Quick answer: Mixed content happens when a page loads over HTTPS but some of its images, scripts, stylesheets or other files still load over plain HTTP. Browsers then remove the padlock, show a warning or block the insecure files entirely. In WordPress, the fix is to update the WordPress Address and Site Address to HTTPS, run a careful search and replace on the database to change old http:// URLs to https://, fix hard-coded URLs in your theme and plugins, redirect all HTTP traffic to HTTPS, and check the browser console until no warnings remain.
What mixed content is
When you install an SSL certificate, your pages can load over HTTPS. But a page is made of many files. If the HTML loads over HTTPS while an image, font, script or iframe still loads from an http:// address, the page mixes secure and insecure content.
Browsers split this into two kinds:
- Passive mixed content, such as images, audio and video. Historically browsers loaded these but removed the padlock.
- Active mixed content, such as scripts, stylesheets and iframes. Browsers block these because an attacker could change them to take over the page.
Chrome has been steadily tightening its rules since late 2019, upgrading some insecure resources to HTTPS automatically and blocking them if that fails. Firefox and Safari behave similarly. The direction is clear: mixed content that once showed a small warning now often just breaks.
Signs you have mixed content
- The padlock is missing or shows a warning icon.
- Chrome shows “Not secure” or an info icon instead of a padlock. Our article on the Chrome not secure warning explains the different states.
- Parts of the page look broken: missing styles, fonts, sliders or embedded videos.
- The browser console shows “Mixed Content” errors.
Step 1: Back up your site
Before changing anything in the database, take a full backup of files and database. Search and replace mistakes can break a site, and a backup lets you roll back in minutes. Test on a staging copy if you have one.
Step 2: Find the insecure URLs
Browser developer tools
Open the page in Chrome, right-click, choose Inspect and open the Console tab. Mixed content errors list the exact URLs being loaded over HTTP. The Security tab gives a summary of the page’s status.
Check several page types: home, a post, a page, a category archive, a product and checkout if you run a store. Mixed content often appears only on certain templates.
Online checkers
Free tools such as Why No Padlock and JitBit’s SSL check crawl a page or site and list insecure resources. They save time on larger sites.
Search the database
The most common source in WordPress is old content. Posts and pages saved before the switch still contain http:// links to images and other files.
Step 3: Update the WordPress addresses
Go to Settings, then General, and make sure both WordPress Address (URL) and Site Address (URL) start with https://. If these fields are greyed out, they are set in wp-config.php with WP_HOME and WP_SITEURL, so update them there.
Step 4: Search and replace in the database
You need to change http://yourdomain.com to https://yourdomain.com throughout the database. Do not do this with a plain SQL query. WordPress stores some settings as serialized data, which includes string lengths. A naive replace can corrupt those values and break widgets or theme settings.
Use a tool that handles serialized data:
- WP-CLI. Run a dry run first, then the real command:
wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run
wp search-replace 'http://example.com' 'https://example.com' --all-tables
Our guide to WP-CLI covers installation and other useful commands.
- Better Search Replace plugin. A simple interface that supports dry runs and serialized data. Remove it once you are done.
Remember the www version too if your site has used both. Search for http://www.example.com as well as http://example.com.
After the replace, clear every cache: page cache, object cache, CDN cache and browser cache.
Step 5: Fix hard-coded URLs in themes and plugins
If warnings remain, the insecure URL may be hard-coded in your theme or a plugin.
- Search your theme files for “http://” and replace them with https://, or better, build the URLs with WordPress functions such as get_template_directory_uri().
- Check the Customizer for custom CSS that loads background images over HTTP.
- Check widget areas and page builder settings for old image URLs.
- Look at plugin settings, especially sliders, galleries and social feeds.
If a third-party resource is only available over HTTP, you need to replace it with a provider that supports HTTPS, host the file yourself, or remove it. There is no safe way to load it securely.
Step 6: Redirect HTTP to HTTPS
Make sure every request to an http:// URL is redirected permanently to its https:// version. On Apache this is usually a rule in .htaccess. On Nginx it is a server block that returns a 301. Many hosts offer a “force HTTPS” toggle.
Proper redirects matter for search too. Our guide to HTTPS migration SEO explains how to move without losing rankings, including updating Search Console and your XML sitemap.
Step 7: Consider upgrade-insecure-requests
The Content-Security-Policy header supports a directive called upgrade-insecure-requests. It tells the browser to request every resource over HTTPS, even if the HTML says http://. It is a useful safety net, but it only works if the resource is actually available over HTTPS. It does not replace fixing the URLs.
Once everything works over HTTPS, consider adding HSTS so browsers always use HTTPS for your domain.
What about plugins that fix it automatically?
Plugins such as Really Simple SSL and SSL Insecure Content Fixer can rewrite insecure URLs on the fly as pages load. They are a quick fix and helpful for non-technical site owners, but they add processing to every page and hide the underlying problem. If you deactivate the plugin later, the warnings come back.
A permanent fix in the database and theme is cleaner. Use these plugins as a temporary bridge if you must.
Mixed content on WooCommerce stores
Mixed content on checkout pages is especially harmful. Shoppers who see a security warning while entering card details will leave. After any SSL change, test the cart, checkout, my account and order confirmation pages carefully, and check payment gateway settings for old HTTP callback URLs.
Choosing and renewing certificates
Mixed content is separate from certificate problems, but they often appear together. If the certificate itself is expired or misconfigured, browsers show a full-page error. Free certificates from Let’s Encrypt renew automatically on most hosts, while paid certificates need manual renewal reminders. Our article on SSL certificate types explains the differences.
Questions people ask
Does mixed content hurt SEO?
Indirectly. Google uses HTTPS as a light ranking signal, and broken pages with warnings make visitors leave. Fixing mixed content is part of a clean HTTPS setup.
Can I just change http to https in a few posts?
You can, but on any site with more than a handful of posts, a database search and replace is faster and more complete.
Why do warnings appear only on some pages?
Different templates load different resources. A slider on the homepage or an old embed in one post can cause warnings only there.
Do I need to fix links to other websites?
Ordinary links to external HTTP sites do not cause mixed content. Only resources loaded into your page, such as images, scripts and iframes, do.
Summing up
Mixed content is almost always fixable in an afternoon. Back up, update the WordPress addresses, run a safe search and replace, fix theme and plugin URLs, redirect everything to HTTPS and check the console until it is clean.
If you would rather have the switch to HTTPS handled for you, our Turn visitors into customers team builds and maintains secure WordPress sites.
