Mixed content warnings usually mean your WordPress site is loading over HTTPS, but one or more files on the page still use HTTP. The SSL certificate may be working, but the page is still calling old image, script, stylesheet, font, or embed URLs.
The safest way to fix mixed content is to confirm SSL first, take a backup, then update the actual HTTP sources.
Confirm SSL Works First
Before editing WordPress, open your website with https:// at the start.
Check:
- The homepage loads over HTTPS
- The browser does not show a certificate error
- The certificate matches the domain
- The WordPress dashboard is reachable
- Both
wwwand non-wwwversions behave as expected
If the certificate itself is not working, fix that before chasing mixed content. Mixed content is a page-resource problem, not the same as a missing or expired certificate.
Take a Backup
Mixed content fixes may involve WordPress settings, page content, plugin settings, or database updates. Take a backup before making broad changes.
A good WordPress backup should include files and the database. The database is especially relevant because WordPress stores page content, settings, and many URLs there.
If the site has ecommerce, booking, or membership activity, think carefully before restoring any older backup later because newer orders or submissions may be lost.
Check WordPress URL Settings
In WordPress, go to Settings > General and check:
- WordPress Address
- Site Address
After SSL is installed and working, these should usually start with https://.
Do not change these settings if you are unsure whether the HTTPS site works. A wrong value can lock you out or create redirect loops. If the fields are unavailable or controlled elsewhere, the setting may be managed in a configuration file.
Find the Mixed Content URLs
Use the browser console to find the exact HTTP resources.
In most browsers, you can right-click the page, choose Inspect, then open the Console tab. Mixed content warnings often show the file that was blocked or upgraded.
Look for URLs starting with http://.
Then identify where each URL comes from:
- Page content
- Media library
- Page builder settings
- Theme options
- Widget areas
- Menus
- Plugin settings
- Header or footer scripts
- Custom CSS
- CDN or cache settings
If every page shows the same warning, the source is probably global. If only one page shows it, start with that page’s content and settings.
Update Page and Media URLs
For a small number of issues, you may be able to edit the page directly.
Check:
- Images
- Buttons
- Background sections
- File downloads
- Embedded videos
- Maps
- Form embeds
- Linked styles or scripts
Replace old http:// URLs with https:// URLs where the secure version exists.
Do not change unrelated URLs just to make the page look tidy. Focus on resources actually loaded by the page.
Be Careful With Database Search and Replace
On older WordPress sites, HTTP URLs may be stored across many database entries. A search-and-replace tool can update them faster than manual editing, but it can also cause damage if used carelessly.
Before using any search-and-replace tool:
- Back up the site
- Confirm the exact old URL
- Confirm the exact new URL
- Include the correct
wwwor non-wwwversion - Run a preview or dry run if available
- Avoid changing unrelated third-party URLs
For example, replacing http://yourbusiness.ca with https://yourbusiness.ca is different from replacing every http:// string in the database.
Check Theme and Plugin Settings
Some mixed content comes from theme or plugin options instead of page content.
Check:
- Logo URL
- Favicon URL
- Background images
- Custom font settings
- Analytics scripts
- Header and footer code
- Slider images
- Form embeds
- CDN settings
If a plugin is loading old HTTP files, update the plugin and check its settings. If the plugin is abandoned, consider replacing it with a maintained alternative.
Clear Cache and Retest
After fixes, clear:
- WordPress cache
- Browser cache
- Hosting cache
- CDN cache
- Page builder cache
- Optimization plugin cache
Then test in a private browser window.
Check the homepage, contact page, forms, checkout pages, booking pages, and any page that previously showed a warning.
Do Not Hide the Warning
Some plugins can mask mixed content by rewriting URLs as the page loads. That may help temporarily, but it is better to fix the stored URLs and settings when possible.
If the underlying content still uses HTTP, the issue can return when plugins change, cache behaves differently, or the theme is updated.
A Practical Fix Order
- Confirm SSL works.
- Take a backup.
- Check WordPress Address and Site Address.
- Use the browser console to identify HTTP resources.
- Fix page, media, theme, or plugin sources.
- Use search and replace only when needed.
- Clear cache.
- Retest key pages.
If mixed content is tied to old WordPress settings, a managed SSL option can save time. You can explore Managed SSL Service through Tech Help Canada Hosting.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
We empower people to succeed through practical business information and essential services. If you’re looking for help with SEO, copywriting, or getting your online presence set up properly, you’re in the right place. If this piece helped, feel free to share it with someone who’d get value from it. Do you need help with something? Contact Us
Want a heads-up once a week whenever a new article drops?
