How to fix WordPress mixed content warnings

What this problem looks like

Mixed content often appears after SSL is enabled but WordPress still stores http links in post content, widgets, and theme customiser fields. Page builders and old image URLs in the media library are frequent sources.

Fix certificates and redirects first, then hunt http strings. A database search-replace fixes bulk content, but hardcoded URLs in theme files need manual edits via File Manager, SFTP, or FTP.

Step 1: List blocked assets in browser DevTools

Load an https page, open DevTools → Console, and look for Mixed Content warnings. Each line names an http URL. Screenshot the list before you change anything.

Images in old posts and featured images.
CSS or JS from plugins with hardcoded http CDNs.
Background images in page builder sections.
Google Fonts or analytics scripts loaded insecurely.

Step 2: Confirm WordPress generates https links

In wp-admin go to Settings → General. Both URLs must use https://. If admin will not load, open wp-config.php in your site root, next to wp-admin and wp-content, and set these constants:

php

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Step 3: Search-replace http URLs safely

On staging or with backup, use WP-CLI dry-run first. These commands need SSH access to the server. If you only have a hosting control panel, use a trusted search-replace plugin with a dry-run option instead.

bash

wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run
wp search-replace 'http://example.com' 'https://example.com' --all-tables

Step 4: Fix theme and widget hardcoding

Search theme files for http:// via File Manager, SFTP, or FTP. Check Text widgets, Custom HTML blocks, and page builder global settings. Better Search Replace can target specific database tables if file edits are not enough.

Step 5: Clear all caches and verify

Purge host cache, optimisation plugin cache, and Cloudflare. Test checkout, forms, and login. Mixed content on cart pages can block payment scripts in strict browsers.

When to stop DIY and hire help

Large legacy sites with page builders and thousands of http URLs are tedious to fix by hand. BugShield resolves mixed content and SSL alignment at a confirmed fixed price.

Questions answered

WordPress mixed content warning FAQs

Answers about finding insecure assets, correcting stored URLs, clearing caches, and protecting HTTPS pages.

Why is mixed content still showing after SSL?

Old http URLs remain in the database and cached HTML. Search-replace content and purge every cache layer.

Will a mixed content plugin fix everything?

Plugins can rewrite output on the fly but do not fix stored http URLs. Correct the database and assets for a permanent fix.

Can I use // protocol-relative URLs?

Protocol-relative URLs are outdated. Use explicit https:// for all assets on modern sites.

Does mixed content hurt SEO?

Browsers may block resources, hurting user experience and trust signals. Google prefers fully secure pages.

How do I find mixed content on a WordPress page?

Open the browser Console and Network panels, reload the page over HTTPS, and record every HTTP image, stylesheet, script, font, iframe, or API request that is blocked or upgraded.

Can I search and replace HTTP URLs in the WordPress database?

Yes, but take a backup and use a WordPress-aware tool that preserves serialized data. Run a dry test for your exact domain before applying replacements.

Why does mixed content appear only for some visitors?

A CDN, page cache, browser cache, device-specific template, or logged-out page may still serve older HTTP URLs. Test in a private window after clearing every cache layer.

How do I fix mixed content from an external website?

Change the asset to an HTTPS URL if the provider supports it, host an authorised local copy, or remove the resource. Do not proxy unknown third-party scripts through your site.

Can mixed content break WooCommerce checkout?

Yes. Browsers may block insecure payment scripts, fonts, images, or API calls, leaving checkout controls incomplete or preventing the customer from submitting payment.

When should a developer fix WordPress mixed content?

Get help when thousands of stored URLs, page-builder data, custom theme files, or checkout scripts are involved and a broad replacement could damage live content.

Keep troubleshooting

Learn how to fix WordPress mixed content warnings.