Switching a WordPress site from HTTP to HTTPS has historically been a tedious task. While on the surface the Site Address and WordPress Address have to be updated, existing content still remains using HTTP URLs where hard-coded in the database. Furthermore, updating _two_ URLs to migrate to HTTPS is still a fairly unintuitive step which is not clearly explained.
This changeset simplifies migration from HTTP to HTTPS and, where possible, makes it a one-click interaction.
* Automatically replace insecure versions of the Site Address (`home_url()`) with its HTTPS counterpart on the fly if the site has been migrated from HTTP to HTTPS. This is accomplished by introducing a `https_migration_required` option and enabling it when the `home_url()` is accordingly changed.
* A new `wp_replace_insecure_home_url()` function is hooked into various pieces of content to replace URLs accordingly.
* The migration only kicks in when the Site Address (`home_url()`) and WordPress Address (`site_url()`) match, which is the widely common case. Configurations where these differ are often maintained by more advanced users, where this migration routine would be less essential - something to potentially iterate on in the future though.
* The migration does not actually update content in the database. More savvy users that prefer to do that can prevent the migration logic from running by either deleting the `https_migration_required` option or using the new `wp_should_replace_insecure_home_url` filter.
* For fresh sites that do not have any content yet at the point of changing the URLs to HTTPS, the migration will also be skipped since it would not be relevant.
* Expose a primary action in the Site Health recommendation, if HTTPS is already supported by the environment, built on top of the HTTPS detection mechanism from [49904]. When clicked, the default behavior is to update `home_url()` and `site_url()` in one go to their HTTPS counterpart.
* A new `wp_update_urls_to_https()` function takes care of the update routine.
* A new `update_https` meta capability is introduced to control access.
* If the site's URLs are controlled by constants, this update is not automatically possible, so in these scenarios the user is informed about that in the HTTPS status check in Site Health.
* Allow hosting providers to modify the URLs linked to in the HTTPS status check in Site Health, similar to how that is possible for the URLs around updating the PHP version.
* A `WP_UPDATE_HTTPS_URL` environment variable or `wp_update_https_url` filter can be used to provide a custom URL with guidance about updating the site to use HTTPS.
* A `WP_DIRECT_UPDATE_HTTPS_URL` environment variable or `wp_direct_update_https_url` filter can be used to provide a custom URL for the primary CTA to update the site to use HTTPS.
Props flixos90, timothyblynjacobs.
Fixes#51437.
Built from https://develop.svn.wordpress.org/trunk@50131
git-svn-id: http://core.svn.wordpress.org/trunk@49810 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This will discard any invalid responses instead of causing fatal errors.
It also makes badges optional, on the same basis as actions are optional. They are expected, but there may be situations where they are not present.
Props Clorith, dogwithblog, kraftbj, whyisjake, SergeyBiryukov.
Fixes#50145.
Built from https://develop.svn.wordpress.org/trunk@49537
git-svn-id: http://core.svn.wordpress.org/trunk@49275 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Most of the tests pass content that is already wrapped in a paragraph or list tags, thus producing nested paragraphs or invalid markup.
Additionally, don't output an empty `<div>` tag if the test does not provide any actions.
Props maxpertici, afercia.
Fixes#48948.
Built from https://develop.svn.wordpress.org/trunk@47529
git-svn-id: http://core.svn.wordpress.org/trunk@47304 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This avoids the performance overhead of the function call every time `dirname( __FILE__ )` was used instead of `__DIR__`.
This commit also includes:
* Removing unnecessary parentheses from `include`/`require` statements. These are language constructs, not function calls.
* Replacing `include` statements for several files with `require_once`, for consistency:
* `wp-admin/admin-header.php`
* `wp-admin/admin-footer.php`
* `wp-includes/version.php`
Props ayeshrajans, desrosj, valentinbora, jrf, joostdevalk, netweb.
Fixes#48082.
Built from https://develop.svn.wordpress.org/trunk@47198
git-svn-id: http://core.svn.wordpress.org/trunk@46998 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Introduces the faux primitive capability `view_site_health_checks` available to single site admins and multisite super-admin to view the site health page within the admin.
The capability is mapped to the `install_plugins` capability without being dependent on the file system being writable. This fixes a bug where the feature couldn't be used by sites unable to write to the file system or managed through version control.
The capability is granted on the `user_has_cap` filter.
Props birgire, Clorith, palmiak, peterwilsoncc, spacedmonkey.
Fixes#46957.
Built from https://develop.svn.wordpress.org/trunk@45507
git-svn-id: http://core.svn.wordpress.org/trunk@45318 1a063a9b-81f0-0310-95a4-ce76da25c4cd
* Split plural strings with multiple sentences to avoid duplicating translations.
* Decouple strings where the singular and plural form are not just the same string with different numbers, but essentially two different strings.
* Use an established pattern for numbered placeholders in translator comments.
* Replace constants in translatable strings with placeholders, mark them as code.
* Make sure sentences are translated as a whole, not as separate string parts.
* Remove unnecessary context and escaping.
Props ocean90, SergeyBiryukov.
See #46683.
Built from https://develop.svn.wordpress.org/trunk@45099
git-svn-id: http://core.svn.wordpress.org/trunk@44908 1a063a9b-81f0-0310-95a4-ce76da25c4cd
- displays an error notice when JavaScript is off, consistently with other admin screens that depend on JavaScript
- keeps the main `h1` visible
Minor clean-ups:
- makes code indentation consistent in `site-health.php` and `site-health-info.php`
- removes a couple of `<div class="wp-clearfix"></div>` as that's not the intended usage of `wp-clearfix` (those divs didn't do anything anyways)
Fixes#46717.
Built from https://develop.svn.wordpress.org/trunk@45076
git-svn-id: http://core.svn.wordpress.org/trunk@44885 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The document `<title>` gives a name to a web document. In the context of the WordPress admin, a unique, meaningful, title is important for various reasons:
- it allows browser's history to store meaningful entries
- when multiple browser's tabs are open, it allows users to better identify the tab content
- it's the first thing screen readers announce when navigating to a web page, thus helping users to identify the nature of the page content
Props chetan200891, mukesh27.
Fixes#46699.
Built from https://develop.svn.wordpress.org/trunk@45070
git-svn-id: http://core.svn.wordpress.org/trunk@44879 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The Site Health score indicator isn't exactly a "progress bar" and shouldn't use ARIA roles and properties related to progress bars. Also, some browser / screen reader combinations don't announce the score properly.
- removes any ARIA
- adds a screen-reader-text "Current health score:"
- adds `role="img" aria-hidden="true" focusable="false"` to the SVG
- reduces CSS specificity simplifying unnecessary overqualified selectors
- fixes the syntax for ::after and ::before (double colon)
Fixes#46621.
Built from https://develop.svn.wordpress.org/trunk@45041
git-svn-id: http://core.svn.wordpress.org/trunk@44850 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The Site Health tool serves two purposes:
- Provide site owners with information to improve the performance, reliability, and security of their site.
- Collect comprehensive debug information about the site.
By encouraging site owners to maintain their site and adhere to modern best practices, we ultimately improve the software hygeine of both the WordPress ecosystem, and the open internet as a whole.
Props Clorith, hedgefield, melchoyce, xkon, karmatosed, jordesign, earnjam, ianbelanger, wpscholar, desrosj, pedromendonca, peterbooker, jcastaneda, garyj, soean, pento, timothyblynjacobs, zodiac1978, dgroddick, garrett-eclipse, netweb, tobifjellner, pixolin, afercia, joedolson, birgire.
See #46573.
Built from https://develop.svn.wordpress.org/trunk@44986
git-svn-id: http://core.svn.wordpress.org/trunk@44817 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Felix Arntz
Sergey Biryukov
desrosj
Peter Wilson
Andrea Fercia
Gary Pendergast