Table of Contents
Mixed content happens when a page loaded securely over https:// still tries to pull in an image, script, or stylesheet over the old unencrypted http://. Browsers flag this because it undermines the whole point of the padlock, even though the certificate itself is installed correctly.
Why it happens
Most sites accumulate http:// links over time — in old blog posts, theme files, widgets, or database entries — from before SSL was installed. Switching the site to https:// doesn't automatically update those old references.
1. Find the mixed content
Open your site in Chrome, right-click and choose Inspect, then go to the Console tab and reload the page. Any mixed content warnings will list the exact http:// URLs the browser blocked or flagged, which tells you precisely what to fix.
2. Fix database references (WordPress)
Old image URLs and links stored in your posts and pages are the most common culprit. A plugin like Better Search Replace lets you find every instance of "http://yourdomain.com" in the database and replace it with "https://yourdomain.com" in one pass — always back up your database first.
3. Fix hardcoded theme files
Check your theme's header.php and functions.php for hardcoded http:// links to scripts, fonts, or stylesheets, and update them to https:// or to protocol-relative URLs (starting with // instead of http://).
4. Check external embeds
Old YouTube embeds, ad scripts, or third-party widgets sometimes still use an http:// embed code from years ago — replace these with the current https:// version from the provider's own site.
5. Use a plugin as a shortcut
Really Simple SSL and similar plugins include an automatic mixed-content fixer that rewrites http:// resource URLs to https:// on the fly, without you needing to manually hunt down every instance — a good safety net alongside the manual fixes above.
6. Clear your cache
After making changes, clear both your WordPress caching plugin's cache and your browser cache — old cached pages can keep showing the mixed content warning even after the underlying issue is fixed.
Key takeaway: Mixed content is almost always old http:// references left over from before SSL was installed, not a problem with the certificate itself — the browser console will tell you exactly which resources to fix.