WordPress Mixed Content Error After SSL: The Full Fix (2026)

Mixed content = the page is https but some resources still load http. You enabled SSL, but old image URLs, scripts, and fonts still hardcode http:// - the browser shows a warning instead of a clean padlock. Fix the root: update every internal URL, not just the site setting.

Step 1: Set WordPress URLs to HTTPS

Foundation first - wp-admin > Settings > General: both "WordPress Address (URL)" and "Site Address (URL)" must start with https://. If they're still http, every internal link WordPress generates defaults to insecure. If wp-admin is inaccessible, set them in wp-config.php:

Step 2: Find What's Actually Loading HTTP

Before mass-replacing, see the offenders. Open the flagged page in Chrome, F12 > Console - mixed content warnings list every http URL. Typical patterns:

• -Old uploads: http://yoursite.com/wp-content/uploads/... - search-replace fixes (step 3)
• -Hardcoded theme/plugin assets: http:// in CSS files, widget code, or theme templates - manual fix (step 4)
• -External resources: a third-party script or font loaded over http - update or remove it

For a site-wide scan, whynopadlock.com crawls a page and lists every insecure resource.

Step 3: Search-Replace the Database

The bulk fix - update every http://yourdomain.com URL in the database to https://. Use a serialization-safe tool: Better Search Replace plugin, or WP-CLI:

The --dry-run first shows how many replacements without changing anything. Never run a naive find-replace via SQL - WordPress stores serialized data that corrupts if you change the string length without updating the length field.

Step 4: Clean Hardcoded URLs in Files

Database clean but warnings persist? The URLs live in files, not the database. Check:

• -Theme files: header.php, footer.php, style.css for hardcoded http:// image or script URLs
• -Widgets and menus: manually-typed http:// links in Custom HTML widgets or customizer fields
• -External scripts: a font, analytics snippet, or social embed loaded over http - update the URL or remove the script

Step 5: Plugin Shortcut (If Database Edit Is Risky)

Not comfortable running search-replace? SSL Insecure Content Fixer or Really Simple SSL rewrites http asset URLs to https on the fly. Faster, doesn't touch the database - but it's a mask, not a cure. The correct fix is updating the URLs; the plugin just hides them. Use it as a bridge while you clean the database properly.

Step 6: Force HTTPS + Verify

Once URLs are clean, force the redirect so no visitor hits http accidentally. In .htaccess:

Then verify: browse a few pages, check the padlock, run the site through whynopadlock or the SSL Labs test. Clean padlock everywhere = done.

Related: redirect loop fix - 403 forbidden error - SSL certificates explained - security checklist.