Fix guide · HTTPS · medium

Mixed content on an HTTPS page

Mixed content means an HTTPS page loads some of its files (images, scripts, stylesheets, frames) over plain http://. Browsers block insecure scripts and styles outright, so parts of the page break, and the padlock warning tells visitors the page is not fully secure. Anything loaded over http:// can also be read or changed on the way.

Time to fix

15 minutes to an hour

Risk if ignored

Broken pages and tampered scripts

Breaks anything?

No. Fixing it un-breaks things

How to fix it

Open the page, press F12 and look at the Console. Every insecure file is listed:

Mixed Content: The page at 'https://yourdomain.com/' was loaded over HTTPS,
but requested an insecure image 'http://yourdomain.com/logo.png'.

Fix each URL at its source: change http:// to https:// (or make it relative, like /logo.png).

Most mixed content in WordPress is old http:// URLs stored in the database. With WP-CLI, after a backup:

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid --dry-run
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid

Also set Settings → General → WordPress Address and Site Address to https://. No WP-CLI? The Better Search Replace plugin does the same.

SSL/TLS → Edge Certificates:

Automatic HTTPS Rewrites: On

Cloudflare rewrites http:// links to https:// on the fly where the file exists over HTTPS. A safety net, not a replacement for fixing the source.

Tell browsers to upgrade every http:// request on the page automatically. nginx:

add_header Content-Security-Policy "upgrade-insecure-requests" always;

Apache: Header always set Content-Security-Policy "upgrade-insecure-requests". If you already send a CSP, add upgrade-insecure-requests to it instead of sending a second header.

Our scan checks the page's HTML. Run the console check on your other key pages (checkout, login, blog posts) too.

Check your fix

Common mistakes

Fixing the page but not the theme or CSS file, where background images often still use http://.
Linking a third-party file that has no HTTPS version. Host it yourself or remove it.
Running a database search-replace without a backup, or changing the guid column in WordPress.