Fixing "Not Secure" warnings and mixed content in WordPress

When a browser shows "Not Secure" next to your address, or the padlock is missing or has a warning symbol on it, visitors notice. It puts people off filling in forms and paying for things, and browsers are becoming stricter every year about what they'll load on an insecure page.

There are three main reasons a WordPress site ends up in this state:

• The SSL certificate is missing, expired or doesn't cover the address being visited.
• The site is being served over plain http://, either because WordPress is still configured that way or because visitors aren't redirected to https://.
• The page loads over https:// but pulls in images, scripts, fonts or forms from http:// addresses. This is called mixed content.

The fixes below work through these in order. Most sites have more than one of these problems at the same time, especially after moving to HTTPS.

Check your SSL certificate

Click the padlock (or warning symbol) in the address bar and look at the certificate details. You're checking three things.

Does a certificate exist? If you see "Your connection is not private" or NET::ERR_CERT errors, the certificate is missing, broken or doesn't match. Nothing else on this page will help until that's fixed.

Is it still valid? Certificates have an expiry date. Free Let's Encrypt certificates currently last 90 days, and that's gradually being cut to 45 days by 2028,¹ so they need to renew automatically. Renewal fails if your DNS has changed, the domain points somewhere else or a firewall blocks the verification request.

Does it cover the address you're using? A certificate for example.com doesn't automatically cover www.example.com. If one version works and the other shows an error, the certificate needs reissuing to include both.

Almost every host now provides free certificates. Look for an SSL/TLS or "Let's Encrypt" section in your control panel, or ask your host to issue or reissue one. You shouldn't need to pay for a certificate for a typical small business site.

Switch WordPress to HTTPS

With a valid certificate in place, go to Tools → Site Health. Since WordPress 5.7, if WordPress detects that HTTPS is available but not being used, it shows an Update your site to use HTTPS button. This switches both site URLs to HTTPS and rewrites old HTTP links to your own site in your content as pages load.²

The button won't appear if your URLs are set in wp-config.php. In that case, or if the button isn't there for another reason, update the URLs by hand.

Before changing them, note down the current values. Changing the site URLs logs you out, and a typo can lock you out of the dashboard. If that happens, our guide to regaining access to WordPress admin shows how to fix it.

Go to Settings → General and change both the WordPress Address (URL) and the Site Address (URL) from http:// to https://. You'll be logged out and asked to log back in, which is normal.

If these fields are greyed out, the URLs are set in wp-config.php. Download a copy of the file first, then look for WP_HOME and WP_SITEURL and update them there.

Redirect all HTTP traffic to HTTPS

Changing WordPress settings doesn't stop people reaching the old http:// address from bookmarks, old links or by typing it in. You need a redirect at server level.

Many hosts have a "Force HTTPS" toggle in their control panel, which is the simplest option. On Apache or LiteSpeed hosting you can add this to the top of .htaccess, above the WordPress section:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Download a copy of .htaccess before editing it. If the site stops loading or starts looping, putting the original back undoes the change immediately.

Only set up one HTTPS redirect. If your host's toggle, a plugin and .htaccess are all redirecting at once, they can fight each other and cause a redirect loop. On Nginx, the redirect goes in the server configuration, and your host will need to add it.

If you use Cloudflare, set the SSL/TLS encryption mode to Full or Full (strict) when your server has its own certificate. In Flexible mode Cloudflare connects to your server over plain HTTP, so an HTTPS redirect on the server sends every request round in a loop.³

Find the mixed content

If the certificate is fine and the site loads over HTTPS but the padlock still shows a warning, something on the page is loading over HTTP.

Open the page, then open developer tools (F12, or right-click and choose Inspect) and select the Console tab. Reload the page. Mixed content shows up as warnings or errors like:

Mixed Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure image 'http://example.com/wp-content/uploads/logo.png'.

Each message tells you exactly which file is the problem. Note whether the insecure address is on your own domain or somewhere else, because the fix is different.

Modern browsers automatically upgrade insecure images, audio and video to HTTPS, and block insecure scripts, stylesheets and other resources outright.⁴ An upgraded image that isn't available over HTTPS simply doesn't load. So mixed content can show up as a broken layout, a missing slider or a form that won't submit, rather than just a padlock warning.

Update old URLs in the database

If your site was built on HTTP and later moved to HTTPS, your posts, pages, widgets, menus and plugin settings will be full of http:// links to your own domain. These need updating in the database.

Take a fresh database backup immediately before this step, even if you took one earlier. A search and replace touches almost every table, and a mistake is much easier to undo from a backup than by hand.

Don't do this with a plain SQL find and replace. WordPress and many plugins store data in a "serialised" format that records the length of each piece of text. Changing http to https adds a character, and a naive replace corrupts those entries, which can wipe widgets and plugin settings.

If you have WP-CLI access, run a dry run first to see what would change:

wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run

If the results look right, run it again without --dry-run. WP-CLI's search-replace command handles serialised data safely.⁵ Replace example.com with your domain, and repeat for the www version if your old links used it.

Without WP-CLI, a search and replace plugin such as Better Search Replace does the same job from the dashboard. Run a dry run first, then deactivate and delete the plugin once you're done.

Fix hardcoded links in themes and page builders

If mixed content remains after updating the database, the insecure links are probably coming from somewhere the search and replace can't reach.

• Theme files: search your theme (and child theme) for http:// in PHP, CSS and JavaScript files, and update any links to your own domain or to external resources. Download a copy of any file before editing it. If you edit a parent theme directly, the next theme update will overwrite your changes.
• Page builder CSS: builders such as Elementor generate CSS files that can still contain old URLs. In Elementor, use the Replace URL tab on its Tools screen (under the Elementor menu), then clear its generated files. The button for that is called Clear Cache in Elementor 3.28 and later, and Regenerate CSS & Data in older versions.⁶
• Customiser settings: check custom CSS and header or footer script boxes in Appearance → Customise or your theme's options panel.
• External resources: scripts, fonts or images loaded from another site over http:// need changing to https://. If that service doesn't support HTTPS, it's time to replace it.

Clear every cache

Cached pages keep serving old HTTP links long after you've fixed the source. Clear your caching plugin, your host's server cache and your CDN cache, then check again in a private browsing window. Our guide to a WordPress site not updating walks through each caching layer.

Still seeing warnings?

If the console is clean but the padlock is still missing, check for forms that submit to an http:// address (a newsletter sign-up embedded from another service is a common example). Browsers treat those as insecure too.

If the browser shows a full-page red warning such as "Deceptive site ahead" rather than a padlock problem, that's a different issue. Google has flagged the site as harmful, usually because it's been hacked. See our guide to cleaning up a hacked WordPress site.

If you're still stuck, my WordPress development service and emergency WordPress support cover SSL setup, HTTPS migrations and mixed content clean-ups.