SSL troubleshooting
How to Fix Mixed Content Warnings
Your certificate is installed, but the padlock is missing or parts of the page are broken. Mixed content is the usual cause, and you can find and fix it in an afternoon.
What a mixed content error means
A mixed content error means an HTTPS page loads some of its resources, such as images, scripts or stylesheets, over plain HTTP. The certificate itself is fine. The page is only partly encrypted, so browsers upgrade, block or warn about the insecure parts.
It is the most common problem right after you install SSL, because old pages and templates still contain hard-coded http:// addresses. The fix is always the same: make every resource load over HTTPS.
Rule out the certificate first
Before you chase individual resources, confirm that your certificate, chain and covered names are correct for every hostname.
Run the SSL checkerWhat is mixed content?
Mixed content is an HTTPS page that requests resources over HTTP. Anyone on the network path could read or change those resources, which undermines the protection of the whole page.
Browsers split mixed content into two groups. As of October 2026, current browsers handle them as follows:
| Type | Older name | Examples | Browser behavior |
|---|---|---|---|
| Upgradable | Passive | Images (img src), CSS background images, audio, video | Request is upgraded to HTTPS; blocked if that fails |
| Blockable | Active | Scripts, stylesheets, iframes, web fonts, fetch() calls, images in srcset or picture | Blocked |
Upgrading only works if the other server offers the same file over HTTPS. If it does not, the image or video simply disappears from the page.
Why does my padlock disappear?
Your padlock disappears because the browser saw resources on the page that did not load securely. Passive content shown over HTTP, for example in an older browser or after a user unblocks it, replaces the padlock with a warning such as “Not secure”.
Active content behaves differently. Browsers block insecure scripts, stylesheets and iframes outright, so the padlock may remain while menus, layouts, forms or embeds stop working. Both cases send the same message to visitors: something on this page is not right.
Tip: If the padlock is missing on every page, including a blank test page, the problem is probably not mixed content. Check the certificate and look at our overview of SSL certificate errors.
How do I find mixed content?
Open the browser console
Load the page, press F12 (or Cmd+Option+I on a Mac) and open the Console tab. Each mixed content message names the insecure URL.
Check key templates
Repeat for the home page, a post or product page, a category page, checkout and forms. Templates share most resources.
Crawl the site
Use a site crawler that reports HTTP resources on HTTPS pages, so you catch pages you would not open by hand.
Search the source
Search theme files, configuration and the database for <code>http://</code> followed by your domain and common third-party hosts.
How to fix a mixed content error
Fix each insecure reference at its source: change it to HTTPS, serve the file from your own HTTPS domain, or remove it. Do not rely on browsers to upgrade requests for you, because blockable content is never upgraded automatically.
| What you find | Likely cause | Fix |
|---|---|---|
| Your own images over HTTP | Absolute http:// URLs in content | Search and replace with https:// or root-relative paths |
| Script or stylesheet blocked | Hard-coded URL in theme or template | Edit the template; load the file over HTTPS |
| Third-party widget blocked | Provider URL uses HTTP | Switch to the provider’s HTTPS URL, or replace the widget |
| Web font missing | @font-face points to HTTP | Update the CSS or host the font yourself |
| Form shows a warning | Form action posts to HTTP | Change the action URL to HTTPS |
As a safety net, you can send the Content Security Policy header upgrade-insecure-requests. It tells browsers to request every resource on the page over HTTPS, including scripts. It does not help if a resource is not available over HTTPS, so fix the source URLs as well.
If you are still in the middle of a migration, follow the full checklist to move from HTTP to HTTPS, including redirects and canonicals.
How do I fix it in WordPress?
In WordPress, set both addresses under Settings → General to https://, then run a search-replace on the database from your old HTTP address to the HTTPS address. Fix anything left in the theme or plugin settings by hand.
Most mixed content in WordPress sits in post content, widgets and page builder data stored with the old address. WP-CLI’s search-replace command handles serialized data correctly, which a plain SQL replace does not:
wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-runRemove --dry-run once the report looks right. Always back up the database first.
Plugins that rewrite http:// to https:// on every page load can hide the problem, but they add processing to each request and the old URLs stay in your database. Use them as a short-term bridge, not as the fix. For choosing and installing a certificate on WordPress, see our guide to SSL for WordPress.
Keep mixed content from coming back
New mixed content usually arrives with copied embed codes, old newsletter templates or a plugin update. Use root-relative or HTTPS URLs in new content, and recheck key templates in the console after theme changes. After each larger change, run the SSL checker together with your crawl to confirm the certificate side is still in order.
Before you call it fixed
Work through this short list after every round of changes. Clear all caches first, or you may still be looking at old pages.
- Page, plugin and CDN caches cleared
- Console shows no mixed content messages on key templates
- Padlock visible on home, content, product and checkout pages
- Crawl reports no HTTP resources on HTTPS pages
- Forms submit to HTTPS addresses
- Certificate valid for every hostname
Confirm your HTTPS setup
Once the console is clean, check the certificate, chain and hostnames from the outside to make sure visitors see a fully secure site.
Run the SSL checker