The SSL certificate is installed, the site loads over HTTPS, but the address bar shows “Not Secure” or a broken padlock instead of the lock icon it’s supposed to have. That’s a WordPress mixed content error, and it’s one of the more common problems that shows up right after an SSL install, a theme change, or a site migration. The fix is usually fast once you know exactly where to look.
What Is a WordPress Mixed Content Error?
A WordPress mixed content error happens when a page loads over secure HTTPS but also pulls in at least one resource, like an image, script, or stylesheet, over insecure HTTP. Browsers flag or block that insecure resource, which strips the padlock icon from the address bar even though the site has a valid SSL certificate installed.
There are two flavors of this problem, and they matter for how urgent the fix is. Passive mixed content covers things like images or videos loaded over HTTP: the browser still shows the content but marks the connection as not fully secure. Active mixed content covers scripts, stylesheets, and iframes loaded over HTTP: most modern browsers block these outright, which can silently break layout, functionality, or tracking scripts on a WordPress site.
Why Does My WordPress Site Show a Mixed Content Warning?
Most mixed content warnings on WordPress trace back to hardcoded HTTP URLs sitting in the database, usually left over from before the site had SSL, or introduced during a migration or domain change that didn’t update every URL reference. Plugins, theme files, page builder content, and even old blog posts can all still point to the http:// version of an image, font, or script.
The most common sources are old post content with absolute image URLs typed in as http://yourdomain.com/wp-content/uploads/..., page builder blocks that store background images or custom CSS with hardcoded URLs, and third-party embeds like fonts, ad scripts, or video players still calling their HTTP endpoints. A CDN that isn’t configured to serve HTTPS can cause the exact same warning even when every WordPress setting looks correct.
HTTPS adoption has become the default rather than the exception. According to Google’s Transparency Report, 83 of the top 100 sites on the web now serve traffic over HTTPS by default, and Google has treated HTTPS as a search ranking signal since announcing it in August 2014. A site stuck showing mixed content warnings is working against both user trust and search visibility at the same time.
How Do You Find Mixed Content on a WordPress Site?
The fastest way to find mixed content on a WordPress site is the browser’s developer console: open it, reload the page, and look for warnings that name the exact insecure URL being blocked or flagged. This works in any modern browser and requires no plugins or extra tools.
- Open the page in Chrome or Firefox and press
Ctrl+Shift+J(Windows/Linux) orCmd+Option+J(Mac) to open the console. - Reload the page with the console open.
- Look for lines containing “Mixed Content” — each one lists the exact HTTP URL the browser blocked or flagged.
- Repeat on a few different page types: homepage, a blog post, a product or service page, since different templates often pull in different assets.
For a full-site scan instead of page-by-page checking, free online tools like WhyNoPadlock or JitBit’s SSL Check will crawl a URL and list every insecure resource it finds in one report.
Fix 1: Update the Site URL and Search-Replace the Database
The most reliable fix for mixed content caused by old HTTP links in post content is a direct database search-and-replace, swapping every http://yourdomain.com reference for https://yourdomain.com using a plugin built to handle WordPress’s serialized data safely, such as Better Search Replace.
- Take a full database backup before changing anything.
- Install and activate the Better Search Replace plugin.
- Under Tools > Better Search Replace, search for
http://yourdomain.comand replace withhttps://yourdomain.com. - Run it first with “Dry Run” checked to preview how many rows will change, then uncheck it and run for real.
- Clear any caching plugin and CDN cache afterward so the old HTTP references aren’t served from a cached copy.
A plain SQL find-and-replace query is riskier here because WordPress stores some data, like widget settings and page builder layouts, as serialized arrays. A straight text replace can corrupt the character counts inside that serialized data and break the field entirely, which is exactly why a purpose-built plugin is worth using instead of running raw SQL.
Fix 2: Force HTTPS With wp-config.php and .htaccess
When a WordPress site sits behind a proxy, load balancer, or CDN, WordPress itself sometimes can’t tell the connection is actually secure, which triggers mixed content warnings even after the database is clean. Adding a proxy detection snippet to wp-config.php and a redirect rule to .htaccess fixes that at the server level.
Add this above the line that reads /* That's all, stop editing! */ in wp-config.php:
define('FORCE_SSL_ADMIN', true);
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
$_SERVER['HTTPS'] = 'on';
}Then add this to the top of .htaccess to force every HTTP request to redirect to HTTPS:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Back up both files before editing them, and test the site immediately after saving. A typo in .htaccess can take a site fully offline, so this fix is best reserved for someone comfortable editing server config files directly, or done through hosting support if there’s any doubt.
Fix 3: Use an SSL Plugin to Auto-Fix Mixed Content
For anyone who’d rather not touch the database or server files directly, a dedicated SSL plugin can scan and rewrite insecure URLs automatically. Really Simple SSL includes a Mixed Content Scan & Fixer in its paid tier that detects HTTP resources site-wide and rewrites them to HTTPS on both the front and back end, without a manual database pass.
This is the lowest-effort option and a reasonable starting point for a small business site, but it’s worth treating as a patch rather than a permanent fix. A plugin rewriting URLs on the fly still has to do that work on every page load, and it doesn’t clean up the underlying hardcoded links sitting in the database the way a search-replace does.
Which Mixed Content Fix Should You Use?
The right fix depends on where the mixed content is coming from and how comfortable the site owner is editing files or running database operations. The table below breaks down when each method makes sense.
| Method | Best For | Skill Needed | Risk Level |
|---|---|---|---|
| Database search-replace | Old post content with hardcoded HTTP links | Medium | Low, if backed up first |
| wp-config.php + .htaccess | Proxy, CDN, or load balancer detection issues | Medium-high | Medium, a bad edit can break the site |
| SSL plugin (Really Simple SSL) | Fast fix without touching code or the database | Low | Low, but doesn’t clean up root cause |
How to Prevent Mixed Content After a Site Migration
Site migrations are one of the most common triggers for a fresh wave of mixed content warnings, because URLs, media paths, and sometimes the domain itself all change at once. Following a proper WordPress migration process that avoids downtime keeps the old site available for testing and reduces the chance of stray HTTP references getting left behind in the move.
A CDN in front of the site can also catch mixed content that slips past a database cleanup. Setting up Cloudflare for WordPress and enabling its Automatic HTTPS Rewrites option rewrites HTTP resource links to HTTPS at the edge, which acts as a safety net on top of fixing the root cause in the database.
The one thing worth avoiding is relying on an edge or plugin-level rewrite as the only fix. Rewriting URLs on every request adds overhead that a clean database doesn’t need, and it can mask a mixed content problem that resurfaces the moment the CDN or plugin gets disabled.
Frequently Asked Questions
A mixed content warning appears when a page loaded over HTTPS also loads at least one image, script, or stylesheet over insecure HTTP, usually from an old post, a page builder setting, or a third-party embed that still points to the HTTP version of a file.
Mixed content isn’t a direct Google ranking penalty on its own, but it undermines the HTTPS ranking signal Google has used since 2014 and breaks the trust signal of the padlock icon, which can lower click-through rates and conversions even if rankings don’t move immediately.
Yes. A database search-and-replace tool combined with edits to wp-config.php and .htaccess can resolve mixed content without an SSL plugin, though a purpose-built search-replace plugin is still the safest way to update the database itself.
Cloudflare’s WordPress plugin has an Automatic HTTPS Rewrites option that rewrites HTTP resource links to HTTPS at the edge, but it doesn’t remove the hardcoded HTTP links stored in the WordPress database, so it works best alongside a database cleanup rather than as a replacement for one.
Open the browser’s developer console (Ctrl+Shift+J on Windows or Cmd+Option+J on Mac), reload the page, and look for entries labeled “Mixed Content” that list the exact insecure URL, or run the site through a free scanner like WhyNoPadlock for a full-site report.
A WordPress mixed content error is almost never a sign the SSL certificate failed, it’s a sign that some corner of the site is still pointing to the old HTTP address. Fix the database first, add server-level HTTPS detection if the site sits behind a proxy or CDN, and treat any plugin-based fix as a safety net rather than the whole solution.
Leave a Reply