How to Fix Mixed Content on Your Website (HTTPS Warnings)
Mixed content is a secure page that loads something insecure: an image, script or font fetched over http:// while the page itself uses https://. Browsers either block the insecure part, so your page looks broken, or show a warning instead of the padlock. You fix it by changing every http:// address on the page to https://, which takes a search-and-replace on most sites.
Last reviewed: 10 November 2026, against current browser behaviour as documented by MDN.
Before you start
- A working SSL certificate. Mixed content only matters once the site loads over HTTPS. SSL certificate errors and "Not secure" warnings fixes that first.
- A backup. You are about to change content in bulk. What a weekly hosting backup can restore shows what is covered, and Plesk can take a fresh one.
What counts as mixed content?
| Type | Examples | What the browser does |
|---|---|---|
| Upgradable | Images, video, audio | Tries them over HTTPS automatically |
| Blockable | Scripts, stylesheets, iframes, fonts, data requests | Blocks them, so features and layout break |
Scripts are the riskiest: an attacker who changes one can change the whole page. That is why browsers block them.
How do you find the insecure items?
- Open the page over HTTPS in your browser.
- Open the developer console (press F12, or Cmd+Option+J in Chrome on a Mac). Each warning names the insecure address it found.
- Visit the pages that matter: the home page, a post, the checkout and the contact form. Mixed content is usually on a few templates.
- Search the source. In the page source, search for
http://. Each hit that is not a plain outbound link is a candidate.
An online mixed content checker or a crawler can scan the whole site, if it is large.
How do you fix it on WordPress?
- Check the addresses. In Settings > General, the WordPress Address and Site Address must both start with
https://. - Replace the old addresses in the database. Search for
http://yourdomain.comand replace it withhttps://yourdomain.com, using a tool that handles serialised data. WordPress search and replace: change URLs and text safely shows the steps, including the dry run. - Update the theme and plugins. Some hard-code
http://addresses. Update them, and replace any that cannot be fixed. How to bulk find and replace content in WordPress covers the editor route. - Clear every cache, in WordPress, any caching plugin and the browser.
- Reload the page and check the console again.
How do you fix it on any other website?
- Change
http://tohttps://in every address you control: images, scripts, stylesheets, fonts, forms and links. - Use relative addresses for your own files, such as
/images/logo.png, so the page always uses its own protocol. - Use the HTTPS address of any third-party item. Most services offer one. If a service has none, replace it.
- Upload the changed files and test again.
Can one setting fix it all?
Yes, as a stopgap. The upgrade-insecure-requests directive tells the browser to request every http:// item over HTTPS. On a site served by Apache, add this line to the .htaccess file in the website's folder:
Header always set Content-Security-Policy "upgrade-insecure-requests"
It only works for items that also exist over HTTPS, so it hides a problem rather than removing it. Fix the addresses, then remove the line if you like. If you are not sure how your site is served, open a ticket and we will check.
Troubleshooting
| Symptom | Fix |
|---|---|
| The console shows nothing but the padlock warns | Clear the cache and test in a private window |
| An image is missing | Its HTTPS address does not exist. Replace the image |
| Only the checkout warns | A payment or tracking script uses http://. Update the plugin |
| It returns after every edit | A theme option or layout plugin keeps the old address. Update its setting |
| A font or icon is missing | The stylesheet loads it from http://. Fix the stylesheet |
Need a hand?
Open a ticket in the console with the page address and the console messages, and we will point you to the fix.
Official Documentation Reference
- MDN: Mixed content: what browsers upgrade and block, and how to check a site.
- MDN: Content-Security-Policy upgrade-insecure-requests: the directive used above.
