What is mixed content?
Mixed content occurs when your website is loaded over HTTPS, while individual resources are still loaded over HTTP.
These resources can include:
Images
Fonts
CSS or JavaScript files
Content loaded by plugins or themes
External content such as maps, videos, or social media elements
This means the browser is loading both secure HTTPS content and insecure HTTP content on the same page.
⚠️ Mixed content doesn't necessarily mean there's a problem with your SSL certificate
Mixed content can occur even when your SSL certificate is valid if individual resources are still being loaded over HTTP.
How do I find the resource causing mixed content?
Mixed content warnings are displayed in your browser's developer tools.
Open the affected page and launch the developer tools. In the Console, look for messages containing Mixed Content.
How you open the developer tools varies depending on your browser. The warning will usually identify the resource that is still being loaded over HTTP.
For example, an affected URL might look like this:
http://yourdomain.com/wp-content/uploads/image.jpg
Example from the Brave developer console:
Make a note of the URL or resource shown in the warning. This tells you which content on your website is still being loaded over HTTP.
How do I fix a mixed content error?
First, you need to find out where the affected HTTP URL is being used on your website.
If the resource is also available over HTTPS, change the URL from:
http://yourdomain.com/...
to:
https://yourdomain.com/...
Only switch the URL to HTTPS if the resource is actually available over HTTPS.
For externally hosted content, the resource may not be available over HTTPS. In this case, remove the content or replace it with an alternative that supports HTTPS.
Can I fix mixed content with a plugin?
If multiple HTTP URLs are still stored in your WordPress database, you can use a plugin such as Better Search Replace by WP Engine to replace them.
⚠️ Create a backup before making any replacements
Better Search Replace makes changes to your WordPress database. Before using it, create a manual backup of your Box and carefully check which URL you are searching for and replacing.
Keep in mind that a database replacement only helps if the affected URL is actually stored in the database. If the HTTP resource is being loaded by a theme, plugin, or external embed, it needs to be corrected at the source instead.
With Better Search Replace, you can search for a specific HTTP URL and replace it with the corresponding HTTPS URL.
Example:
http://yourdomain.com ➡️ https://yourdomain.com
Where can an HTTP URL be stored?
An affected URL can be stored or embedded in different parts of your WordPress website, for example:
In pages or posts
In a page builder
In widgets or theme settings
In plugin settings
In custom CSS or JavaScript
Directly in theme or plugin files
In externally embedded content
Where you need to change the URL depends on where the affected resource is being loaded from
💡 Found the affected URL but don't know where to change it?
Making changes to website content, themes, plugins, or custom files is a web development task. In this case, contact your web agency, web developer, or the support team for the affected theme or plugin.
📚 Related articles
External resources: