Fix Mixed Content on HTTPS Websites: Complete Guide

You installed an SSL certificate, but the browser still shows an incomplete or warning padlock icon? That's Mixed Content — the most common issue after migrating a site from HTTP to HTTPS. This guide explains what mixed content is, how to detect it, and how to fix it completely for both WordPress and non-WordPress sites.

What is Mixed Content?

Mixed content occurs when an HTTPS page loads some resources — images, scripts, CSS, or iframes — over HTTP (without the S). Modern browsers block or warn users about these resources because HTTP content on an HTTPS page is a security risk.

There are two types of mixed content:

• Mixed Passive Content — Images, video, audio loaded over HTTP. Browsers show a warning but still load them.
• Mixed Active Content — Scripts, CSS, iframes loaded over HTTP. Browsers block these entirely — they're significantly more dangerous.

How to Detect Mixed Content

1. Browser Developer Tools

Press F12 → Console and look for warnings starting with "Mixed Content" or "Blocked loading mixed-content". These messages include the exact URL of the problematic resource.

2. Online Tools

Use tools like Why No Padlock (whynopadlock.com) or JitBit SSL Check to scan your page and list all mixed content URLs in one click.

3. Database Search (WordPress)

Fixing Mixed Content in WordPress

Method 1: Really Simple SSL Plugin

The easiest method for WordPress. The Really Simple SSL plugin automatically handles mixed content by:

• Adding HTTP Strict Transport Security (HSTS) headers
• Setting up HTTP → HTTPS redirects via .htaccess
• Fixing URLs in content dynamically via PHP output buffering

Method 2: Update WordPress URLs in Settings

Go to Settings → General and change both WordPress Address and Site Address from http:// to https://

Method 3: Database Search-Replace

Use the Better Search Replace plugin or WP-CLI to replace http://yourdomain.com with https://yourdomain.com across the entire database:

Fixing Mixed Content on Non-WordPress Sites

1. Use Protocol-Relative URLs

2. Content Security Policy: upgrade-insecure-requests

Add this header via .htaccess to make browsers automatically upgrade HTTP to HTTPS:

Or in HTML head:

3. Fix URLs Directly in Source Code

Preventing Future Mixed Content

• Always use relative or protocol-relative URLs when adding new resources
• Set up HTTP → HTTPS redirect in .htaccess
• Add HSTS header so browsers always remember to use HTTPS
• Check for mixed content every time you add new content or install a plugin

Setting Up HSTS for Long-Term Mixed Content Prevention

HTTP Strict Transport Security (HSTS) is a response header that instructs browsers to always connect to your site using HTTPS. Once a browser receives the HSTS header, it will automatically upgrade all future HTTP requests to HTTPS for the duration of the max-age period — without waiting for a server-side redirect. This closes the window where a first-request HTTP connection could be intercepted.

Add HSTS to your .htaccess file:

Understanding each directive:

• max-age=31536000 — browser remembers HSTS for 1 year (31,536,000 seconds)
• includeSubDomains — applies to all subdomains as well (e.g., blog.yourdomain.com)
• preload — qualifies your site for the HSTS Preload List maintained by browsers (register separately at hstspreload.org)

Advanced Mixed Content Detection Methods

Beyond browser dev tools and basic online scanners, these methods give you broader coverage across multi-page websites:

Crawl with Screaming Frog or Sitebulb

Desktop crawler tools can spider every URL on your site and flag mixed content resources automatically. They export results as CSV so you can fix URLs in bulk — especially useful for large sites with hundreds of pages.

Check Google Search Console Security Issues

Google Search Console reports security issues, including mixed content detected by Googlebot during crawls. Navigate to Security & Manual Actions → Security Issues for a list of affected pages and resource URLs.

Server-Side grep via SSH

If you have SSH access, search your codebase directly for hardcoded HTTP URLs:

Mixed Content, Core Web Vitals, and SEO Impact

Mixed content is not just a security issue — it directly affects Core Web Vitals and search rankings. When a browser blocks mixed active content, scripts that control interactivity fail silently, raising Interaction to Next Paint (INP) scores. Blocked stylesheets can also cause layout shifts, increasing Cumulative Layout Shift (CLS). Both are Google ranking signals.

Google's indexing pipeline also evaluates page trustworthiness as part of E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). A page displaying browser security warnings consistently signals low trustworthiness — which can suppress organic rankings over time even without a manual penalty.