Fix Mixed Content WordPress: Full Guide for Beginners

What Is Mixed Content in WordPress?

Fix Mixed Content WordPress issues is essential if you want a fully secure and SEO-friendly site. Mixed content happens when your WordPress site loads over HTTPS, but some resources—like images, scripts, or stylesheets—still load over HTTP. This mismatch triggers browser security warnings and breaks the secure padlock icon.

For WordPress site owners, this issue commonly arises after installing an SSL certificate but still referencing HTTP URLs in themes, plugins, or media.

Mixed content can negatively impact:

• Site security
• SEO performance
• User trust

How to Detect Mixed Content in WordPress

Use Browser Console (Developer Tools)

Open your browser’s developer tools and go to the Console tab. If mixed content exists, you will see errors like:
“This request has been blocked; the content must be served over HTTPS.”

Use Mixed Content Checker Tools

Several online tools can help:

• Why No Padlock
• JitBit SSL Checker
• Screaming Frog SEO Spider (for advanced crawling)

Fix Mixed Content WordPress Using Plugins

Really Simple SSL Plugin

This popular plugin automatically detects and fixes most mixed content issues by:

• Enforcing HTTPS sitewide
• Rewriting old HTTP URLs on the fly
• Redirecting all traffic to HTTPS

However, it may not fix hardcoded URLs in theme files or databases.

SSL Insecure Content Fixer Plugin

This plugin offers more granular control with several fixing levels:

• Simple
• Content
• Widgets
• Capture (advanced)

Choose the right level depending on where insecure content appears.

Fix Mixed Content WordPress Without Plugin

Update WordPress & Site URL to HTTPS

Navigate to Settings > General and update:

• WordPress Address (URL)
• Site Address (URL)

Ensure both use https:// instead of http://.

Force HTTPS via .htaccess (Apache Servers)

Add the following rewrite rule to your .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>Code language: HTML, XML (xml)

This forces all traffic through HTTPS.

Search and Replace HTTP in Database

Use the “Better Search Replace” plugin or WP-CLI to update URLs in the database:

• Search for http://yourdomain.com
• Replace with https://yourdomain.com

Make sure to run a dry test before executing the replacement.

Manually Fix in Theme or Template Files

Inspect your theme’s files such as header.php, footer.php, and functions.php for hardcoded HTTP URLs. Replace them with HTTPS versions.

Fix Mixed Content in Media and Content

Update Media Links to HTTPS

Images embedded in posts or pages may still use HTTP. Edit them manually in the content editor or use a search-and-replace plugin to fix in bulk.

WordPress HTTPS Image Not Showing Fix

If HTTPS images are not showing, try:

• Clearing your cache
• Regenerating thumbnails
• Verifying the source URL is accessible over HTTPS

Fix Redirection and SSL Display Issues

Fix “No Padlock” or Broken SSL

Broken padlock icons usually indicate mixed content. Even one HTTP resource can trigger this. Fix all insecure links to restore full SSL status.

“Your Connection Is Not Fully Secure” Warning

This browser message typically results from mixed content. Double-check your content and third-party scripts for HTTP references.

WordPress HTTP to HTTPS Redirect Setup

Use a 301 redirect in .htaccess or use your host’s HTTPS redirect tool to ensure all HTTP requests are redirected to HTTPS.

Common Errors and How to Fix Them

This Request Has Been Blocked

This error appears in Chrome Console when an HTTP resource is blocked on an HTTPS page. Fix by updating the URL or removing the insecure reference.

Better Search Replace Mixed Content Doesn’t Work?

If the plugin fails:

• Check serialized data
• Clear caches
• Try using WP Migrate DB or WP-CLI for advanced replacement

Best Practices After Fixing Mixed Content

• Test across multiple devices and browsers
• Verify using Google Search Console
• Set up a CDN with HTTPS rewriting
• Optionally add HSTS headers to enforce HTTPS

How to Fix Mixed Content Issue in WordPress: Step-by-Step Summary

If you’re unsure where to start, here’s a summarized checklist:

• Install an SSL certificate (via host or Let’s Encrypt)
• Update WordPress and Site URLs to use https://
• Redirect all HTTP traffic to HTTPS via .htaccess or server config
• Use a search-and-replace plugin to update database content
• Check theme/template files for hardcoded links
• Reupload or relink any media files using HTTP
• Use browser DevTools and tools like SSL Checker to confirm all is fixed

You can apply these steps manually or with plugins depending on your experience level.

Mixed Content Error: HTTP Over HTTPS in WordPress Plugins or Widgets

Sometimes plugins (e.g., sliders, image galleries, analytics scripts) may load assets over HTTP, causing mixed content.

• Review plugin settings for any manual URL fields
• Reach out to plugin support if the plugin hardcodes HTTP
• Replace the plugin with a secure alternative if it’s outdated

WordPress Mixed Content Due to External Scripts (Google Fonts, CDN, Ads)

Even if your WordPress site uses HTTPS, third-party resources (Google Fonts, scripts, ads, or CDNs) may be loaded via HTTP.

• Ensure script URLs use https:// (e.g., in functions.php or theme settings)
• Use //example.com or protocol-relative URLs to avoid hardcoding HTTP

Use Mixed Content Checker Tools After Every Theme or Plugin Update

After updating themes or plugins, always recheck for mixed content. Some themes/plugins reintroduce HTTP links during updates.

Tools to Use:

• Why No Padlock
• SSL Labs
• Chrome DevTools → Console tab
• Screaming Frog (advanced users)

SSL Insecure Content Fixer vs. Really Simple SSL: Which One to Choose?

Both plugins help with mixed content, but they serve slightly different users:

• Really Simple SSL: Great for beginners, automatic fixes
• SSL Insecure Content Fixer: More detailed, with multiple fix levels for advanced users

If you tried one and it didn’t fully work, try the other — or use both strategically.

Conclusion – Keep Your WordPress Fully Secure

Fixing mixed content in WordPress is crucial for SEO, security, and performance. Whether you choose plugins or manual methods, the goal is the same: ensure all resources load securely over HTTPS.

Once fixed, regularly monitor your site after updates and content changes to maintain a secure experience for users and search engines alike.