Fix Mixed Content After Moving WordPress to HTTPS

You installed an SSL certificate, but the browser still shows “Not secure”, a padlock with a warning, or some images and styles are missing. That is a mixed content problem: the page loads over HTTPS, but some files inside it still load over plain HTTP, and browsers block or flag them.

Mixed content hurts trust, can break layouts and forms, and affects SEO. Here is how to find every insecure link and fix it properly.

Step 1: Confirm your SSL certificate works

Open https://yourdomain.com and click the padlock or site information icon. The certificate should be valid, issued for your exact domain, and not expired. Check both www and non-www versions. Most hosts offer free Let’s Encrypt certificates that renew automatically. Make sure yours covers both addresses.

Step 2: Set WordPress to use HTTPS

In wp-admin, go to Settings → General and change both WordPress Address (URL) and Site Address (URL) to start with https://. Save, and log in again if asked.

If the fields are greyed out, they are set in wp-config.php with WP_HOME and WP_SITEURL. Update them there.

Step 3: Replace old HTTP links in the database

Your posts, pages, widgets, page builder layouts, and theme settings still contain hard-coded http:// links to images and pages. Replace them with a database-aware search and replace tool, which handles serialized data correctly:

• With a plugin such as Better Search Replace, search for http://yourdomain.com and replace with https://yourdomain.com. Run a dry run first to see how many changes it would make.
• With WP-CLI: wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables --dry-run, then run it again without --dry-run.

Do not run a plain SQL REPLACE query on serialized data. It corrupts page builder and widget settings.

If you use Elementor, also go to Elementor → Tools → Replace URL, then Regenerate Files & Data.

Step 4: Find the remaining insecure files

Open a page that still shows a warning, press F12, and look at the Console tab. Each mixed content warning names the exact URL loading over HTTP. Typical leftovers:

• Images or fonts hard-coded in the theme’s CSS or template files
• Scripts from third-party services (old embeds, chat widgets, tracking codes) using http://
• Custom HTML widgets and header or footer code snippets
• Links inside your theme customizer settings

Change each to https://. If an external service does not support HTTPS at all, replace or remove it.

Step 5: Redirect all HTTP traffic to HTTPS

Visitors and search engines that use old http:// links should be sent to the secure version with a permanent 301 redirect. Many hosts have a “Force HTTPS” switch in the control panel. On Apache or LiteSpeed you can add this to the top of .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

Use only one method. Two different redirect systems can create a redirect loop. If that happens, see our guide to the WordPress login redirect loop.

Step 6: Clear caches and check again

Purge your caching plugin, server cache, and CDN, then reload the page in a private window. The padlock should be clean on every page you test: homepage, a post, a product page, and your contact and checkout pages.

Step 7: Tell search engines

• In Google Search Console, add the https:// version (or use a domain property, which covers both) and submit your sitemap.
• Update your site address in Google Business Profile, social profiles, and email signatures.
• Optionally add an HSTS header once everything works, so browsers always use HTTPS.

Frequently asked questions

Is a “Really Simple SSL” type plugin enough?

These plugins can fix many links on the fly, but they rewrite content on every page load. Fixing the links in the database once is cleaner and faster. Some sites use both: the database fix, plus the plugin for edge cases.

Does mixed content affect SEO?

HTTPS is a ranking signal, and “Not secure” warnings lower trust and conversions. Blocked scripts can also break forms and checkout, which costs more than rankings.

Why do some images still load over HTTP after the search and replace?

They are probably hard-coded in theme files, CSS, or third-party embeds, which a database search does not touch. The browser console lists them.