 5.4+

Tested Up To 7.1

Requires PHP 7.0+

Security History

5 known vulnerabilities, all patched

1 High 4 Medium

Most recent: July 22, 2026

View details ▸

WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter Medium

July 22, 2026 Patched in ["7.8.6.7"] CVE-2026-15786

WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering Medium

May 13, 2026 Patched in ["7.8.5.11"] CVE-2026-3829

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Medium

April 30, 2026 Patched in ["7.7.3"] CVE-2024-13362

WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected files High

April 9, 2024 Patched in ["7.1.0"] CVE-2023-7046

Freemius SDK <= 2.4.2 - Missing Authorization Checks Medium

March 4, 2022 Patched in ["5.7.10"] CVE-2022-4974

What It Does

WP Encryption installs a free Let's Encrypt SSL certificate with a single click, then forces all site traffic over HTTPS through automatic redirect rules. It also scans for mixed-content errors, adds security headers, and includes login hardening features such as passkey and two-factor support.

Who It's For

This plugin is best suited for small to mid-sized WordPress site owners on shared or VPS hosting who want a hands-off way to obtain and renew Let's Encrypt certificates without editing server configs. It is also useful for administrators who need to quickly diagnose and fix mixed-content warnings after migrating to HTTPS.

Who Should Skip It

Sites hosted on managed WordPress platforms that already provision and renew SSL certificates automatically (such as WP Engine, Kinsta, or SiteGround's own tools) do not need this plugin. Enterprise or compliance-heavy environments that require EV certificates, wildcard SANs, or paid certificate authority support should look at commercial alternatives.

The Bottom Line

WP Encryption delivers an impressive combination of feature breadth, recent maintenance, and near-perfect user ratings, and the 83.24 overall score is held back mainly by relatively modest install numbers and a thin support thread sample. For a typical small-business or blogger site on standard hosting, this is a strong, lower-overhead alternative to the more popular Really Simple Security.

Related Plugins

Really Simple Security 99/100

Pick this instead if you run a high-traffic or multisite install and want the most battle-tested free SSL helper with the largest community in the category.

Hostinger Tools 87/100

Pick this instead if your site is hosted on Hostinger, since it bakes SSL provisioning and redirects directly into the hosting control panel and avoids a third-party plugin.

SSL Insecure Content Fixer 84/100

Pick this instead if your host already issues certificates and you only need help catching stubborn mixed-content scripts, styles, and iframes after switching to HTTPS.

WP Force SSL & HTTPS Redirect 84/100

Pick this instead if you want a lighter plugin focused solely on forcing HTTPS redirects and headers without the certificate automation layer.

Flexible SSL for CloudFlare 83/100

Pick this instead if your site sits behind Cloudflare's Flexible SSL mode and you need to fix redirect loops caused by that configuration.