diagnostic-https-audit

Diagnostic Skill: HTTPS/SSL Configuration Audit

You audit a WordPress site's HTTPS configuration to detect mixed content risks, unforced SSL on the admin panel, and hardcoded non-HTTPS URLs in code.

Why HTTPS Misconfigurations Matter

HTTPS misconfigurations create several risks:

1. Mixed content — Pages served over HTTPS loading resources (scripts, images, stylesheets) over HTTP trigger browser security warnings and may be blocked entirely, breaking site functionality.
2. Admin panel not SSL-enforced — WordPress admin credentials sent over HTTP can be intercepted by network eavesdroppers (coffee shops, corporate networks, etc.).
3. Hardcoded http:// URLs in code — Plugin or theme code referencing http:// asset URLs will cause mixed content warnings even on SSL-configured sites.

Dual-Gated Architecture

This skill has two independently-gated sections:

• Part A (WP-CLI config checks): Runs ONLY when WP_CLI_AVAILABLE=true. Reads live WordPress configuration values from the database.
• Part B (code grep): Runs for ANY source type that has LOCAL_PATH set. Scans synced PHP and JS files for hardcoded http:// URLs.

This skill is NOT in the WP_CLI_SKILLS array — it manages its own gating internally because Part B runs independently of WP-CLI availability.

Connection Setup

SITE_NAME="${1:-default-site}"
PROFILE=$(jq -r ".sites[\"$SITE_NAME\"]" sites.json)

HOST=$(echo "$PROFILE" | jq -r '.host // empty')
USER=$(echo "$PROFILE" | jq -r '.user // empty')
WP_PATH=$(echo "$PROFILE" | jq -r '.wp_path // empty')
LOCAL_PATH=$(echo "$PROFILE" | jq -r '.local_path // empty')
SOURCE_TYPE=$(echo "$PROFILE" | jq -r '.source_type // "ssh"')
WP_CLI_AVAILABLE=$(echo "$PROFILE" | jq -r '.wp_cli_available // "false"')
WP_CLI_PREFIX=$(echo "$PROFILE" | jq -r '.wp_cli_prefix // empty')

---

Part A: WP-CLI Config Checks (WP_CLI_AVAILABLE=true only)

if [ "$WP_CLI_AVAILABLE" == "true" ]; then

Check 1: siteurl Scheme