If you want to force HTTPS and fix mixed content in WordPress, you’re usually chasing one of two things: a site that still loads over insecure http://, or the dreaded “not fully secure” padlock warning where the certificate is installed but the browser is still complaining. Both are fixable, and neither is as scary as it looks. This guide walks through getting your whole site onto HTTPS, redirecting the old insecure address, and tracking down the leftover mixed-content warnings — step by step, in plain terms.
HTTPS and mixed content: what’s actually going on
HTTPS is the encrypted, padlocked version of your site’s address. To serve it, your site needs an SSL/TLS certificate. Once that’s in place, every page and every resource on it — images, scripts, stylesheets, fonts — should load over https:// too.
Mixed content is what happens when the page itself loads securely over HTTPS but something on it still points to an old http:// address. The browser sees one insecure item on an otherwise secure page and downgrades the whole thing — that’s the broken padlock or “not secure” warning your visitors see. Fixing it means getting every last resource onto HTTPS. Here’s the order to do it in.
Step 1: Confirm you actually have an SSL certificate
None of this works without a valid certificate. Visit your site with https:// typed in front of the address. If it loads with a padlock (even a broken one), you have a certificate — skip ahead. If you get a full security error or the page won’t load over HTTPS at all, you need a certificate first. Most modern hosts issue free ones automatically; if yours doesn’t, that’s the first thing to sort out.
Step 2: Set your WordPress and Site Address to https
WordPress stores your site’s own address in two settings, and they need to say https. Go to Settings → General and check:
- WordPress Address (URL)
- Site Address (URL)
If either still starts with http://, change it to https:// and save. (One caution: if these fields are greyed out, they’re being set elsewhere — leave them alone and skip to the next step.) After saving you may be logged out; log back in at the https:// address. This tells WordPress to build links and load its own assets securely.
Step 3: Force HTTPS by redirecting HTTP traffic
Setting the address isn’t enough on its own — you also want anyone who arrives at the old http:// version to be sent automatically to the secure one, so no one ever lands on the insecure page. This redirect is best done at the server level. On a typical Apache setup it lives in the .htaccess file (a server settings file):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]If you’re not comfortable editing server files — and there’s no shame in that, it’s easy to get wrong — a well-reviewed plugin such as “Really Simple SSL” can apply the redirect and handle most mixed-content fixes for you in a couple of clicks. On good managed hosting, this redirect is already in place and you don’t touch anything at all.
Step 4: Find and fix the mixed-content warnings
With the site on HTTPS and redirecting, most warnings vanish. What’s left is usually old http:// links baked into your content and settings. To hunt them down:
Let the browser tell you what’s insecure
Open a page showing the warning, right-click, choose Inspect, and look at the Console tab. The browser lists every mixed-content item by its exact URL — that’s your to-do list. Usually it’s a handful of images, an embedded video, or a script still pointing at http://.
Fix hardcoded http:// links in your content and database
The most common cause is old links saved directly in posts, pages, and widgets — for example an image inserted years ago with an http:// address. Editing them one by one works but is tedious. The reliable fix is a search-and-replace across the database, swapping http://yourdomain.com for https://yourdomain.com. A trusted tool like the “Better Search Replace” plugin does this safely — and because it’s a database change, take a backup first. Never run a raw find-and-replace on a live site without one.
Update anything that points at itself with the old address
Check theme options, page-builder settings, and any hardcoded links in custom code or CSS for stray http:// references to your own domain, and update them to https://.
Step 5: Test it properly
Don’t trust a single page. Load several pages of the site and confirm the padlock is clean and unbroken on each — home page, a content page, and anything with embedded media or a form. Check on your phone as well as your desktop. If a warning lingers, go back to the browser Console on that specific page; it will name the exact resource still loading over http:// so you can fix that one item.
The managed shortcut: automatic HTTPS that just works
Everything above is doable yourself, but it’s fiddly, and it’s the kind of task where one missed setting leaves a warning that quietly costs you trust with visitors. On our managed WordPress hosting, HTTPS is simply handled: certificates are issued and renewed automatically, the HTTP-to-HTTPS redirect is already in place, and traffic runs over a fast global network. There’s no certificate to buy, no renewal to remember, and no expired-certificate warning to wake up to. If a migrated-in site arrives with mixed-content issues, sorting them out is part of getting you moved over — our US-based team handles it rather than handing you a checklist.
Clean HTTPS is also a baseline security item, not just a cosmetic one — it’s on our broader WordPress security checklist, and it’s part of why WordPress can be a genuinely secure platform when the fundamentals are looked after.
The bottom line
To force HTTPS and clear mixed content: confirm your certificate, set both site URLs to https, redirect HTTP traffic to HTTPS, hunt down leftover http:// resources with the browser Console and a careful database search-and-replace, and test every key page — phone included. Take a backup before any database change. And if you’d rather this were simply never your problem, managed hosting with automatic HTTPS means the padlock stays green without you touching a setting. See what’s included on our hosting page, or keep clean HTTPS on your recurring maintenance checklist.