v1.4.1: sanitize forwarded-proto input, fix WPCS style violations

- Wrap $_SERVER['HTTP_X_FORWARDED_PROTO'] read in wp_unslash()/sanitize_text_field()
- Flip 4 comparisons to Yoda condition style
- Add missing @Package docblock tag, fix docblock spacing
- No functional/behavioral changes from v1.4.0

Author: bitcryptic-gw

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.4.1] - 2026-06-19
+### Changed
+- `$_SERVER['HTTP_X_FORWARDED_PROTO']` is now unslashed and sanitized before use, following WPCS input-handling conventions (no functional or security impact — the value was only used in a string comparison; behavior is identical to v1.4.0)
+- Flipped four comparisons to Yoda condition style (no behavior change)
+- Added missing `@package` docblock tag and corrected docblock spacing (code-style only)
+
 ## [1.4] - 2026-06-19
 ### Fixed
 - HTTPS detection no longer uses a hostname-based heuristic (checking for a dot in `HTTP_HOST`). It now relies exclusively on a genuine `X-Forwarded-Proto: https` header, preventing false HTTPS detection on direct, non-proxied connections.

proxy-aware-https-fix.php

@@ -1,39 +1,56 @@
 <?php
-
 /**
  * Plugin Name: Proxy-Aware HTTPS Fix
  * Description: Enforces HTTPS detection and correct REST API resolution behind reverse proxies.
- * Version: 1.4
+ * Version: 1.4.1
  * Author: BitCryptic
+ *
+ * @package Proxy_Aware_Https_Fix
  */
 
-if (defined('WP_CLI') && WP_CLI) return;
+if ( defined( 'WP_CLI' ) && WP_CLI ) {
+	return;
+}
 
-add_action('plugins_loaded', function() {
-    $proto = $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '';
+add_action(
+	'plugins_loaded',
+	function () {
+		$proto = isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
+		? sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) )
+		: '';
 
-    if (
-        (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') &&
-        $proto === 'https'
-    ) {
-        $_SERVER['HTTPS'] = 'on';
-    }
-});
+		if (
+		( ! isset( $_SERVER['HTTPS'] ) || 'on' !== $_SERVER['HTTPS'] ) &&
+		'https' === $proto
+		) {
+			$_SERVER['HTTPS'] = 'on';
+		}
+	}
+);
 
-add_filter('home_url', function($url) {
-    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
-        return str_starts_with($url, 'http:') ? 'https:' . substr($url, 5) : $url;
-    }
-    return $url;
-});
+add_filter(
+	'home_url',
+	function ( $url ) {
+		if ( ! empty( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ) {
+			return str_starts_with( $url, 'http:' ) ? 'https:' . substr( $url, 5 ) : $url;
+		}
+		return $url;
+	}
+);
 
-add_filter('site_url', function($url) {
-    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
-        return str_starts_with($url, 'http:') ? 'https:' . substr($url, 5) : $url;
-    }
-    return $url;
-});
+add_filter(
+	'site_url',
+	function ( $url ) {
+		if ( ! empty( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ) {
+			return str_starts_with( $url, 'http:' ) ? 'https:' . substr( $url, 5 ) : $url;
+		}
+		return $url;
+	}
+);
 
-add_filter('rank_math/rest_api_url', function() {
-    return get_site_url(null, '/wp-json/');
-});
+add_filter(
+	'rank_math/rest_api_url',
+	function () {
+		return get_site_url( null, '/wp-json/' );
+	}
+);