Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Auto-Install Free SSL · Version history

Auto-Install Free SSL changelog and version history

Latest version
5.0.1
Oct 18, 2026 (22 days ago)
Releases
62
since 2022
In the last year
6
about one every 60 days
Tested up to
WordPress 7.1.4
PHP 5.6 or later

Releases each year

  • 202227 releases
  • 202320 releases
  • 20246 releases
  • 20254 releases
  • 20265 releases

20265 releases

  1. Auto-Install Free SSL 5.0.1Latest

    • Updated the Freemius WordPress SDK to the latest version
    • effectiveTLDs.inc.php was updated from the latest Public Suffix List.
    • [Pro] Fix: Decrypting a malformed, truncated, or non-encrypted stored credential (cPanel or DNS Service Provider) no longer causes a fatal TypeError on PHP below 8.0; it now fails safely.

  2. Auto-Install Free SSL 5.0.0

    • [Pro] Feature: GoDaddy DNS Service Provider entries can now use either a classic API Key/Secret pair or a newer Personal Access Token (PAT) for wildcard SSL DNS-01 validation; GoDaddy TXT records are updated in place on renewal instead of being deleted and recreated.
    • [Pro] Fix: Wildcard SSL certificate issuance using the DNS-01 challenge (any DNS Service Provider, including cPanel) was completely broken — every wildcard request sent an empty challenge response to Let’s Encrypt™ and was rejected. This is now fixed.
    • [Pro] Security: Following a full-codebase security review, closed several cPanel credential-exposure issues: cPanel API debug logging (which could log raw API responses/headers) is now off by default, cPanel credentials were briefly written back into the WordPress options table on every admin page…
    • Security: The certificate-file download page, the manual HTTP-01 challenge-file handler, and the Log page’s date parameter now require administrator (manage_options) capability and strictly validate their inputs, closing a path-traversal opening that could allow reading or writing files outside the…
    • Security: Added a missing nonce/capability check to the Force HTTPS override link, and switched the Force HTTPS “revert” link (sent by email) to a timing-safe comparison for its one-time secret.
    • [Pro] Security: Added missing nonce/capability checks (CSRF protection) to the Domains and DNS Service Provider “Delete” links and to the Add Cron Job form.
    • Security: Hardened output escaping on the Log page, admin notices, and the Generate SSL page’s admin-email field, closing a couple of admin-only XSS opportunities.
    • [Pro] Security: Hardened output escaping on the live log stream, the Download SSL Certificates page, and the Domains / DNS Service Provider / Revoke SSL Certificate settings screens, closing a handful of admin-only XSS opportunities.
    • [Pro] Security: DNS record values sent to the Namecheap API are now properly URL-encoded, so a value containing “&” or “=” can no longer corrupt the request or drop unrelated DNS records; fixed Cloudflare DNS-01 TXT-record creation failing (or erroring) for subdomains and on API authentication erro…
    • [Pro] Security: Added an optional shared-secret and a run lock for cron.php when triggered over HTTP (configurable from the Add Cron Job page), and a warning on the cPanel Settings page when TLS certificate verification is left disabled while a verified connection to the same host is confirmed to w…
    • [Pro] Reliability: Added connection/response timeouts to all cPanel API calls so an unresponsive cPanel host can no longer hang a cron run or admin request.
    • [Pro] Fix: Account-key rollover (during Let’s Encrypt™ key changes) now updates the private and public key files as a single atomic operation, so a failure partway through can no longer leave mismatched key files on disk.
    • [Pro] Fix: Fixed wildcard-domain grouping so a domain that didn’t need renewal no longer corrupts the grouping of domains checked afterward, and fixed two logic bugs that could make the plugin miss an existing (or already-issued wildcard) certificate and waste Let’s Encrypt™ rate-limit budget on an…
    • Fix: Fixed several code paths that could fatal or misbehave with an unwritable log file, a non-array admin-email setting, a corrupt/unparseable SSL certificate in the SSL renewal reminder email, or an undefined array offset on the Generate SSL page on a fresh install.
    • [Pro] Fix: Fixed a wide class of fatal PHP 8 errors that could occur on a fresh install, or with a stale/tampered settings URL, across the premium settings screens (Revoke SSL Certificate, Multi-Domain, Add Domain, Add DNS Service Provider), in the main cron/issuance flow when an invalid ACME proto…
    • [Pro] Fix: Restored a missing regular-expression match that made converting a certificate from PEM to DER format always produce corrupt output during cPanel SSL installation.
    • Reliability: Fixed a dead status check in ACME challenge verification, bounded every previously-unbounded ACME polling loop (challenge verification, certificate fetch) with a maximum attempt count and a time limit so a stuck step now fails cleanly with a log entry instead of hanging indefinitely, a…
    • [Pro] Fix: Removed a remaining curl_close() call path for PHP 8.5, where the function is deprecated and cURL handles are garbage-collected automatically.
    • [Pro] cPanel: Since cPanel 134 (released 2026-08-24) disables password (HTTP Basic) authentication for its API by default, API Token is now the recommended and default authentication method throughout the plugin: the cPanel Settings page lists API Token before Password, pre-selects it, pre-checks S…
    • [Pro] cPanel: When a connection fails and a password was the credential actually used, the cPanel 134+ cause is now clearly explained — with a 2FA-specific hint and guidance toward creating an API Token — at the top of the possible-causes list on the cPanel Settings page, the Exclude Domains page,…
    • [Pro] cPanel: cURL connection errors (including SSL/TLS certificate verification failures) are now always written to the plugin log for troubleshooting, even though the on-screen message stays generic.
    • [Pro] cPanel: Added the Let’s Encrypt™ / FreeSSL.tech Terms of Service & Privacy Policy agreement text directly above the cPanel Settings submit button.
    • [Pro] cPanel: Fixed DNS-01 wildcard SSL validation creating a duplicate _acme-challenge TXT record in the DNS zone on each renewal, instead of updating the existing record in place.
    • [Pro] Fix: The Namecheap DNS Service Provider’s TLD list lookup could fatal error when Namecheap’s API returned an error instead of a TLD list (e.g. from an unrecognized IP address), and could then cache that failed lookup for up to 7 days; both are now fixed.
    • [Pro] Fix: Saving a DNS Service Provider with an invalid field (e.g. a blank required API Identifier) appeared to succeed instead of showing the validation error; and switching GoDaddy’s authentication method from Personal Access Token back to Classic API Key no longer leaves the API Identifier fie…
    • Security: HTTPS redirects (Force HTTPS) now always target the site’s configured Home URL host, instead of the requested Host header. This is intentional hardening against Host-header-based redirect abuse; if you intentionally serve this site under multiple hostnames (an alias domain, a staging/prev…
    • Fix: Force HTTPS (activate/deactivate/revert) now detects when WP_SITEURL/WP_HOME is hard-coded in wp-config.php — previously it silently wrote a siteurl/home value to the database that WordPress ignores, while still showing a success message and sending a confirmation email. It now shows one combi…
    • [Pro] Exclude Domains: Fixed excluding a domain no longer excluding its cPanel server aliases, which could cause SSL issuance to silently retry an alias domain the admin had explicitly excluded; and fixed the page showing a false “can’t connect to cPanel” error before any cPanel host or credentials…
    • [Pro] cPanel: A stale cPanel connection-failure notice on the dashboard now clears as soon as the cPanel Settings form is saved again, instead of persisting indefinitely.
    • [Pro] Add Domain: A document root that can’t be verified with realpath()/is_dir() (e.g. under open_basedir restrictions on shared hosting) is now saved with a warning instead of being rejected outright. A document root that does resolve via realpath() but isn’t a directory (e.g. it points at a file…

  3. Auto-Install Free SSL 4.7.0

    • The plugin is now compatible with PHP 5.6 through 8.5.
    • [Pro] Compatibility: Fixed a compatibility regression introduced in the previous release that prevented the plugin’s cPanel settings, cron job, and issue SSL option loading on PHP 5.6. Replaced PHP 7.0+ null coalescing syntax with PHP 5.6–safe alternatives in cPanel API error handling.
    • Compatibility: Added array guards before count() calls to prevent PHP 7.2+ warnings.
    • Compatibility: Replaced strlen() checks on WordPress options and nullable values with !empty() to avoid PHP 8.0+ TypeErrors and PHP 8.1+ deprecations.
    • Compatibility: Added explicit property declarations in ACME, DNS API, and cPanel classes to resolve PHP 8.2 dynamic property deprecations.
    • Compatibility: Removed redundant curl_close() calls to address PHP 8.5 deprecations.
    • Compatibility: Aligned the runtime PHP version check with the declared minimum requirement of PHP 5.6.
    • Removed the deprecated indigophp/hash-compat package and updated Composer autoloading accordingly.
    • Updated usrflo/registered-domain-libs with the latest Public Suffix List TLD tree, including new TLD entries and structural improvements. Improved registered-domain validation to better support internationalized (UTF-8) domain names.
    • Optimized registered-domain parsing by reusing a single regDomain instance per request.
    • Updated the Freemius WordPress SDK to version 2.13.4.
    • Changed: removed the hard requirement for allow_url_fopen. The plugin uses cURL for ACME and related HTTP requests; allow_url_fopen is only a fallback in legacy cPanel XML-API code when cURL is unavailable.
    • Added an explicit WordPress 4.1+ runtime check (including the cron.php fallback path) to match the plugin header and documentation.
    • Updated readme.txt minimum requirements to remove allow_url_fopen check.

  4. Auto-Install Free SSL 4.6.3

    • Fix: The CA bundle now always includes the root certificate. Previously, only the intermediate certificate was included in the CA bundle, which caused installation failures on hosting servers (including cPanel servers) where the root certificate was not present in the local trust store. This fix al…
    • [Pro] Fix: Improved cPanel API error logging to correctly handle all response types. Previously, only the first ‘errors’ was included. The logger now safely handles null, arrays, and any unexpected types, and labels each section of errors, messages, and warnings for easier diagnosis.

  5. Auto-Install Free SSL 4.6.2

    • Fixed WordPress 6.7+ translation loading notices by delaying plugin textdomain usage until the init hook.
    • Delayed admin class initialization to prevent translation functions from running too early.
    • [Pro] Reused the plugin environment check handler in cron.php and removed early translated requirement messages.
    • Replaced direct-access translated die() messages with plain text to avoid early translation loading.
    • Updated the Freemius WordPress SDK to version 2.13.1.
    • Updated readme.txt

20254 releases

  1. Auto-Install Free SSL 4.6.1

    • Fixed one line of code that requires PHP 7.0 or later. But this plugin supports PHP 5.6
    • Updated the Freemius WordPress SDK to version 2.13.0.
    • Updated readme.txt

  2. Auto-Install Free SSL 4.6.0

    • Enhanced Error Logging: Enhanced error logging for domain control validation failures using HTTP-01 challenge, now including the challenge URI content for improved debugging and diagnostics.
    • Optimized Server IP Detection: Optimized the aifs_ip_of_this_server() function to accurately detect the server’s IP address, ensuring reliable results even when SERVER_ADDR returns false positives.
    • Improved Localhost Detection: Improved the is_localhost() function in AutoInstallFreeSSL\FreeSSLAuto\Admin\Factory to accurately determine if the website is hosted on a localhost environment.
    • Improved Help Text: Updated help text of the ‘Generate SSL’ page to provide clearer guidance for WordPress installations on localhost and bare IP addresses, enhancing user experience.
    • Enhanced UI Functionality: Modified the ‘Generate SSL’ page to disable the ‘Next Step’ button when WordPress is installed on a bare IP address, preventing invalid actions.
    • Updated the Freemius WordPress SDK to version 2.12.1.

  3. Auto-Install Free SSL 4.5.1

    • Updated the Freemius WordPress SDK to the latest version.

  4. Auto-Install Free SSL 4.5.0

    • Updated the Freemius WordPress SDK to version 2.10.1.
    • Improved some code.
    • Fixed _load_textdomain_just_in_time notice.
    • Fixed some minor issues.

20246 releases

  1. Auto-Install Free SSL 4.4.0

    • Updated the Freemius WordPress SDK to version 2.9.0.

  2. Auto-Install Free SSL 4.3.0

    • Updated the URL of the Let’s Encrypt™ Subscriber Agreement and made it dynamic.
    • Updated the Freemius WordPress SDK to version 2.8.1.
    • [Pro] Fixed an issue with filtering domain and aliases if the control panel is not cPanel.

  3. Auto-Install Free SSL 4.2.0

    • Updated the Freemius WordPress SDK to version 2.7.4.
    • [Pro] Added a feature to group all domains by document root, useful for users with multiple aliases (i.e., ServerAlias) for domains sharing the same document root.

  4. Auto-Install Free SSL 4.1.0

    • Fixed an issue with the documentroot being passed with the domain and ServerAlias in Step 1 of generating a free SSL certificate.
    • Improved error handling in Step 1 of generating a free HTTPS certificate.
    • [Pro] Fixed an issue for non-cPanel websites: SSL certificate file path was not loaded correctly during the first time free ssl security certificate generation.
    • Improved the function aifs_ip_of_this_server() to support IPv6.
    • Added functions to detect if the WordPress website is hosted on localhost or a bare IP address. Displays information and recommendations in the WordPress dashboard, as Let’s Encrypt™ does not issue free HTTPS SSL certificates for localhost and bare IP addresses.
    • Updated the Freemius WordPress SDK to version 2.7.3.

  5. Auto-Install Free SSL 4.0.0

    • Improved the Generate SSL page.
    • [Pro] Improved the main page.
    • [Pro] Fixed an bug with automatic SSL installation on cPanel if the plugin generates the SSL certificate for the first time.
    • [Pro] Added a page to download SSL certificates if the license is for unlimited sites and multi-domain mode is activated. In any other cases, the users was already able to download the SSL certificate from the plugin’s main page.
    • Updated the Freemius WordPress SDK to version 2.7.2.
    • Introduced toggle switch option to enable or disable SSL renewal reminders before the expiry.
    • Moved Delete plugin data on plugin deactivation option from Log page to Generate Free SSL Certificate page (main page in case of premium).
    • Introduced toggle switch option to enable or disable ‘Delete plugin data on plugin deletion’ option.
    • Moved Delete plugin data on deactivation logic to Freemius after uninstall action. Now plugin data will be deleted (if enabled) on plugin deletion (i.e., uninstallation) instead of deactivation.
    • Added an option to download the fullchain.pem file of the free encryption certificate if the web server software is NGINX.
    • Extended the option to exclude domain alias for single domain mode. However, for now, it need to be done through database entry.
    • Improved the logic that checks if the domain aliases are online with CURL (in addition to fsockopen).
    • Improved minimum system requirement check.
    • Moved Schedule daily Cron Job Event logic to the activation hook.

  6. Auto-Install Free SSL 3.6.10

    • Updated the Freemius WordPress SDK to version 2.6.2.
    • [Pro] Fixed an issue with displaying a log message.

202320 releases

  1. Auto-Install Free SSL 3.6.9

    • Updated the Freemius WordPress SDK to version 2.6.1.
    • [Pro] Added an existing video documentation in the cPanel settings page.

  2. Auto-Install Free SSL 3.6.8

    • Introduced an email field in the first step of the free https certificate generation process to gather the admin email ID. This update ensures a valid email ID is provided for Let’s Encrypt account registration. In previous versions, the WordPress Administration Email Address was used for this purp…

  3. Auto-Install Free SSL 3.6.7

    • Updated the Freemius WordPress SDK to version 2.6.0.

  4. Auto-Install Free SSL 3.6.6

    • Substituted the deprecated function get_currentuserinfo() with wp_get_current_user().
    • Enhanced some instructions for manual SSL generation.
    • [Pro] Enhanced the logging code for cases where the ‘.well-known/acme-challenge’ directory is not writable.

  5. Auto-Install Free SSL 3.6.5

    • In version 3.6.3, we introduced A record verification for all domain aliases against the server’s IP address to cater to specific use cases. However, this caused issues for some websites to generate free ssl cert, especially those using CDNs. In this update, we’ve adjusted our approach: by default,…

  6. Auto-Install Free SSL 3.6.4

    • Improved the detection process (and fixed a related bug) of the server’s IPv4 address where the WordPress website is hosted.
    • Updated the Freemius WordPress SDK to version 2.5.12.

  7. Auto-Install Free SSL 3.6.3

    • Resolved a loading issue with the theme editor in the WordPress 6.3 dashboard when Force HTTPS is activated.
    • Enhanced IP address verification logic for all available domain aliases, as opposed to solely the ‘mail.’ alias in previous versions. Now, it filters out the domain alias (when generating the free TLS certificate) if its A record differs from the server’s IP address. Note that if the option ‘aifs_v…
    • Updated the Freemius WordPress SDK to version 2.5.11.

  8. Auto-Install Free SSL 3.6.2

    • Enhanced error handling logic for cases where after submitting a request to the ‘finalize’ URL, the response from Let’s Encrypt contains an empty ‘certificate’ key (location value).
    • Resolved an issue where the ‘finalize’ response in the cert free generation process was unintentionally removed from the database.
    • Introduced a new capability to activate the option ‘aifs_log_all_ca_server_response’ by accessing the following URL (login required): http://www.example.com/wp-admin/admin.php?page=auto_install_free_ssl&log_all_ca_server_response=yes (Please replace ‘www.example.com’ with your domain name.)

  9. Auto-Install Free SSL 3.6.1

    • Fixed the issue with character encoding for sending automated email notifications to support multilingual characters.
    • Added feature to write Let’s Encrypt free https cert server response details in the log files for every API call (if the option ‘aifs_log_all_ca_server_response’ is set to true). This will be helpful for troubleshooting.
    • Removed WordPress translation function __() for some error and exception messages (which are intended for developers) to make those English only.
    • Tested up to: 6.3

  10. Auto-Install Free SSL 3.6.0

    • Improved the domainsArray() function that filters domain and server alias.
    • Created a new function to detect the IPv4 of the server.
    • Created a new function to get the confirmed and domain-specific free https ssl certificate directory.
    • Improved the function that detects the cPanel host and fixed a premium version-specific issue with it.
    • Updated the Freemius WordPress SDK to 2.5.10
    • Automatic entry of some initial data has been moved to the activation hook.
    • [Pro] Improved the function sslRequiredForFirstTime() called before generating a free web ssl certificate.
    • [Pro] Created a new function to detect if the given domains array has at least one Wildcard domain.
    • [Pro] Improved some free tls cert generation and installation logic.
    • [Pro] Added a feature that detects if the cPanel hostname was changed and updates it automatically.
    • [Pro] Added a feature that detects if cPanel credentials were changed and send notifications by email and admin notice.
    • [Pro] Improved the functionality to send notifications by email and admin notice if the encryption key was changed.
    • Please click the following URL for the previous changelog: https://freessl.tech/aifs_changelog.txt

  11. Auto-Install Free SSL 3.5.1

  12. Auto-Install Free SSL 3.5.0

  13. Auto-Install Free SSL 3.4.3

  14. Auto-Install Free SSL 3.4.2

  15. Auto-Install Free SSL 3.4.1

  16. Auto-Install Free SSL 3.4.0

  17. Auto-Install Free SSL 3.3.2

  18. Auto-Install Free SSL 3.3.1

  19. Auto-Install Free SSL 3.3.0

  20. Auto-Install Free SSL 3.2.15

202227 releases

  1. Auto-Install Free SSL 3.2.14

  2. Auto-Install Free SSL 3.2.13

  3. Auto-Install Free SSL 3.2.12

  4. Auto-Install Free SSL 3.2.11

  5. Auto-Install Free SSL 3.2.10

  6. Auto-Install Free SSL 3.2.9

  7. Auto-Install Free SSL 3.2.8

  8. Auto-Install Free SSL 3.2.7

  9. Auto-Install Free SSL 3.2.6

  10. Auto-Install Free SSL 3.2.5

  11. Auto-Install Free SSL 3.2.4

  12. Auto-Install Free SSL 3.2.3

  13. Auto-Install Free SSL 3.2.2

  14. Auto-Install Free SSL 3.2.1

  15. Auto-Install Free SSL 3.2.0

  16. Auto-Install Free SSL 3.1.3

  17. Auto-Install Free SSL 3.1.2

  18. Auto-Install Free SSL 3.1.1

  19. Auto-Install Free SSL 3.1.0

  20. Auto-Install Free SSL 3.0.7

  21. Auto-Install Free SSL 3.0.6

  22. Auto-Install Free SSL 3.0.5

  23. Auto-Install Free SSL 3.0.4

  24. Auto-Install Free SSL 3.0.3

  25. Auto-Install Free SSL 3.0.2

  26. Auto-Install Free SSL 3.0.1

  27. Auto-Install Free SSL 3.0.0

Questions about Auto-Install Free SSL’s releases

What is the latest version of Auto-Install Free SSL?

5.0.1, released on Oct 18, 2026 (3 weeks ago). It’s tested up to WordPress 7.1.4 and needs PHP 5.6 or later.

How often is Auto-Install Free SSL updated?

6 releases in the last year, about one every 60 days. Its first release on WordPress.org dates from June 2022.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Auto-Install Free SSL’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.