You just provisioned a new SSL certificate via Let’s Encrypt or Cloudflare, and you successfully updated your WordPress Site Address to use https://. However, instead of a reassuring green padlock, Google Chrome displays a gray warning icon and the text “Not Secure”.
If you open the browser’s Developer Console (F12), you will likely see a stream of yellow warnings: “Mixed Content: The page at ‘https://…’ was loaded over HTTPS, but requested an insecure image ‘http://…’.”
Here is exactly how to diagnose and permanently fix Mixed Content errors on your WordPress site. (Note: If your site is completely inaccessible with a privacy error, refer to our ERR_CERT_DATE_INVALID Troubleshooting Guide instead).
Understanding Mixed Content
When a browser connects to a website over HTTPS, it expects the entire payload of that page—every image, stylesheet, script, and font—to also be delivered over a secure, encrypted HTTPS connection.
If your core HTML document loads securely via HTTPS, but a single logo image is hardcoded to load from an http:// URL, the browser flags the entire page as insecure. This is because a malicious actor could theoretically intercept that insecure image request and inject a malicious script in its place.
Step 1: Identifying the Insecure Assets
Before you can fix the issue, you must know what is breaking.
- Open your website in Google Chrome.
- Right-click anywhere on the page and select Inspect.
- Click on the Console tab.
- Look for the yellow warnings. They will explicitly list the exact URLs of the assets (images, CSS files, or JavaScript files) that are being loaded via
http://.
Common culprits include old media library images inserted into blog posts years ago, hardcoded logo URLs in your theme’s header.php, or insecure tracking pixels from third-party plugins.
Step 2: The Database Search and Replace (The Permanent Fix)
If you have hundreds of blog posts with old http:// image links, you cannot fix them manually. You must run a database search and replace.
WARNING: Always back up your database before performing this step. A malformed search and replace will instantly break your site. If your database crashes, refer to our Database Connection Error Guide.
We highly recommend using a plugin like Better Search Replace or WP-CLI rather than running raw SQL queries, as WordPress stores many URLs in serialized PHP arrays which raw SQL will corrupt.
Run a search and replace for:
- Search for:
http://yourdomain.com - Replace with:
https://yourdomain.com
Select all tables (especially wp_posts and wp_postmeta) and run the operation.
Step 3: Fixing Hardcoded Theme/Plugin Assets
If the Console reveals that the insecure asset is a stylesheet or script loading from your theme folder (e.g., wp-content/themes/your-theme/style.css), the Search and Replace will not fix it.
This means the theme developer improperly hardcoded an HTTP link. You must locate the file (usually functions.php or header.php) and change the enqueue script URL to use https://, or better yet, use WordPress native functions like get_template_directory_uri() which automatically detect the correct protocol.
Step 4: The Cloudflare “Automatic HTTPS Rewrites” Band-Aid
If you need an immediate fix while you debug the database, and your site is hosted behind Cloudflare, you can enable a temporary band-aid.
- Log into your Cloudflare dashboard.
- Go to SSL/TLS -> Edge Certificates.
- Toggle on Automatic HTTPS Rewrites.
Cloudflare will dynamically parse your HTML on the fly and rewrite insecure HTTP links to HTTPS before the browser ever sees them. However, this relies on Cloudflare’s edge processing and does not fix the root cause in your database.
Conclusion
Securing your site with an SSL certificate is mandatory for SEO and user trust. By systematically identifying mixed content in the console and performing a serialized database replacement, you can restore the green padlock and ensure your Secure Web Hosting environment is functioning perfectly.
Automated free SSL issuance and 1-click HTTPS redirection are fully configured on managed cPanel hosting in Pakistan.
