Fixing mixed content warnings on HTTPS sites

Mixed content occurs when an HTTPS page includes resources (images, scripts, stylesheets, iframes) loaded over HTTP. Browsers block or warn about mixed content because it undermines the security of the HTTPS connection. The result: a broken padlock, security warnings, or blocked resources.

What is mixed content?

Finding mixed content

Browser developer tools (quickest):

1. Open the page in Chrome or Firefox
2. Press F12 to open Developer Tools
3. Go to the Console tab
4. Look for warnings starting with "Mixed Content:"-they list the exact HTTP URLs causing issues

Online checker: Use whynopadlock.com to scan any URL for mixed content without needing developer tools.

Fix in WordPress

The most common cause is the WordPress site URL still set to HTTP after SSL is enabled.

1. Go to WordPress Admin → Settings → General
2. Change both WordPress Address (URL) and Site Address (URL) from http:// to https://
3. Save changes

For legacy content with hardcoded HTTP links, use the Really Simple SSL plugin-it rewrites HTTP to HTTPS across your whole site automatically. Alternatively, use WP-CLI:

wp search-replace 'http://yourdomain.com','https://yourdomain.com' --all-tables

Content Security Policy via .htaccess

Add a Content Security Policy header that upgrades HTTP resources to HTTPS automatically. Add to your .htaccess:

Header always set Content-Security-Policy "upgrade-insecure-requests"

This header instructs browsers to load all resources over HTTPS without changing the actual URLs in your HTML. It works for most cases but does not fix links in your database.

Automatic rewrite via Cloudflare

If you use Cloudflare, enable Automatic HTTPS Rewrites under SSL/TLS → Edge Certificates. This rewrites HTTP resource URLs on the fly at the Cloudflare edge, eliminating mixed content warnings without touching your server or database.

Test the fix

1. Hard-refresh the page (Ctrl+Shift+R / Cmd+Shift+R) to bypass browser cache
2. Check the browser console for remaining mixed content warnings
3. Confirm the padlock icon shows a full green lock with no warning
4. Check subpages-mixed content may exist on specific pages (blog posts with old images, etc.)

Related articles