Mixed content happens when a page loaded securely over HTTPS still tries to load some resource — an image, a script, a stylesheet — over the old, unencrypted HTTP, which browsers flag as a security warning and can silently block, breaking the resource even though the page itself shows the padlock.
Check your browser console for the specific mixed content warning
Open your browser’s developer console (F12 or Cmd+Option+I) on an affected page and look for warnings specifically mentioning “mixed content” or “insecure content.” The warning names the exact resource and its HTTP URL, which is more useful than trying to spot a broken image by eye.
Mixed content HTTP/HTTPS resolution
Mixed content warnings traced to their exact insecure source and resolved.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
This or something else?
| Your site shows a mixed content warning, or resources fail to load despite a valid SSL certificate | This fix covers it |
| You haven’t migrated to HTTPS at all yet | HTTP to HTTPS full migration, the prerequisite step |
| Your SSL/TLS configuration itself needs grading and improvement, separate from mixed content specifically | SSL/TLS configuration grade improvement |
| The issue is a broken link, not specifically an HTTP-versus-HTTPS resource loading problem | The relevant broken link scan & repair tier for your site’s size |
What you are seeing
- A browser security warning specifically citing mixed or insecure content
- Images, scripts, or stylesheets failing to load despite the page itself showing as secure
- The browser console listing the exact insecure resource URLs
- The issue possibly limited to specific pages or a specific plugin’s output
Common causes
- Hardcoded HTTP URLs left in the database from before an HTTPS migration
- A plugin or theme still referencing its own assets over HTTP by default
- An embedded third-party resource (a widget, an ad script) served only over HTTP by its own provider
- Content pasted or imported from another source retaining its original HTTP references
- A CDN or asset-optimisation service caching and re-serving an old HTTP version of a resource from before the migration
What we do
- Identify every instance of mixed content across the site
- Determine the source of each — database content, theme, plugin, or third-party embed
- Update hardcoded references to use HTTPS where the resource supports it
- Find an HTTPS-compatible alternative where a third-party resource doesn’t support it
- Verify the warning clears across affected pages
- Check for any remaining instances after the primary fixes
What is included
- Mixed content sources identified and resolved
- HTTPS-compatible alternatives found for third-party resources where needed
- Verified warning clearance across affected pages
- The pre-fix backup, kept for 30 days
Not included
- HTTPS migration itself, if not already done — a separate, prerequisite fix
- SSL/TLS configuration grading, a separate, related fix
- Replacing a third-party service entirely if no HTTPS-compatible alternative exists, a larger decision
- Ongoing monitoring as new content or plugins are added
Questions about this fix
Why would this show up even though my site has a valid SSL certificate?
A valid certificate secures the page itself, but each individual resource the page loads is checked separately — an image or script still pointing to an old HTTP address triggers the warning regardless of the page's own certificate being fine.
Does this actually block anything, or just show a warning?
It depends on the browser and resource type — some mixed content is simply blocked outright, breaking the resource entirely, while other types load with just a warning shown; either way it's worth fixing rather than leaving to chance.
Could this have been introduced by content I copied from another website?
Yes, that's a common source — pasted content sometimes carries along its original image or script URLs verbatim, including the HTTP version, without anyone noticing until it's actually tested.
What if a third-party service I rely on simply doesn't offer HTTPS?
That's a genuine constraint worth discussing directly — sometimes an alternative provider exists, and sometimes the honest answer is that the service needs replacing or the resource needs to be self-hosted instead.
Does browsers blocking mixed content actually cost me anything beyond the warning itself?
Yes, potentially — a blocked script or stylesheet can mean broken functionality or a visibly malformed page, not just a scary padlock icon, so the practical cost depends on exactly what's being blocked on the affected pages.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.