Mixed content happens when a WordPress page loads over HTTPS but some images, scripts, stylesheets or other files still load over HTTP.
This can cause browser security warnings or stop parts of the page from loading correctly.
Before you start, make sure the domain has a valid SSL certificate.
- Log in to your WordPress admin area.
- Go to Settings > General.
- Check the WordPress Address and Site Address fields.
- Make sure both addresses start with
https://. - Save the changes if you had to update either address.
- Clear any WordPress, theme, plugin or server cache.
- Check the site again in a private browser window.
If the warning is still showing, old HTTP links may still be stored in the WordPress database.
You can usually fix this with a reputable SSL or search-and-replace plugin. Plugins such as Really Simple Security can help with SSL and mixed content, while search-and-replace plugins can update old http:// links stored in posts, pages and settings.
If you use a search-and-replace plugin, take a backup first. Search for the old HTTP version of your domain and replace it with the HTTPS version.
Example:
http://example.test
Replace with:
https://example.test
Use your real domain name rather than example.test.
If the mixed content warning remains, open the browser developer tools and check the Console tab. This can show which file is still loading over HTTP.
The remaining issue may come from a theme, plugin, page builder, embedded script or external service. If you are unsure, open a support ticket and include the page URL where the warning appears.