SSL and mixed content warnings

The short answer

A “not secure” warning or a missing padlock on a site that already has a certificate almost always means mixed content: the page loads over https but something on it (an image, a stylesheet, a script) is still being requested over plain http. The fix is to make sure WordPress knows its address is https, then replace the old http:// links stored in the database with a search and replace tool.

If the certificate itself has expired or was never issued, that is a different problem, fixed in the hosting console under SSL/TLS Certificates.

What it means

An SSL certificate (today more accurately called a TLS certificate) is what lets a browser show the padlock. It proves the site is who it says it is and encrypts everything between the visitor and the server. Without a valid one, browsers show a full-page warning and many visitors leave.

Mixed content is a different, milder problem. The page itself is secure, but it pulls in at least one resource over http://. Browsers refuse to load the insecure item, or they downgrade the padlock to a warning icon. On a WordPress site this usually happens right after switching to https, because the database is full of links that were saved as http:// when the site was built.

Two places tell you exactly what is wrong. Click the padlock (or the warning icon) in the address bar and the browser explains whether the certificate is valid or whether content is blocked. Open the browser’s developer console (F12 on most browsers, then the Console tab) and it lists every blocked resource by URL.

Common causes

• Old http:// links saved in the database. Image paths in posts, logo URLs in theme settings, slider images and page builder content all keep the full address they were saved with.
• WordPress Address and Site Address still set to http. WordPress then generates http links for its own scripts and styles.
• Hard-coded http:// in theme files and CSS. Background images in style.css, fonts or scripts added directly to header.php, and child theme tweaks.
• Third party embeds. An old widget, badge or tracking snippet that only exists at an http address.
• An expired or mismatched certificate. Let’s Encrypt certificates last 90 days and renew automatically, but renewal fails if the domain no longer points at the server.

How to fix it

1. Confirm the certificate is valid. Click the padlock in the address bar. If it says the certificate is expired or for a different name, go to the hosting console: in Plesk open Websites & Domains, then SSL/TLS Certificates, and issue or reinstall a Let’s Encrypt certificate for the domain and www. The idea is the same on any host; only the menu names differ.
2. Set WordPress to https. Under Settings > General, change both WordPress Address and Site Address to begin with https://. Save. You will be logged out and back in.
3. Replace the old links in the database. Take a backup first. Then run a search and replace of http://yourdomain.com to https://yourdomain.com. With WP-CLI over SSH: wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables. Without SSH, install the Better Search Replace plugin, run a dry run first, then the real one. Repeat for the www version if the site used it.
4. Find what is left. Reload the page, open the console, and read the URL of any resource still blocked. Each one tells you where it came from.
5. Fix hard-coded theme files. If a blocked URL comes from style.css, header.php or functions.php, edit those files in File Manager (or via SFTP) and change http:// to https://. If a resource does not exist at an https address at all, remove it or find a replacement.
6. Force https for everyone. If Cloudflare is in front of the site, turn on “Always Use HTTPS” and “Automatic HTTPS Rewrites” under SSL/TLS, and set the encryption mode to “Full (strict)” so Cloudflare also talks to your server securely. Without Cloudflare, add a redirect from http to https in the hosting console or the site’s .htaccess file.
7. Clear every cache. Purge the caching plugin, any server cache and Cloudflare, then test in a private browser window.

On WP Alpha

Every site on WP Alpha gets a free Let’s Encrypt certificate, and we convert a site to https for free. That covers the database search and replace and the redirect, so if your site has arrived with us still showing http links, ask support on live chat and it will be done rather than explained.

Let’s Encrypt certificates renew automatically every 90 days. Cloudflare sits in front of every site. VERIFY: whether “Always Use HTTPS” and “Full (strict)” are set by default on the Cloudflare layer If you would rather run the search and replace yourself, WP-CLI is available over SSH.