Skip to content
Website Rescue Rescue

SSL and HTTPS Problems

Mixed Content Warning

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

Mixed content means an HTTPS page is still requesting images, scripts, stylesheets, or iframes over plain HTTP — browsers warn, block active content, or weaken the padlock until those URLs are https or relative. Fix leftover http:// asset URLs in content, builders, and CDN settings; do not ignore console blocks on checkout or login.

A valid certificate is not enough if the HTML still pulls insecure assets. Mixed content is common after migrations, Elementor/Divi URL leftovers, and CDN misconfiguration. This guide shows how to find blocked requests in DevTools and replace them safely without breaking serialized WordPress data.

Intermediate

What the error means

Browsers treat an HTTPS document as a secure context. Passive mixed content (images, video, audio) may display with warnings; active mixed content (scripts, stylesheets, iframes, XHR in older models) is usually blocked outright, breaking layout and functionality. WordPress stores many absolute URLs in posts, postmeta, theme mods, and builder JSON — so installing SSL without a careful search-replace leaves http:// references behind. Page builders regenerate CSS that can reintroduce old hosts. CDNs and “flexible” SSL modes sometimes serve HTTPS to visitors while origin or asset hostnames still emit HTTP links.

Common symptoms

  • Padlock shows a warning, “Not secure,” or “connection is not fully secure”
  • DevTools Console reports mixed content blocked or upgraded requests
  • Images missing, icons broken, or CSS/JS failing only on https:// pages
  • Homepage padlock OK but inner builder pages warn
  • Problem started after enabling SSL, migrating hosts, or changing domain
  • HTTP site looks fine; HTTPS shows broken assets
  • Checkout or forms behave oddly when scripts are blocked as active mixed content

Most likely causes

  1. 01 Post content and media URLs still stored as http:// after SSL
  2. 02 Elementor, Divi, or other builder CSS/JSON with hardcoded HTTP asset paths
  3. 03 Theme customizer, widgets, or custom CSS using absolute http:// backgrounds
  4. 04 CDN or image host serving HTTP links while the page is HTTPS
  5. 05 siteurl/home fixed to https but serialized meta still contains old HTTP
  6. 06 Third-party embeds (maps, videos, iframes) hard-coded to http://
  7. 07 Cache or CDN still serving old HTML that references HTTP assets

What changed before the problem started

  • SSL installed or Let’s Encrypt / AutoSSL renewed and HTTPS forced
  • Domain change, www vs apex switch, or host migration
  • Builder CSS regenerated or theme updated with old URLs
  • CDN enabled or SSL mode changed (especially Flexible vs Full)
  • Content import from an HTTP staging or backup site
  • New plugin embedding external HTTP resources

Troubleshooting steps

  1. 01

    Confirm mixed content versus a bad certificate

    Open the page on https:// and check DevTools → Console for mixed content messages. If the browser shows a hard certificate error interstitial, fix SSL first — mixed content repairs will not help an invalid cert. Screenshot the blocked URLs; they name the exact assets to replace.

  2. 02

    Set WordPress Address and Site Address to https

    In Settings → General (or `siteurl` / `home` in the database), both URLs must use https:// and the canonical host visitors use. Then enable a single HTTP→HTTPS redirect at the host or CDN. Avoid stacking multiple force-SSL plugins that fight each other.

  3. 03

    Replace HTTP URLs with a serialization-safe tool

    Use a trusted search-replace that understands PHP serialized data (WP-CLI `search-replace`, or a reputable migration plugin) from `http://yourdomain` to `https://yourdomain`. Never run a naive SQL REPLACE on serialized strings — it corrupts lengths and can take the site down.

  4. 04

    Regenerate builder CSS and clear caches

    After URL fixes, regenerate Elementor/Divi/other builder CSS and purge all page, CDN, and browser caches. Retest the pages that previously warned; builders often keep HTTP in generated files until regenerated.

  5. 05

    Fix remaining console offenders one by one

    Any leftover http:// script, stylesheet, or iframe in the Console must be updated to https, a protocol-relative URL only when the host supports HTTPS, or removed. Prefer root-relative paths (`/wp-content/...`) for same-site assets when editing templates.

  6. 06

    Align CDN and SSL end-to-end

    If a CDN proxies the site, prefer Full or Full (Strict) with a valid origin certificate so WordPress and asset URLs stay on HTTPS consistently. Purge the CDN after URL repairs so visitors stop receiving cached HTTP references.

When to stop troubleshooting

Stop if serialization-safe replace tools are unavailable and manual SQL feels risky, builder CSS keeps reintroducing HTTP after regenerations, CDN and origin SSL modes conflict beyond a simple setting change, or checkout scripts stay blocked during business hours. Escalate rather than running blind database replaces.

Information to collect before requesting help

  • 01 Screenshot of Console mixed content messages and the affected URL
  • 02 Whether the certificate itself is valid (padlock vs hard interstitial)
  • 03 Domains in use (apex, www, CDN hostname)
  • 04 Page builder in use (Elementor, Divi, Beaver, other)
  • 05 Recent SSL, migration, or domain changes
  • 06 CDN/Cloudflare SSL mode if proxied
  • 07 Whether login and checkout pages are affected

How a professional repairs the problem

A pro confirms certificate health, runs a serialization-safe HTTP→HTTPS replace across content and builder data, regenerates builder CSS, aligns CDN SSL mode, removes or upgrades third-party HTTP embeds, purges all caches, and verifies Console-clean loads on homepage, key templates, login, and checkout.

Frequently asked questions

Is mixed content the same as an expired certificate? +
No. Expired or mismatched certificates fail trust before the page loads normally. Mixed content means HTTPS works but some subresources are still requested over HTTP.
Why do browsers block some mixed content but not others? +
Active mixed content (like scripts) is typically blocked because it can rewrite the page. Passive content like images may still load with a weakened security indicator, depending on the browser.
Will an SSL plugin fix mixed content automatically? +
Plugins can help force HTTPS and rewrite URLs, but leftover builder CSS, hardcoded theme assets, and third-party embeds often need targeted cleanup. Install a valid certificate first; plugins cannot invent one.
Can I just ignore the Console warnings? +
Not on stores or login pages. Blocked scripts break features, and warnings erode trust. Clean the listed URLs.
Why did mixed content return after I fixed it? +
Usually cache, regenerated builder CSS from old data, or a CDN still serving old HTML. Purge everything and regenerate builder files after the database URLs are correct.
Is protocol-relative //example.com still recommended? +
Prefer explicit https:// or root-relative paths for your own assets. Protocol-relative URLs are less common now and still fail if the asset host has no working HTTPS.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form.

Written by Website Rescue

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.