Fix mixed content warnings after switching to HTTPS

Your certificate is installed, but the browser shows "Not fully secure", a warning icon instead of the padlock, or some images and styles are missing. This is mixed content: the page loads over HTTPS but pulls some resources over plain HTTP. Browsers upgrade or block those requests, which can break layouts and scripts.

Before you start

• Confirm the certificate itself is valid: the domain loads on https:// without a certificate error.
• Take a backup before changing the database or theme files.

Find the insecure resources

1. Open the affected page in Chrome, Edge or Firefox and press F12.
2. Open the Console tab and reload. Mixed content messages list the exact http:// URLs.
3. Check several page types: home, a post, a shop page, because each template may load different files.

Online scanners such as "Why No Padlock" or JitBit's SSL check can crawl many pages at once.

Types of mixed content

Fix it in WordPress

1. In Settings → General make sure both addresses start with https://.
2. Replace old URLs in the database with WP-CLI or Better Search Replace: search http://example.com, replace with https://example.com, all tables, dry run first.
3. Regenerate CSS in your page builder (for example Elementor → Tools → Regenerate CSS & Data).
4. Purge LiteSpeed Cache and any CDN.

Fix hard-coded URLs in files

• Search the active theme's files and custom CSS for http:// references, for example background images in style.css.
• Check widgets and custom HTML blocks for embedded scripts or iframes using http://.
• Third-party embeds that do not support HTTPS at all must be replaced or removed.
• Use protocol-relative or, better, explicit https:// URLs.

Fix it on static sites

For HTML sites, SitePad or Sitejet, edit the elements that contain external links or embeds and change http:// to https://, then publish again. In custom code, search all .html, .css and .js files.

Add an upgrade header as a safety net

A Content Security Policy directive tells browsers to request every resource over HTTPS. Add to .htaccess:

Header always set Content-Security-Policy "upgrade-insecure-requests"

This fixes resources that exist on HTTPS but are linked with http://. It does not help when the remote server has no HTTPS version, so still fix the links themselves.

Force HTTPS for visitors

Mixed content is about resources inside the page. Separately, make sure visitors arriving on http:// are redirected to https://, using cPanel → Domains → Domains → Force HTTPS Redirect.

Troubleshooting

• Warning persists after fixing: you are seeing a cached page. Purge all caches and test in a private window.
• Only the logged-in view has mixed content: an admin-only plugin loads insecure files; it does not affect visitors, but update the plugin.
• Fonts blocked: a font is loaded from an old http:// URL in CSS; update it or host the font locally.

Next steps

• Force HTTPS in WordPress
• Search and replace URLs safely
• Force HTTPS redirect in cPanel