Fix guide · WordPress

How to Fix Mixed Content Warnings in WordPress (2026)

Mixed content means your HTTPS page is loading resources (images, scripts, stylesheets) over HTTP. Browsers block many mixed content resources for security, which can break your site's appearance or functionality. Search engines prefer fully-HTTPS pages. This guide covers every common cause and the fastest fix for each.

Run a free check to confirm this is affecting your site

Why it matters

What this issue costs you

Browsers display a "Not Secure" warning or a padlock-with-warning icon when mixed content is present. Beyond user trust, Google has stated HTTPS is a ranking signal, and mixed content means your page isn't fully HTTPS. Fixing it is quick and high-impact.

Step-by-step

How to fix: Mixed content (HTTP on HTTPS)

WordPress

1
Step 1: Find the mixed content sources
Open your page in Chrome. Open DevTools (F12) → Console. Look for "Mixed Content" warnings — they list the exact URLs loaded over HTTP. Common sources: hardcoded image URLs in old posts, plugin assets, embedded widgets, or iframe sources.
2
Step 2: Install Really Simple SSL (quickest fix)
The Really Simple SSL plugin (free, 5M+ installs) automatically rewrites HTTP URLs to HTTPS in content and fixes the wp_options site URL. Go to Plugins → Add New → search "Really Simple SSL" → Install → Activate. It will detect your SSL certificate and prompt you to enable SSL. Review and accept.
3
Step 3: Update WordPress URLs in Settings
Go to Settings → General. Make sure both "WordPress Address (URL)" and "Site Address (URL)" start with https://. If they show http://, change them. This prevents WordPress from generating new HTTP URLs going forward.
4
Step 4: Replace http:// in the database (for old content)
Old post content often contains hardcoded http:// image URLs. Use the WP-CLI Search-Replace command (or a plugin like Better Search Replace) to update them:
WP-CLI
```
wp search-replace 'http://yoursite.com' 'https://yoursite.com' --all-tables
```

Verify the fix

Run the checker to confirm the issue is resolved

After applying the steps above, paste your URL below. Our checker will re-run every applicable check and show whether mixed content (http on https) still shows as a failing check.

FAQ

Common questions about mixed content (http on https)

Will fixing mixed content break any plugins or images?

Fixing mixed content should never break anything — you are only upgrading http:// to https://. If you see any breakage after the fix, it's likely a different issue (e.g., a resource that only exists over HTTP).

Really Simple SSL fixed most but not all mixed content. What's left?

Hard-coded external embeds (YouTube, third-party widgets) may still use HTTP. Check the Console and update each external URL manually, or ask the embed provider for an HTTPS URL.

Does mixed content affect my Google ranking?

Mixed content means Google may not count your page as fully HTTPS. Since HTTPS is a (minor) ranking signal and browsers display warnings to users, fixing it is worth the effort. It also eliminates the browser warning that erodes user trust.

While you're here