A mixed content error occurs when a WordPress page loads over HTTPS but requests one or more images, scripts, stylesheets, fonts or other resources over HTTP. Browsers may block those resources or remove the secure padlock.
Installing an SSL certificate is only the first step. Every resource on the page must also use HTTPS.
Confirm the certificate works
Open the HTTPS version of the homepage and several internal pages. If the browser reports an expired, mismatched or untrusted certificate, fix that first through the hosting provider or certificate issuer. Mixed content cannot be solved reliably while the certificate itself is invalid.
Find the insecure resources
Open the browser developer tools and check the Console and Network panels for URLs beginning with http://. Test multiple templates, including posts, pages, archives, forms and checkout pages. A crawler such as Semrush can help locate mixed content across a larger site.
Update the WordPress site URLs
Go to Settings > General and confirm both the WordPress Address and Site Address use the canonical HTTPS URL. A mismatch can cause WordPress to keep generating insecure links.
If those fields are locked, check wp-config.php for WP_HOME and WP_SITEURL constants.
Replace old HTTP URLs in the database
After a migration to HTTPS, content, widgets and theme settings may still contain absolute HTTP URLs. Create a complete backup and use a serialization-safe search-and-replace tool. Replace only the exact old site URL with the exact HTTPS version.
Do not run a raw database replacement that can damage serialized data. Test the change on staging when the site contains ecommerce, membership or multilingual data.
Check the theme and custom code
Search theme files, WPCode snippets, CSS and template settings for hard-coded HTTP resources. Replace them with HTTPS URLs when the source supports HTTPS. Protocol-relative URLs are usually unnecessary on a modern HTTPS site.
Review plugins and embedded services
Forms, maps, videos, chat tools, tracking scripts and older plugins may insert insecure assets. Update the plugin or its configuration. If the third-party source does not support HTTPS, replace it rather than weakening browser security.
Check CDN and image URLs
Confirm the CDN has a valid certificate and that its public URL uses HTTPS. Purge the CDN, hosting and WordPress caches after changing URLs. Image optimization and media offloading plugins may also store an outdated HTTP CDN address.
Avoid using a plugin as the permanent fix
An SSL helper plugin can provide a fast temporary correction, but it may rewrite requests on every page load without correcting the database or configuration. Fix the source URLs when possible, then remove unnecessary rewrite layers.
Set one HTTPS redirect
Redirect all HTTP traffic to HTTPS at the server, host or CDN level. Avoid stacking multiple redirect systems. Conflicting redirects can cause the WordPress too many redirects error.
Verify the repair
- Clear all caches.
- Test in a private browser window.
- Recheck the browser Console.
- Crawl important pages for HTTP resources.
- Confirm canonical tags and sitemaps use HTTPS.
Mixed content can affect trust, functionality and technical SEO. For related issues, use my WordPress troubleshooting hub.
