6 Ways to Fix Mixed Content Warnings in WordPress

A mixed content warning occurs when a secure HTTPS page loads resources — such as images, scripts, or stylesheets — over an unencrypted HTTP connection. Browsers like Chrome and Firefox block or flag these insecure elements, breaking functionality and undermining visitor trust. Unlike a simple 404 error or a plugin conflict, mixed content is a protocol mismatch: your WordPress site says it's secure, but parts of it aren't.

If you see a padlock icon replaced by a "Not Secure" label in the address bar, or if certain page features stop working after switching to SSL, you're dealing with mixed content. The good news? Most fixes are straightforward and don't require developer-level skills. Below, we'll walk through six proven methods to identify and resolve mixed content warnings in WordPress, ordered from the simplest to the more advanced.

What exactly is mixed content, and why does it break my WordPress site?

Mixed content happens when an HTTPS webpage includes elements fetched via HTTP. Browsers interpret this as a security risk — an attacker could intercept the unencrypted resource and modify it. Two types exist:

• Active mixed content: Scripts, iframes, stylesheets, and other executable resources. Modern browsers block these outright, often breaking page layouts or interactive features.
• Passive mixed content: Images, videos, and audio files. Browsers typically load these but display a warning, which still scares visitors and hurts SEO rankings.

For WordPress site owners, the most common trigger is a site URL that still references HTTP in the database after an SSL certificate is installed. Other causes include hardcoded HTTP links in themes, plugins, or third-party embeds.

Key takeaways: Fixing mixed content warnings in WordPress

• Mixed content is an HTTPS/HTTP mismatch, not a plugin bug or hosting error.
• Always back up your site and database before making changes.
• The quickest fix is updating the Site URL and WordPress Address in Settings > General.
• Use a search-and-replace plugin (like Better Search Replace) to swap HTTP URLs in the database.
• Install an SSL plugin (like Really Simple SSL) to automate redirects and fix insecure links.
• For stubborn cases, manually edit the .htaccess file or add a filter to functions.php.
• Prevent future warnings by using relative URLs for media and checking third-party integrations for HTTPS support.

Before you start: Backup your site and database

Before making any changes, create a full backup of your WordPress files and database. A misstep — especially when editing the .htaccess file or running a database search and replace — can break your entire site. Use a plugin like UpdraftPlus or your hosting control panel's backup tool. If you're comfortable with phpMyAdmin, export the database manually. This safety net ensures you can restore everything if something goes wrong.

Common causes of mixed content in WordPress

• Site URL or WordPress Address still set to HTTP in Settings.
• Hardcoded HTTP links in theme files (header.php, footer.php).
• Insecure URLs in post or page content (images, embeds).
• Plugins or widgets that load resources from external HTTP sources.
• CDN or caching configurations that serve mixed content.
• Incomplete SSL certificate installation (site loads HTTPS but resources still use HTTP).

6 Ways to Fix Mixed Content Warnings in WordPress

1. Update your WordPress Address and Site URL

Go to Settings > General in your WordPress dashboard. Look for two fields: WordPress Address (URL) and Site Address (URL). If either starts with http://, change it to https://. Click Save Changes. This is often the fastest fix because it tells WordPress to generate all internal links using HTTPS.

After saving, clear your site cache and browser cache. Refresh the page and check the padlock icon. If the warning persists, move to the next method.

2. Run a database search and replace

Even after updating the site URLs in settings, old HTTP links may be stored in your database — inside post content, widget text, or custom fields. Install a free plugin like Better Search Replace. Navigate to Tools > Better Search Replace. Set "Search for" to http://yourdomain.com and "Replace with" to https://yourdomain.com. Select all tables and run the operation.

⚠️ Warning: Do not run a blanket search and replace on serialized data without a plugin that handles serialization (Better Search Replace does). If you use phpMyAdmin, use the safe search-and-replace script from Interconnectit instead of a raw SQL query.

After the replace, revisit your site. Most mixed content warnings should disappear. If not, proceed to the next step.

3. Use an SSL plugin to automate fixes

Plugins like Really Simple SSL or SSL Insecure Content Fixer can automatically detect and correct mixed content. Install and activate the plugin. Really Simple SSL, for example, will detect your SSL certificate and force HTTPS on all pages. It also adds filters that rewrite insecure resource URLs on the fly.

These plugins are ideal if you're not comfortable editing code. They handle .htaccess redirects, update site URLs, and fix many common insecure links. After activation, revisit a page with mixed content warnings and check the browser console.

4. Manually edit the .htaccess file

If your site still loads HTTP resources, you may need to force HTTPS at the server level. Access your site's root directory via FTP or cPanel File Manager. Locate the .htaccess file (create a backup first). Add the following code above the # BEGIN WordPress line:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

This snippet redirects all HTTP traffic to HTTPS. Save the file and test your site. If you see an infinite redirect loop, check that your SSL certificate is properly installed and that the site URLs in WordPress settings are already set to HTTPS.

5. Fix hardcoded HTTP links in theme files

Some themes hardcode URLs in PHP files, such as header.php or footer.php. Use a code editor or WordPress theme file editor (Appearance > Theme File Editor) to search for http:// in your active theme. Replace any instance that references your domain with https://. Alternatively, replace the full URL with a relative path like //yourdomain.com/image.jpg (protocol-relative URL).

If you're unsure which file contains the hardcoded link, use the "Search in Theme Files" feature of a plugin like WPCode or the Debug Bar. Test each change by viewing the affected page.

6. Check third-party resources and CDN settings

Mixed content can originate from external sources: embedded YouTube videos, Google Fonts loaded over HTTP, or CDN URLs that aren't updated to HTTPS. Open your browser's developer console (F12) and look for warnings about mixed content. The console will list the exact URL that's insecure.

For third-party services, update the embed code to use HTTPS. For CDNs like Cloudflare, ensure your SSL/TLS encryption mode is set to "Full" or "Full (strict)" and that the CDN URL in your plugin settings starts with HTTPS. If a resource doesn't support HTTPS, consider replacing it with a secure alternative.

How to prevent mixed content warnings in the future

Prevention starts with a consistent workflow. Always use relative URLs for internal links and media — for example, /wp-content/uploads/photo.jpg instead of http://yoursite.com/.... This way, the protocol adapts automatically when you switch to HTTPS.

When adding third-party content (embeds, scripts, fonts), verify they support HTTPS before pasting the code. Update your WordPress theme and plugins regularly, as developers often patch security issues. Finally, run a weekly site health check with tools like Why No Padlock? or SSL Labs to catch mixed content early.

Frequently Asked Questions

What is mixed content in WordPress?
Mixed content occurs when an HTTPS page loads resources (images, scripts, stylesheets) over HTTP, causing browsers to warn users or block the resources.

How do I find mixed content warnings on my site?
Open your browser's developer tools (F12), go to the Console tab. Look for messages like "Mixed Content" or "This page was loaded over HTTPS but requested an insecure resource." The console shows the exact URL causing the issue.

Can a plugin cause mixed content warnings?
Yes. Plugins that load external scripts, fonts, or widgets — especially sliders, social sharing buttons, and analytics tools — often hardcode HTTP URLs. Update the plugin or manually fix the URL in its settings.

Will fixing mixed content improve my SEO?
Yes. Google uses HTTPS as a ranking signal and flags pages with mixed content as less secure. Fixing warnings helps maintain your search ranking and visitor trust.

What if I can't fix mixed content after trying all methods?
Check your SSL certificate installation. A misconfigured or self-signed certificate can cause persistent warnings. Contact your hosting provider for assistance, or hire a WordPress developer for a thorough audit.

Final Thoughts

Mixed content warnings are a common but solvable issue for WordPress site owners. By following the six methods above — from simple settings updates to database changes and code edits — you can restore full HTTPS security and keep your visitors and search engines happy. Always back up your site before making changes, and test each fix in your browser's console.

Once your site is healthy and secure, consider automating your content publishing with a tool like nativeWP, which helps you bulk-generate and schedule SEO-optimized articles directly to WordPress. A secure site paired with consistent, high-quality content is the foundation of long-term online success.