One of the most common issues website owners face after migrating to an SSL certificate is the dreaded Mixed Content Error. You’ve bought an SSL certificate, you’ve installed it, but browsers like Google Chrome still refuse to show the secure green padlock, displaying a “Not Secure” warning instead.
This happens when a website loads its initial HTML page over a secure HTTPS connection, but then pulls in external resources (like images, CSS stylesheets, JavaScript files, or videos) over an insecure HTTP connection.
Because the insecure content can theoretically be intercepted or altered by hackers, the browser blocks the green padlock to warn the user. Here is the complete technical guide on how to hunt down and fix Mixed Content errors in WordPress.
Step 1: Ensure Core WordPress Settings Use HTTPS
The absolute first step is to verify that WordPress knows it should be running over HTTPS. If WordPress is still generating core links using HTTP, you will have mixed content across your entire site.
- Log into your
wp-admindashboard. - Navigate to Settings > General.
- Check the WordPress Address (URL) and the Site Address (URL) fields.
- If they begin with
http://, change both tohttps://. - Save your changes.
Note: If saving these settings suddenly locks you out of your site with an ERR_TOO_MANY_REDIRECTS loop, it means your server (or proxy like Cloudflare) is forcing HTTPS at the DNS level while WordPress is trying to force it at the application level, creating an infinite loop.
Step 2: Use “Better Search Replace” for Hardcoded Database Links
Even after updating the core settings, all the images you uploaded in the past, or manual links you inserted into your posts, are permanently hardcoded in your MySQL database with http://.
To fix this efficiently without breaking serialized data:
- Install and activate the Better Search Replace plugin.
- Go to Tools > Better Search Replace.
- In the Search for field, enter your old HTTP URL:
http://www.yourdomain.com - In the Replace with field, enter the secure HTTPS URL:
https://www.yourdomain.com - Select all the database tables, uncheck the “Run as dry run” option, and execute the replacement.
This will scan your entire database and seamlessly upgrade all hardcoded links to HTTPS.
Step 3: Check Your Theme and Plugins
Sometimes, poorly coded themes or plugins load their external scripts directly via HTTP. For example, a theme might have this hardcoded in its header.php file:
<script src="http://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
You need to inspect your site’s source code (Right-Click > Inspect > Console). The browser console will explicitly list every single file that is causing the Mixed Content error. Once you identify the file (e.g., a Google Font or an external script), you must edit your theme files to change http:// to https:// (or // for protocol-relative URLs).
Caution: Be careful when editing functions.php or header.php. A small syntax error could trigger a Cannot Modify Header Information warning or crash the site.
Step 4: Upgrade to SSL-Optimized Hosting
Manually hunting down Mixed Content errors and configuring .htaccess redirects can be overwhelming. Furthermore, a poorly configured SSL certificate at the server level will keep throwing errors regardless of what you do in WordPress.
To eliminate these headaches permanently, upgrade to Nextgen’s premium WordPress Hosting in Pakistan. Our enterprise-grade infrastructure comes with robust SSL pre-installed, automatic server-level HTTPS routing, and advanced security firewalls out of the box—ensuring your users always see the secure green padlock without any manual configuration on your end.
Ensure flawless HTTPS compliance and UI styling with Nextgen’s web development packages.
