Fix Mixed Content WordPress: Full Guide for Beginners
What Is Mixed Content in WordPress?
Fix Mixed Content WordPress issues is essential if you want a fully secure and SEO-friendly site. Mixed content happens when your WordPress site loads over HTTPS, but some resources—like images, scripts, or stylesheets—still load over HTTP. This mismatch triggers browser security warnings and breaks the secure padlock icon.
For WordPress site owners, this issue commonly arises after installing an SSL certificate but still referencing HTTP URLs in themes, plugins, or media.
Mixed content can negatively impact:
- Site security
- SEO performance
- User trust
How to Detect Mixed Content in WordPress
Use Browser Console (Developer Tools)
Open your browser’s developer tools and go to the Console tab. If mixed content exists, you will see errors like:
“This request has been blocked; the content must be served over HTTPS.”
Use Mixed Content Checker Tools
Several online tools can help:
- Why No Padlock
- JitBit SSL Checker
- Screaming Frog SEO Spider (for advanced crawling)
Fix Mixed Content WordPress Using Plugins
Really Simple SSL Plugin
This popular plugin automatically detects and fixes most mixed content issues by:
- Enforcing HTTPS sitewide
- Rewriting old HTTP URLs on the fly
- Redirecting all traffic to HTTPS
However, it may not fix hardcoded URLs in theme files or databases.
SSL Insecure Content Fixer Plugin
This plugin offers more granular control with several fixing levels:
- Simple
- Content
- Widgets
- Capture (advanced)
Choose the right level depending on where insecure content appears.
Fix Mixed Content WordPress Without Plugin
Update WordPress & Site URL to HTTPS
Navigate to Settings > General and update:
- WordPress Address (URL)
- Site Address (URL)
Ensure both use https:// instead of http://.
Force HTTPS via .htaccess (Apache Servers)
Add the following rewrite rule to your .htaccess file:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>Code language: HTML, XML (xml)This forces all traffic through HTTPS.
Search and Replace HTTP in Database
Use the “Better Search Replace” plugin or WP-CLI to update URLs in the database:
- Search for http://yourdomain.com
- Replace with https://yourdomain.com
Make sure to run a dry test before executing the replacement.
Manually Fix in Theme or Template Files
Inspect your theme’s files such as header.php, footer.php, and functions.php for hardcoded HTTP URLs. Replace them with HTTPS versions.
Fix Mixed Content in Media and Content
Update Media Links to HTTPS
Images embedded in posts or pages may still use HTTP. Edit them manually in the content editor or use a search-and-replace plugin to fix in bulk.
WordPress HTTPS Image Not Showing Fix
If HTTPS images are not showing, try:
- Clearing your cache
- Regenerating thumbnails
- Verifying the source URL is accessible over HTTPS
Fix Redirection and SSL Display Issues
Fix “No Padlock” or Broken SSL
Broken padlock icons usually indicate mixed content. Even one HTTP resource can trigger this. Fix all insecure links to restore full SSL status.
“Your Connection Is Not Fully Secure” Warning
This browser message typically results from mixed content. Double-check your content and third-party scripts for HTTP references.
WordPress HTTP to HTTPS Redirect Setup
Use a 301 redirect in .htaccess or use your host’s HTTPS redirect tool to ensure all HTTP requests are redirected to HTTPS.
Common Errors and How to Fix Them
This Request Has Been Blocked
This error appears in Chrome Console when an HTTP resource is blocked on an HTTPS page. Fix by updating the URL or removing the insecure reference.
Better Search Replace Mixed Content Doesn’t Work?
If the plugin fails:
- Check serialized data
- Clear caches
- Try using WP Migrate DB or WP-CLI for advanced replacement
Best Practices After Fixing Mixed Content
- Test across multiple devices and browsers
- Verify using Google Search Console
- Set up a CDN with HTTPS rewriting
- Optionally add HSTS headers to enforce HTTPS
How to Fix Mixed Content Issue in WordPress: Step-by-Step Summary
If you’re unsure where to start, here’s a summarized checklist:
- Install an SSL certificate (via host or Let’s Encrypt)
- Update WordPress and Site URLs to use https://
- Redirect all HTTP traffic to HTTPS via .htaccess or server config
- Use a search-and-replace plugin to update database content
- Check theme/template files for hardcoded links
- Reupload or relink any media files using HTTP
- Use browser DevTools and tools like SSL Checker to confirm all is fixed
You can apply these steps manually or with plugins depending on your experience level.
Mixed Content Error: HTTP Over HTTPS in WordPress Plugins or Widgets
Sometimes plugins (e.g., sliders, image galleries, analytics scripts) may load assets over HTTP, causing mixed content.
- Review plugin settings for any manual URL fields
- Reach out to plugin support if the plugin hardcodes HTTP
- Replace the plugin with a secure alternative if it’s outdated
WordPress Mixed Content Due to External Scripts (Google Fonts, CDN, Ads)
Even if your WordPress site uses HTTPS, third-party resources (Google Fonts, scripts, ads, or CDNs) may be loaded via HTTP.
- Ensure script URLs use https:// (e.g., in functions.php or theme settings)
- Use //example.com or protocol-relative URLs to avoid hardcoding HTTP
Use Mixed Content Checker Tools After Every Theme or Plugin Update
After updating themes or plugins, always recheck for mixed content. Some themes/plugins reintroduce HTTP links during updates.
Tools to Use:
- Why No Padlock
- SSL Labs
- Chrome DevTools → Console tab
- Screaming Frog (advanced users)
SSL Insecure Content Fixer vs. Really Simple SSL: Which One to Choose?
Both plugins help with mixed content, but they serve slightly different users:
- Really Simple SSL: Great for beginners, automatic fixes
- SSL Insecure Content Fixer: More detailed, with multiple fix levels for advanced users
If you tried one and it didn’t fully work, try the other — or use both strategically.
Conclusion – Keep Your WordPress Fully Secure
Fixing mixed content in WordPress is crucial for SEO, security, and performance. Whether you choose plugins or manual methods, the goal is the same: ensure all resources load securely over HTTPS.
Once fixed, regularly monitor your site after updates and content changes to maintain a secure experience for users and search engines alike.
RELATED POSTS
