How to Secure Your WordPress Site from Mixed Content Warnings

Mixed content occurs when an HTTPS page requests resources over HTTP. Updating those resource addresses helps the browser load images, scripts and styles securely without blocking them or issuing warnings.

Identify the insecure resources

Confirm that the site works over HTTPS with a valid certificate. Open the browser’s developer tools and inspect the console or network messages to find the exact HTTP resource URLs and where they originate.

Back up the database and files before making changes. Keep the existing domain and path structure unless a separate move is intended.

Update WordPress and stored links

Review Settings > General and change the intended WordPress and site addresses to HTTPS where required. The two addresses can legitimately differ when WordPress is installed in its own directory; retain that structure and check any configuration overrides.

For a single-site installation, an authorised site owner can use WP-CLI from the correct WordPress directory to preview a serialised-data-aware replacement:

wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run

Replace both addresses with the actual HTTP and HTTPS base URLs. Review the tables and changes, then run the same command without --dry-run only when the scope is correct. Check plugin-specific tables separately; do not select every database table indiscriminately, especially on multisite or a shared database.

Update Elementor content where used

Open Elementor > Editor > Tools > Replace URL. Enter the actual old HTTP and new HTTPS addresses and select Replace URL. Older versions may show Elementor > Tools directly.

Under General, select Clear Files & Data and save to regenerate Elementor’s generated files. This does not fix every external resource or theme reference.

Check files and external services

Update hardcoded HTTP URLs in the relevant theme, custom CSS or plugin settings using a maintainable override. Confirm that external resources support HTTPS before changing their addresses; replace unavailable resources where necessary.

Clear relevant caches and retest representative pages and forms. A general HTTPS redirect or an upgrade policy does not correct missing HTTPS resources or guarantee that the entire site is secure.