You installed an SSL certificate and configured HTTPS, but the browser still shows a "connection not secure" warning. Sound familiar?

This is what a mixed content error looks like. The site seems to work fine, visitors don't complain, but Google sees the problem and lowers your search rankings. Since 2018, Chrome marks pages with mixed content as insecure, and the policy gets stricter with every update.

Fixing this takes two steps. No developer needed, no editing each link manually, and no risk of breaking your layout.

💡 Quick overview:

• find the source of mixed content using Chrome DevTools or online tools
• install a plugin (automatic method) or edit .htaccess and the database (manual method)
• verify the result and set up HTTPS redirect for the future

What is mixed content and why is it dangerous

Mixed content is a situation where a page loads over HTTPS, but individual elements on it (images, scripts, styles, fonts) are pulled over the insecure HTTP protocol.

The browser sees this as a security hole. An attacker can intercept the HTTP request, substitute a script or image, and gain access to user data. That's why Chrome, Firefox, and Safari block "active" mixed content (scripts, iframes) completely, while "passive" content (images, media) triggers a warning in the address bar.

The typical cause is migrating from HTTP to HTTPS. Old links in content, theme settings, CSS files, and widgets remain with the http:// prefix. WordPress doesn't change them automatically, hence the conflict.

Since 2020, Google has stated explicitly: HTTPS is a ranking signal. A page with mixed content loses the "green padlock" and, along with it, visitor trust and SERP positions. You need to fix this immediately after installing SSL, without delay.

Step 1: Diagnosis, finding the source of the problem

Before fixing anything, you need to understand which resources are loading over HTTP. The universal method is Chrome DevTools.

Open your site in Chrome, press F12 (or Ctrl+Shift+I), go to the Console tab, and refresh the page. Each line with a "Mixed Content" warning shows the exact URL of the problematic file.

Nearby, on the Security tab, you'll find a summary: certificate status, list of insecure requests, and recommendations for fixing them. This is enough for a quick assessment of the situation.

If there are many errors and you need to get a complete list in one report, online tools come to the rescue.

Jitbit SSL Checker is a free online scanner. Enter the URL and get a list of all HTTP resources on the page: images, scripts, CSS, external calls. The free version checks up to 200 pages.

Why No Padlock is another free service with detailed analysis: which elements are not secure, where they load from, and what type of content they belong to. It supports checking pages that require authentication.

HTTPS Checker is a desktop utility for macOS that scans your site locally and shows errors after each change. It works with a limit of 100 pages and is convenient for step-by-step debugging.

Once you have the list of problematic URLs in front of you, proceed to fixing them.

Step 2: Fixing, three working methods

The choice of method depends on the number of errors and your willingness to work with code. Plugins solve the task in a couple of clicks, while the manual method gives you full control.

Method 1: Really Simple Security, automated solution

Really Simple Security (formerly Really Simple SSL) is the most popular WordPress SSL plugin with 3 million active installations and a 4.9/5 rating on WordPress.org.

Install the plugin via "Plugins → Add New," activate it, and run the setup wizard. The plugin automatically:

• sets HTTPS in WordPress settings (site address and home URL),
• configures 301 redirect from HTTP to HTTPS,
• replaces HTTP links in content "on the fly" via output buffer,
• checks the certificate and warns about expiration.

After installation, open your site in incognito mode and make sure the padlock in the address bar is green and there are no Mixed Content Warnings in DevTools → Console. For the vast majority of sites, this is enough.

Method 2: SSL Insecure Content Fixer, flexible level settings

If Really Simple Security didn't work (for example, some content loads via third-party APIs), connect SSL Insecure Content Fixer. The plugin has 100,000 active installations, a 4.8/5 rating, and offers five filtering levels:

• Simple is the basic level for beginners, fixes links in content and settings;
• Content additionally checks text widgets and shortcodes;
• Widgets focuses on widget content, including custom HTML;
• Capture intercepts the entire page before rendering and replaces every http:// with https://. Slower but more effective;
• Capture All provides maximum coverage: scripts, inline styles, external calls. The most resource-intensive mode.

Start with Simple. If errors remain, switch to a higher level and recheck your site. Don't jump straight to Capture All without necessity: it loads the server and may conflict with caching plugins.

Method 3: Manual fix,.htaccess and database

If you're fundamentally against extra plugins or the error is isolated, here's the direct path.

Step A. Force HTTPS redirect in.htaccess. Add the following to the beginning of the file (before # BEGIN WordPress):

1
RewriteEngine On
2
RewriteCond %{HTTPS} off
3
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Save and verify that the homepage and all internal URLs redirect to HTTPS. Before editing, download a backup of.htaccess: one typo can break your site.

Step B. Replace HTTP links in the database. Old URLs inside posts, meta fields, and settings still have http://. Changing them with a direct SQL query is risky because serialized PHP data breaks. Use:

• WP-CLI: wp search-replace 'http://example.com' 'https://example.com' --dry-run (first without --dry-run to see the number of replacements);
• the Better Search Replace plugin, which does the same thing through the admin panel with preview.

After replacement, clear your browser cache (Ctrl+Shift+Del), plugin cache (WP Rocket, LiteSpeed), and check your site in incognito mode.

Helpful video on the topic

The GoTechWizard channel author demonstrates the process of fixing mixed content from diagnosis to clean HTTPS without a single line of code:

⁉️🤔 Frequently asked questions

Why does the site still show "not secure" after installing SSL?

The SSL certificate is activated on the server, but some content loads over HTTP. The certificate covers the connection between the browser and the server, while HTTP links inside the page bypass it. The browser sees the mix of protocols and warns the user. There are three main causes: old links to images in posts (inserted before SSL installation), hard-coded HTTP URLs in the theme or plugins, and external resources (Google fonts, CDN scripts) loading via http:// instead of https://. Diagnose through DevTools → Console and follow the steps in this article.

Do I need to buy an SSL certificate or is a free one enough?

For the vast majority of sites, a free SSL from Let's Encrypt is sufficient. It's recognized by all browsers and search engines. Paid certificates (OV, EV) make sense for online stores, banks, and sites with payment forms: they require company verification and display the organization name in the address bar. For a blog, portfolio, or corporate site, Let's Encrypt is the standard. Most hosting providers (Timeweb, Beget, Hostinger) issue it automatically when you create a site.

Can mixed content be fixed without plugins and code changes?

On some hosting providers, yes. Cloudflare includes the Automatic HTTPS Rewrites option in its free plan: it fixes HTTP links to HTTPS on the fly for all traffic passing through the CDN. However, this is a half-measure: the problem remains at the server level, and when you disable Cloudflare, the errors return. It's better to eliminate the cause by replacing HTTP links in the database and setting up an.htaccess redirect. Then your site will be clean regardless of traffic delivery method.

SSL Insecure Content Fixer* or Really Simple Security: which to choose?*

It depends on the task. Really Simple Security is a "set and forget" solution: suitable for a typical WordPress site without complex integrations. SSL Insecure Content Fixer is a tool with graduated levels for fine-tuning. If errors remain after activating Really Simple Security (this happens with non-standard theme structures, custom endpoints, or plugins with direct HTTP calls), switch to SSL Insecure Content Fixer and increase the filtering level. Practice shows: the first plugin covers most cases, the second handles the rest.

Is it safe to use Capture All mode in SSL Insecure Content Fixer?

Capture All intercepts and rewrites every byte of the page before sending it to the browser. This is reliable but increases CPU load. On weak hosting or high-traffic sites, there may be a response delay of 100-300 ms. Caching plugins (WP Rocket) mitigate this effect: the page is generated once and served from cache. Before enabling Capture All, make sure gentler levels haven't solved the problem, and create a backup.

Fixed mixed content, what's next

A mixed content error is not a death sentence. After the two steps from this article, it's completely resolved and, as a rule, doesn't return. The key is not to silence browser warnings but to eliminate the cause: switch every resource to HTTPS.

Consolidate your result: set up automatic SSL checking (UptimeRobot or hosting monitoring sends a notification 30 days before certificate expiration) and make it a rule to insert new links with https:// from the start. A few minutes of prevention now saves hours of debugging later.