WordPress SSL mixed content appears when a secure HTTPS page still loads some assets over HTTP. The page may look normal, but browsers can show warnings, block files, or reduce trust.
Mixed content often appears after a site moves from HTTP to HTTPS, after a redesign, or when old images and scripts remain in the database. A simple checklist helps clean the issue without guessing.
Confirm The SSL Certificate Works
Start by checking that the SSL certificate is active, valid, and installed for the correct domain versions. Test both www and non-www if the site uses redirects. A certificate problem must be fixed before mixed content cleanup can work properly.
Once the certificate is stable, confirm that WordPress Address and Site Address use HTTPS in the general settings.
Crawl For HTTP Assets
Use a crawler or browser developer tools to find images, scripts, stylesheets, fonts, iframes, and files that still load over HTTP. Save the list so each asset can be fixed at the source.
Common problem areas include old media uploads, hard-coded theme links, page builder backgrounds, custom CSS, tracking scripts, and embedded third-party content.
Update Internal URLs
Many mixed content issues come from internal URLs stored in the database. Use a careful search-and-replace tool to update old HTTP site URLs to HTTPS. Always take a backup first, because serialized data can break if replacements are handled poorly.
After the update, clear site cache, CDN cache, and browser cache before testing again.
Check Page Builder Backgrounds
Page builders often store background image URLs separately from normal content. Open important templates, headers, footers, and landing pages. Re-select images from the media library if old HTTP paths remain.
This step catches issues that automated replacement can miss, especially on visually complex pages.
Review External Embeds
Third-party embeds should also load securely. Replace old HTTP YouTube, map, font, script, and widget links with HTTPS versions when the provider supports them. If a provider does not support HTTPS, consider removing the embed.
A secure site should not depend on insecure external files for core functionality.
Test Key Pages After Fixes
Check the homepage, contact page, checkout pages, landing pages, and top blog posts. The browser should show a secure connection without warnings. Also test mobile because cached files and lazy-loaded assets can appear later in the page.
A clean WordPress SSL mixed content process protects visitor confidence and keeps the site aligned with modern security expectations.