How to Fix Mixed Content Warnings After Switching to HTTPS

You have installed an SSL certificate and your website opens with https://, but the browser still shows a warning or the padlock is missing. The most common reason is mixed content.

What is mixed content?

Mixed content happens when a secure HTTPS page loads some resources, such as images, stylesheets, scripts, fonts or embedded videos, over insecure HTTP. Browsers treat this as a risk because those resources could be intercepted or modified.

• Passive mixed content such as images may still load, but the padlock may disappear or show a warning.
• Active mixed content such as scripts and stylesheets is usually blocked, which can break layouts, menus or forms.

Step 1: Find the insecure resources

1. Open the affected page in Chrome, Edge or Firefox.
2. Right-click and choose Inspect, then open the Console tab.
3. Reload the page. Mixed content warnings list each insecure URL.

You can also view the page source and search for http://.

Step 2: Update your site address (WordPress)

In WordPress, go to Settings → General and make sure both WordPress Address and Site Address begin with https://. Save your changes and log in again if prompted.

Step 3: Replace old HTTP links in your content

Older posts and pages often contain image and link URLs saved with http://. Options to fix them include:

• A search-and-replace tool: replace http://yourdomain.com with https://yourdomain.com across the database. Take a full backup first, and use a tool that handles WordPress serialized data correctly.
• Manual edits: for small sites, update affected pages in the editor.

Step 4: Check your theme and plugins

Some themes and plugins contain hard-coded HTTP links in settings or files. Check:

• Logo, background and header image settings in the Customizer
• Widgets and custom HTML blocks
• Page builder sections
• Custom CSS containing url(http://...)

Update these to HTTPS, or replace outdated themes and plugins that keep inserting insecure links.

Step 5: Fix third-party resources

Embedded maps, videos, fonts, analytics and chat widgets should all use HTTPS URLs. Most providers support HTTPS; update the embed code to the secure version. Remove any service that does not support HTTPS.

Step 6: Clear caches and re-test

Clear your caching plugin, server cache, CDN cache and browser cache, then reload the page and check the console again.

Should you use a plugin that fixes mixed content automatically?

Plugins that rewrite HTTP links on the fly can be a quick temporary fix, but they add processing to every page load. It is better to fix the source URLs properly, then remove the plugin.

Prevent mixed content in future

• Always upload images through the WordPress media library rather than pasting external HTTP links.
• Use HTTPS in all embed codes.
• Set up a site-wide HTTPS redirect.

Final thoughts

Mixed content is one of the most common issues after moving to HTTPS, and it is usually straightforward to fix. Once every resource loads securely, the padlock returns and your visitors are fully protected.