Quick answer
Mixed-content warnings happen when an HTTPS page loads some resources (images, scripts, styles) over insecure HTTP. Fix it by setting your WordPress and site URLs to HTTPS, updating hardcoded HTTP links in content and the database, ensuring themes and plugins load assets over HTTPS, and using a plugin or search-replace to catch the rest.
Key takeaways
- Mixed content means an HTTPS page is loading some assets over HTTP.
- Most fixes come down to updating old HTTP URLs to HTTPS.
- A database search-replace catches hardcoded links the settings miss.
You installed an SSL certificate, but the browser still says "not secure" and the padlock is missing. That's almost always mixed content — and it's usually a quick fix once you know where to look.
What mixed content means
Your page loads over HTTPS, but some resources on it — an image, a script, a stylesheet — still load over insecure HTTP. The browser flags the entire page as not fully secure until every asset is HTTPS.
Set your site URLs to HTTPS
In WordPress settings, make sure both the WordPress Address and Site Address use https://. This resolves the most common cases.
Update hardcoded HTTP links
Old content and theme files sometimes hardcode http:// URLs. A database search-replace (via a trusted plugin or tool) updates these across your content in one pass.
Check themes and plugins
Some load assets over HTTP by default. Your browser's developer console lists exactly which resources are the problem, so you can update or replace them.
Verify the padlock
After the fixes, reload and confirm the padlock appears with no warnings. A clean HTTPS lock reassures visitors and removes the "not secure" barrier to trust.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Because some resources on the page still load over HTTP. The browser flags the whole page as insecure until every asset loads over HTTPS.
Keep reading
How Much Does WordPress Maintenance Cost in the US?
What should ongoing WordPress care cost in the US? Here's a clear breakdown of typical pricing and what you actually get.
How to Update WordPress Without Breaking Your Site
Outdated software is the top cause of hacks — but updates can break things. Here's how to update WordPress safely.
How to Back Up a WordPress Site (the Right Way)
A good backup turns a disaster into a five-minute fix. Here's how to back up WordPress properly — files, database, and off-site.