How to Fix Mixed Content (HTTPS/SSL Errors)
WordPress Troubleshooting & Fixes
How to Fix Mixed Content (HTTPS/SSL Errors) in WordPress
After installing an SSL certificate, your site should load fully on HTTPS with a secure padlock. But sometimes images, scripts, CSS, or third-party files still load using HTTP—causing “Not Secure” warnings or broken layouts. This guide explains how to find and fix mixed content issues permanently.
1
What Is Mixed Content?
Your site loads on HTTPS, but some elements still load via HTTP.
Mixed content happens when your website loads secure (HTTPS) and insecure (HTTP) resources at the same time.
This usually affects:
- Images
- CSS files
- JavaScript files
- Fonts
- iFrames
- External scripts
Common symptoms:
- “Not Secure” warning in browser
- Broken padlock
- Images not loading
- Design layout broken
- Console errors:
Mixed Content: The site was loaded over HTTPS
2
Step 1: Turn On “Force HTTPS” in Your Hosting Panel
Some hosting providers handle HTTPS redirections automatically.
Enable HTTPS redirection:
- cPanel: Domains → Force HTTPS Redirect
- LiteSpeed Hosting: Force SSL via .htaccess
- SiteGround: SG Optimizer → HTTPS Enforce
- Hostinger: SSL → Force HTTPS
This fixes 50% of mixed content issues instantly.
3
Step 2: Update WordPress & Site URL to HTTPS
Your website URL must use HTTPS everywhere.
- Go to Settings → General
- Update these fields:
- WordPress Address (URL) → https://yourdomain.com
- Site Address (URL) → https://yourdomain.com
If these point to HTTP, mixed content is guaranteed.
4
Step 3: Fix Mixed Content Using a Plugin (Quickest Fix)
Plugins automatically rewrite insecure URLs.
Recommended plugins:
- Really Simple SSL (best & easiest)
- SSL Insecure Content Fixer
- Better Search Replace (manual replacement)
After activating Really Simple SSL:
- It automatically detects SSL
- Fixes mixed content links
- Adds necessary HTTP→HTTPS rewrites
This instantly resolves 80–90% of SSL/mixed content warnings.
5
Step 4: Manually Replace All HTTP URLs With HTTPS
Best for permanent fixing.
Use Better Search Replace plugin:
- Search: http://yourdomain.com
- Replace: https://yourdomain.com
Run on these tables:
- wp_posts
- wp_postmeta
- wp_options
- wp_woocommerce tables (if any)
This permanently updates all old HTTP URLs.
6
Step 5: Fix Mixed Content From External Scripts
Third-party scripts often load insecure resources.
Check your console log for errors like:
Mixed Content: The resource at http://example.com/script.js was loaded via HTTPFix by updating URLs for:
- Google Fonts
- FontAwesome
- Analytics scripts
- Ad scripts
- iFrame sources
- CDN URLs
Most providers support HTTPS—update URLs to https:// format.
7
Step 6: Regenerate Thumbnails & Replace Old Images
Old images may be stored with HTTP URLs.
If images still load via HTTP, regenerate thumbnails:
- Regenerate Thumbnails plugin
- ShortPixel / Smush with “Fix URL” feature
8
Step 7: Fix Mixed Content in Elementor
Elementor stores image URLs inside its JSON data.
Fix:
- Elementor → Tools → Replace URL
- Search: http://yourdomain.com
- Replace: https://yourdomain.com
This fixes header/footer builder, templates, and Elementor widgets.
9
Step 8: Clear All Cache Layers
Old cached files may continue loading HTTP resources.
Clear these:
- WordPress caching plugin
- Hosting cache (LiteSpeed, NGINX, Varnish)
- Cloudflare CDN cache
- Browser cache
- Elementor cache (Tools → Regenerate Files & Data)
10
Step 9: Add Forced SSL Rules to .htaccess (Optional)
Useful for incomplete redirection.
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
This ensures every request loads HTTPS only.
11
Step 10: Fix Mixed Content in WooCommerce
WooCommerce stores URLs in product metadata.
Fix WooCommerce pages:
- WooCommerce → Status → Tools → Clear Transients
- WooCommerce → Status → Tools → Regenerate Product Lookup Tables
- Update product image URLs manually if needed
Need a Fully SSL-Optimized Website?
All SiteCrafted ready-made websites include SSL setup, HTTPS configuration, CDN integration, and complete mixed content removal for a 100% secure site.
