Mixed Content Warning: How to Fix It on HTTPS Sites

This guide shows you how to find every insecure resource on an HTTPS page and fix it, with a step by step path for WordPress. A mixed content warning fix almost always comes down to the same job: replacing http:// links to images, scripts, styles and iframes with https:// versions, then making sure no new ones sneak back in.

What causes a mixed content warning?

A mixed content warning appears when a page loads over HTTPS but some of its resources, such as images, scripts, stylesheets or iframes, load over plain HTTP. The page itself is encrypted, but those parts are not, so the browser warns the visitor or blocks the insecure files.

web.dev’s explainer What is mixed content? splits it into two types. Passive mixed content covers images, video and audio, which cannot change the rest of the page but can still be swapped or used to track visitors. Active mixed content covers scripts, stylesheets, iframes and other code that can change the whole page, which is why most browsers block it by default.

The most common sources I find in audits:

• Images inserted into old posts before the site moved to HTTPS, with full http:// URLs saved in the database.
• Theme options and page builder settings that store a logo or background image with an http:// URL.
• Hard coded script or font links in a child theme’s header file.
• Third party embeds, widgets or ad scripts that still use http://.
• CSS files that reference background images or fonts with absolute http:// URLs.

Does mixed content affect SEO?

Mixed content affects SEO indirectly: Google does not list mixed content as a separate ranking factor, but blocked resources can break how your page looks and works, and browser warnings reduce trust. Google does recommend serving sites over HTTPS, and a site with mixed content has not fully finished that job.

The practical damage is often bigger than the warning itself. A blocked stylesheet can leave a page unstyled. A blocked script can break a menu, a form or a checkout. A blocked image may simply not appear. If Google renders the page and key resources are blocked, what it sees may not match what you intended. And visitors who notice a missing padlock or a broken layout leave.

How do you find mixed content on your site?

You find mixed content by checking the browser console page by page, searching your code and database for http://, and using a crawler for the whole site. web.dev’s guide to fixing mixed content starts with the console, because Chrome reports mixed content there as errors and warnings.

1. Open DevTools on a page. Check the Console and Issues tabs for mixed content messages. Each one names the insecure URL.
2. Repeat on each template. The console only covers the page you are viewing, so test the homepage, a post, a page, a category and a product.
3. Crawl the site. A crawler that reports insecure resources on HTTPS pages finds old posts you would never check by hand.
4. Search the source. Search theme files, plugin settings and the database for http:// followed by your own domain and common third party domains.
5. Collect reports at scale. For large sites, a Content-Security-Policy-Report-Only header lets browsers send reports of insecure requests without blocking anything.

How do I fix mixed content in WordPress?

To fix mixed content in WordPress, set both site addresses to https, replace old http:// URLs in the database, then fix any hard coded links in the theme, plugins and widgets. Take a full backup before you start.

1. Update the site URLs. In Settings, General, set both WordPress Address and Site Address to the https version.
2. Search and replace the database. Use a search and replace tool, such as WP-CLI’s search-replace command or a reputable plugin, to change http://yourdomain.com to https://yourdomain.com. Run it as a dry run first. These tools handle serialized data that a raw SQL query can break.
3. Check theme and builder settings. Logos, background images and custom code areas often keep old URLs outside normal post content.
4. Check theme files. Look in header.php, footer.php and functions.php of your child theme for http:// links to scripts and fonts.
5. Fix third party resources. Change embeds and scripts to https. If a provider has no HTTPS version, replace or remove it.
6. Clear every cache. Purge the page cache, any CDN cache and minified file caches, then retest.

Plugins that rewrite URLs on the fly can hide the problem, but they add work to every page load and the old URLs stay in your database. A real search and replace is the cleaner fix. If your site needs more than a patch, my WordPress website design service rebuilds on HTTPS from day one.

What does upgrade-insecure-requests do?

The upgrade-insecure-requests directive tells the browser to request every http:// resource on the page over https:// instead, before sending the request. You add it as a Content-Security-Policy response header or as a meta tag in the head.

It is a useful safety net, but not a replacement for fixing URLs. If a resource has no HTTPS version, the upgraded request fails and the resource does not load. Use it after cleaning up, to catch anything you missed, and keep checking the console. Also update ordinary links in a tags to https, so visitors and Google do not pass through a redirect every time they click.

What does a mixed content fix look like on a real site?

Add a mixed content check to every audit with my free SEO audit checklist. If you are moving a site to HTTPS or a new domain, my website redesign service handles the redirects and URL cleanup, and my technical SEO service can fix mixed content and related crawl issues on your current site.

Frequently asked questions