Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMixed-content warnings appear when an HTTPS WordPress page still requests something over HTTP. Open the browser’s developer console to identify the exact request, test that URL with HTTPS, then correct the reference in WordPress, your theme or plugin, the database, or the third-party service that supplied it. Do not leave HTTP scripts, stylesheets, fonts or frames on an HTTPS page.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Make a backup and use staging before bulk edits. Set WordPress’s canonical URLs to HTTPS only after the certificate, HTTPS virtual host and redirect work correctly. Purge every cache layer and retest pages, forms and JavaScript after the change.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What mixed content means
A page loaded through https:// is expected to obtain its subresources through the same protected connection. Mixed content exists when that page asks for one or more resources at http://. The browser may block the request, upgrade some media automatically, or load it with a warning, depending on the resource type and browser.
MDN distinguishes between blockable active content and content that browsers may try to upgrade. The practical rule is stricter than the browser’s best effort: every resource should have a working HTTPS URL. MDN’s guidance is, “The best strategy to avoid issues with mixed content is to serve all the content as HTTPS.” Read the behavior details in MDN’s mixed-content documentation.
#1 Best Overall
| Resource in the page | Typical browser treatment | What you should do |
|---|---|---|
| JavaScript files | Usually blocked as active mixed content | Change the source to a working HTTPS URL or remove it |
| CSS stylesheets | Usually blocked; the page can lose its layout | Serve the stylesheet over HTTPS |
| Web fonts | Often blocked or refused by the browser | Use an HTTPS font endpoint and check cross-origin settings |
| Frames and embedded documents | Commonly blocked | Use an HTTPS embed URL or a provider’s secure embed code |
| Images, audio and video | Some are “upgradeable” and may be rewritten to HTTPS | Correct the stored URL anyway; an HTTP-only host will fail |
An auto-upgraded image can make a page look fixed while leaving a broken request, a console error or an insecure dependency elsewhere. Auto-upgrade is not a replacement for correcting the URL.
Why the padlock can be missing after SSL is enabled
Installing a certificate protects the connection to your server, but it does not rewrite URLs already stored in posts, widgets, theme files or plugin settings. A page can therefore be delivered by HTTPS while its HTML, CSS or JavaScript still points to an old HTTP address. Browsers then warn that the page is not fully secure, block functionality, or omit the normal lock indicator.
Free tools Windows power users keep installed
One-click scans. No signup required.
Mixed active content weakens the HTTPS security boundary. Someone able to interfere with the network could alter an HTTP script or stylesheet before it reaches the browser, even though the main document arrived over HTTPS. A failed image is inconvenient; a blocked login script, checkout script or form handler can be a functional and security problem.
Prepare before changing WordPress
First establish that HTTPS itself is healthy. WordPress recommends HTTPS to protect logins and visitors; its current guidance is at WordPress HTTPS documentation.
- Confirm the certificate is valid for the exact hostname visitors use, including the chosen
wwwor non-wwwform. - Confirm the HTTPS virtual host (or hosting configuration) serves the site and that an HTTP request redirects to the intended HTTPS canonical URL.
- Take a database and file backup. If possible, clone the site to staging and test the changes there first.
- Record the current URL format, active plugins, theme and any CDN or reverse-proxy layer. This makes it easier to identify which component generated a request.
Do not change WordPress’s URL settings merely to hide the warning. If the HTTPS server is not ready, changing those settings can make the dashboard and front end inaccessible.
Rank #2
Find the exact HTTP request
The browser console identifies the real cause faster than guessing from the padlock. Check an affected page while it is loaded over HTTPS.
- Open the page in a current browser and open Developer Tools (usually with F12 or the browser’s menu).
- Select Console. Reload the page with the console open. Look for messages containing “Mixed Content” and an
http://URL. - Select Network, reload again, and filter for
http://or inspect failed and blocked requests. Record the full URL, resource type, initiator and response status. - Open the same hostname by replacing
http://withhttps://. If the secure URL loads the expected resource, the reference can be changed. If it fails, the host may not support HTTPS, may redirect incorrectly, or may be HTTP-only. - Use the initiator or source location to determine whether the URL came from post content, a widget, a theme file, a plugin setting, a media field or generated HTML.
Repeat this process on more than the home page. A contact page, logged-in view, template-driven landing page and checkout can each enqueue different resources.
Set WordPress’s canonical URLs to HTTPS
Once the server and redirect are working, go to Settings > General in the WordPress dashboard. Change both WordPress Address (URL) and Site Address (URL) to the same HTTPS canonical address, then save.
These fields control the address of the WordPress installation and the public site. They do not repair every old URL in the database, nor do they convert third-party assets. If you cannot reach the dashboard after a mistaken change, restore the previous values through the supported configuration method for your host or from a backup, then correct the HTTPS server first.
After saving, sign out and back in, open the front end in a private window and inspect the source and console. Avoid changing one of the two fields to a different hostname unless you intentionally run WordPress and the public site at separate addresses.
Replace old URLs throughout the site
Search for the old HTTP form using a controlled, reversible process. A single URL can exist in several places, so fixing the first occurrence may not remove every warning.
Posts, pages and reusable content
Edit blocks, classic-editor HTML, reusable blocks, navigation menus, widget text and custom HTML fields that contain http://your-domain.example. Update image, audio, video, download and embed URLs to the exact HTTPS address. Inspect captions, background-image declarations and links hidden behind buttons; they are easy to miss in a visual editor.
Theme files and child-theme assets
Check the active theme and child theme for hard-coded URLs in CSS, JavaScript, template files and enqueue calls. A background image in a stylesheet can trigger a warning even when every image in the editor is correct. Prefer WordPress’s enqueue mechanisms and relative or site-aware URLs where the theme supports them, rather than embedding a fixed HTTP hostname.
Plugin settings and generated markup
Review settings for sliders, galleries, analytics, maps, forms, cookie tools, chat widgets and page builders. Some plugins store a URL in their own options and print it on every page. Update the setting to HTTPS, update the plugin if it has a secure configuration, or remove the feature if its provider has no HTTPS endpoint.
Recommended Free Tools
Media metadata and database records
Media attachment metadata, serialized options and builder-specific records can contain old URLs that do not appear in the editor. Use a search-and-replace tool that understands serialized data, and test it on staging. Make the replacement specific to your old site URL instead of replacing every occurrence of the string http://; unrelated external addresses may be intentionally different.
Rank #4
Run the operation in a transaction or in small batches when your tool supports it, keep the backup until verification is complete, and review a sample of changed records. A blind database replacement can corrupt serialized lengths or alter URLs that should not be migrated.
Handle external resources correctly
For a resource hosted outside your domain, test the provider’s HTTPS URL directly. If the same file, font or embed works at HTTPS, replace the HTTP reference in the plugin, theme or content that generated it. Where the provider offers a secure embed-code option, use that current code rather than editing only one attribute.
If the provider is HTTP-only, do not keep the dependency on an HTTPS page. Choose an HTTPS-capable replacement, self-host a resource when you have the right to do so and can maintain it, or remove the feature. Do not proxy an untrusted script through your own domain simply to make the warning disappear; that transfers the risk and creates a maintenance obligation.
- Scripts and stylesheets: never leave an HTTP version in production. They can be blocked and can alter the page.
- Fonts: use an HTTPS endpoint and verify that the server sends appropriate cross-origin headers for your domain.
- Frames: replace an HTTP embed with the provider’s secure embed URL; a frame can remain blocked even when the parent page is secure.
- Images and media: update the stored URL even if the browser currently upgrades it. Otherwise an HTTP-only host or a future browser policy can break it.
Use Content-Security-Policy only as a transition control
If legacy references remain while you complete the migration, the response header Content-Security-Policy: upgrade-insecure-requests tells supporting browsers to rewrite HTTP URLs to HTTPS before requesting them. Configure the header at the web server, CDN or reverse proxy according to your hosting setup.
Content-Security-Policy: upgrade-insecure-requestsThis directive cannot create an HTTPS service where none exists. An HTTP-only resource will fail after the rewrite, and active content can still be unavailable. It can also conceal the original source of a broken dependency during troubleshooting. Treat it as a temporary safety net while you correct stored URLs, and keep testing with the console open. The directive’s limitations are documented by MDN’s upgrade-insecure-requests reference.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Purge caches and check proxy behavior
WordPress may be fixed while visitors continue to receive old HTML or CSS from a page cache, object cache, CDN or reverse proxy. Purge or invalidate each layer after URL changes, then clear any separate browser cache used for testing.
Check that the proxy recognizes the original protocol correctly. A misconfigured TLS terminator can make WordPress think a request is HTTP and generate HTTP links, redirect loops or mixed URLs. Ensure the proxy forwards the appropriate protocol information and that WordPress, the cache and the origin agree on the HTTPS canonical host.
When you change a theme or plugin asset, purge its generated CSS and JavaScript as well as full-page HTML. A stale stylesheet containing one HTTP background image is enough to keep the warning alive.
Verify the repaired site
Verification should test behavior, not just the lock icon.
- Open a clean private-browser session and load representative pages over the final HTTPS URL.
- Keep Console and Network visible. Confirm there are no mixed-content errors, blocked scripts or failed upgraded requests.
- Exercise JavaScript interactions: menus, search, sliders, modal dialogs, login, registration, forms and any editor or upload workflow.
- Submit forms and test redirects, downloads, embedded media and payment or checkout flows in the appropriate test mode.
- Check both anonymous and logged-in views, mobile layouts and pages generated by custom templates or page builders.
- Run a crawler or site-wide link checker that can report
http://references in HTML, CSS and JavaScript. A browser check covers one rendered page; a crawler finds templates and URLs no visitor has opened yet. - Open Tools > Site Health and review the status and recommended improvements. WordPress explains the screen and its diagnostics at WordPress Site Health documentation.
Keep the backup until the crawl, functional tests and cache purge are complete. If a warning returns later, compare the new console URL with the original record; a plugin update, newly enabled widget or cache regeneration may have introduced it.
Common symptoms and targeted fixes
| Symptom | Likely source | Targeted response |
|---|---|---|
| The console names a script from your own domain | Old enqueue code, cached HTML or a plugin option | Update the enqueue or setting, purge caches and reload |
| Only the layout is broken | An HTTP stylesheet or font was blocked | Inspect Network for CSS and font requests, then switch each to HTTPS |
| Images appear, but the warning remains | Another resource is still HTTP, or an auto-upgrade failed | Review every console entry; do not assume visible images prove the page is clean |
| An external script fails only on HTTPS | The provider has no working HTTPS endpoint or blocks your origin | Use the provider’s secure URL, obtain a supported replacement or remove it |
| The dashboard redirects repeatedly | WordPress URL and proxy protocol disagree | Restore access from backup or host configuration, then align HTTPS settings and forwarded-protocol handling |
| The warning returns after a fix | Stale CDN/page cache or another template still contains HTTP | Purge all layers and run a site-wide crawl, including logged-in and special templates |
| A bulk replacement causes unusual formatting or errors | Serialized database data was edited unsafely | Restore the backup and repeat with a serialization-aware tool on staging |
Choose the remediation method deliberately
There is no single safe operation for every site. Match the method to the number of URLs, who controls the resource and how easily you can undo the change.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
| Method | Scope | Reversibility | Strength | Risk or limitation |
|---|---|---|---|---|
| Manual edit in one page or setting | One known reference | High | Easy to review and attribute | Slow and likely to miss duplicates |
| Controlled database search-and-replace | Many first-party records | High when staged and backed up | Efficient for a site-wide domain migration | Unsafe if serialized data or unrelated external URLs are handled blindly |
| Theme or plugin code correction | Generated resources | High when version-controlled | Stops the bad URL at its source | May be overwritten by an update unless maintained in a child theme or supported setting |
| Provider replacement or removal | Third-party resource | Depends on the integration | Removes an HTTP-only dependency permanently | Can require redesign or feature changes |
| CSP upgrade directive | Legacy references during migration | Easy to remove | Contains some accidental HTTP requests | Cannot make HTTP-only resources work and can hide the original failure |
Keep mixed content from returning
- Use HTTPS URLs whenever you add media, embeds, scripts, styles or fonts.
- Review plugin and theme changelogs and test newly generated markup after updates.
- Keep a staging copy for migrations and maintain a recent database and file backup.
- Include a representative HTTPS crawl in release testing, with the browser console checked for blocked or upgraded requests.
- Monitor CDN and reverse-proxy configuration after certificate renewals or infrastructure changes.
- Remove temporary CSP upgrade controls once every dependency has a confirmed HTTPS endpoint, or retain them only with an explicit monitoring plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
