7 Steps to Fix Mixed Content Errors

Mixed content errors are what’s causing your browser to show a security warning even though you’ve already installed an SSL certificate. You did everything right — your site loads over HTTPS, the certificate is valid — and yet the padlock icon still shows a triangle, an exclamation point, or a “Not Secure” label instead of the clean lock you expected. We touched on SSL certificates generally in our original SSL post; this one walks through exactly what mixed content errors are and seven concrete steps to fix them for good.

What Are Mixed Content Errors?

Mixed content errors happen when a page loaded over HTTPS references resources — images, scripts, stylesheets, iframes — that load over plain, unencrypted HTTP instead. The page itself is secure, but pieces of it aren’t, which defeats part of the purpose of having HTTPS at all. Browsers flag mixed content errors because a single unencrypted resource on an otherwise secure page creates a real security gap — that unencrypted request can be intercepted or tampered with, even though the rest of the page is protected.

There are two categories of mixed content errors, and browsers treat them differently:

• Passive mixed content errors — images, video, and audio loaded over HTTP. Lower risk, since these can’t directly manipulate the page. Browsers typically still load these but flag the page as not fully secure.
• Active mixed content errors — scripts, stylesheets, iframes, and fonts loaded over HTTP. Higher risk, because these can modify page behavior or content. Most modern browsers block active mixed content outright rather than just warning about it, which can cause visible functionality to break.

Why Mixed Content Errors Happen So Often After an SSL Migration

The most common cause of mixed content errors: a site that existed before SSL was added, with years of content — blog posts, page builders, widget configurations — containing hardcoded http:// URLs pointing to images and other assets. When SSL gets added, the page itself starts loading over HTTPS, but none of that old embedded content automatically updates. The database still says http:// everywhere those references were saved.

Mixed content errors also happen with third-party embeds — an old YouTube embed code, a widget from a service that hasn’t updated its own HTTPS support, a CDN reference that was configured before your site had SSL.

Step 1: Find Your Mixed Content Errors in the Browser Console

The fastest way to locate mixed content errors: open your site in Chrome, right-click anywhere on the page, and select Inspect. Click the Console tab. Reload the page. Any mixed content errors will appear as warnings in the console, each one specifying the exact URL of the offending resource.

Step 2: Scan Your Whole Site for Mixed Content Errors

For a full-site scan rather than checking page by page, WhyNoPadlock is a free tool built specifically for finding mixed content errors — paste in your URL and it lists every issue found on that page with the exact offending resource.

Step 3: Run a Database Search and Replace

Before running any database-wide change, it’s worth taking a quick database backup first — covered in our post on cPanel backups — so you have a clean rollback point if anything looks off afterward.

If your mixed content errors are coming from hardcoded http:// URLs scattered through years of post content, the most efficient fix is a database-level find-and-replace. Better Search Replace is the standard tool for resolving this category of mixed content errors.

1. Install and activate Better Search Replace
2. Go to Tools → Better Search Replace
3. In “Search for,” enter http://yourdomain.com
4. In “Replace with,” enter https://yourdomain.com
5. Select all tables (or at minimum wp_posts and wp_postmeta)
6. Run a dry run first to see how many replacements would be made before committing
7. Once confirmed, uncheck dry run and execute

Step 4: Confirm Your WordPress Address Settings

Go to Settings → General and confirm both the WordPress Address (URL) and Site Address (URL) fields start with https://. If either still shows http://, update it and save — a mismatch here can itself generate mixed content errors sitewide.

Step 5: Fix Third-Party Embeds Manually

Search and replace only fixes references to your own domain. If mixed content errors are coming from an external service — an old embed code, a widget, a CDN reference — you’ll need to manually update or replace that specific embed with its HTTPS equivalent, or remove it if the service no longer supports HTTPS at all.

Step 6: Add a Content Security Policy as a Backstop

For sites that want a more aggressive, automated fix, a Content Security Policy header can be configured to automatically upgrade insecure requests to HTTPS rather than blocking them. Adding this to your .htaccess file:

Header always set Content-Security-Policy "upgrade-insecure-requests"

This tells the browser to automatically rewrite any http:// resource requests on the page to https:// before loading them. It’s a useful safety net against mixed content errors, but it’s not a substitute for actually fixing the underlying references — treat it as a backstop, not the primary fix.

Step 7: Re-Scan to Confirm Your Mixed Content Errors Are Gone

After completing the steps above, run WhyNoPadlock or check the browser console again. A clean result with zero warnings confirms your mixed content errors are resolved and your padlock should display cleanly.

Frequently Asked Questions About Mixed Content Errors

Will mixed content errors hurt my SEO?

Indirectly, yes. Google has confirmed HTTPS is a ranking signal, and a page showing security warnings creates a poor user experience that can affect engagement metrics, which do factor into rankings. Fixing mixed content errors is worth it for trust and conversion reasons even beyond the direct SEO impact.

Why do I still see mixed content errors after running search and replace?

Usually because the remaining mixed content errors are coming from a source outside your database — a theme file with a hardcoded HTTP reference, a plugin generating HTTP URLs dynamically, or a third-party embed. Check the browser console again after your search and replace to identify what’s left.

Can mixed content errors break my site’s functionality, not just show a warning?

Yes — active mixed content is often blocked outright by modern browsers rather than just flagged. If a blocked script was responsible for a feature on your page, that feature will visibly stop working, not just show a security warning.

The short version: Mixed content errors happen when an HTTPS page loads some resources over plain HTTP — usually leftover from before SSL was added. Find them with the browser console or WhyNoPadlock, fix hardcoded references with a database search and replace, confirm your WordPress address settings are HTTPS, manually update third-party embeds, and consider a Content Security Policy as a backstop. If you’re stuck on a mixed content error you can’t resolve, open a support ticket and we’ll help track it down.