How to Fix: No mixed content

No mixed content is an important SEO check in the Technical Foundation category. This is a high-priority SEO issue that should be addressed soon. It has a significant impact on your SEO performance.

Mixed content is the classic loose end after an HTTPS migration: the page itself loads over https://, but somewhere inside it an image, a script, or a stylesheet is still being pulled over plain http://. The browser notices, and it either downgrades your security indicator or, for scripts, blocks the resource outright and breaks the page. This is a foundational fix, not a nice-to-have — a padlock with an asterisk undermines exactly the trust HTTPS was supposed to establish.

What is This Check About?

This check verifies that a page served over HTTPS loads all of its resources — images, scripts, stylesheets, fonts, iframes — over HTTPS too, with no http:// references left behind. When it fails, you have mixed content: a secure page pulling insecure assets. Browsers treat this as a security problem. “Passive” mixed content like images downgrades the connection’s trust indicator; “active” mixed content like scripts and stylesheets is blocked entirely by modern browsers, which can visibly break layout and functionality.

Why Does This Matter for SEO?

Mixed content undercuts the security posture that HTTPS was meant to deliver, and that has direct consequences:

• HTTPS is a confirmed ranking signal, and mixed content compromises the secure state you are being credited for
• Browsers show “not fully secure” warnings that erode visitor trust and increase bounces
• Blocked active mixed content can break scripts and styles, damaging the user experience Google measures
• On a store or any page handling data, a broken padlock at the wrong moment costs conversions directly

How to Check This Issue

You can identify this issue by:

1. Running an SEO audit using the SEO Roadmap tool
2. Opening the browser console (F12) — mixed content generates explicit warnings and errors naming each insecure resource
3. Looking at the address bar for a “not fully secure” indicator instead of a clean padlock
4. Using an online mixed-content scanner, or “Why No Padlock”, against your key pages

How to Fix This in WordPress

Difficulty Level: MEDIUM – This fix requires some technical knowledge or familiarity with WordPress settings and plugins.

Estimated Time: 1 hr

The goal is to find every http:// reference and either update it or force it to HTTPS. Here is the order I would work in.

Step 1: Find the offending resources

Open the browser console on the affected pages and read the mixed-content warnings — each one names the exact insecure URL. This tells you whether the problem is hardcoded image URLs in content, a plugin or theme loading assets over HTTP, or an external resource that only offers HTTP. Fix what you can see before reaching for a blanket tool.

Step 2: Update the database and content references

Most mixed content on a migrated site is old http:// URLs baked into post content and options. A search-and-replace across the database — using WP-CLI’s search-replace or a plugin like Better Search Replace — updates http://yourdomain.com to https://yourdomain.com everywhere it is stored. Always back up before running a database replace, and run a dry run first if the tool supports it.

Step 3: Catch the rest and confirm assets exist on HTTPS

For stragglers from themes, plugins, or hardcoded template URLs, a plugin like Really Simple SSL can rewrite insecure requests to HTTPS on the fly, and adding an upgrade-insecure-requests Content-Security-Policy directive tells the browser to promote any remaining HTTP requests automatically. One caveat: this only works if the resource is genuinely available over HTTPS. If an external asset truly has no HTTPS version, replace or self-host it rather than papering over it — the fix is the secure asset, not just a rewrite that 404s.

Step 4: Verify the fix

After making changes:

1. Clear your WordPress cache if you’re using a caching plugin
2. Reload the affected pages and confirm the console shows no mixed-content warnings and the padlock is clean
3. Spot-check templates and pages beyond the homepage — mixed content often hides on inner pages
4. Re-run the SEO Roadmap audit to confirm the issue is resolved

Recommended Tools & Plugins

These tools can help you fix and prevent this issue:

• Better Search Replace – Safely update http:// URLs to https:// across the database
• Really Simple SSL – Detects and rewrites insecure requests to HTTPS
• Browser DevTools / Why No Padlock – Pinpoint the exact insecure resources
• SEO Roadmap – Complete SEO audit and action plan tool

Common Mistakes to Avoid

• Running a database search-replace without a backup first
• Assuming the homepage is clean and never checking inner pages and templates
• Rewriting an HTTP asset to HTTPS when no HTTPS version actually exists, causing it to 404
• Treating a rewrite plugin as a permanent fix instead of correcting the source URLs where practical

Need More Help?

If you’re still having trouble fixing this issue, consider:

• Consulting with a WordPress developer or SEO specialist experienced with HTTPS migrations
• Checking the WordPress support forums for mixed-content issues
• Reviewing your SSL plugin’s documentation
• Running a complete site audit with SEO Roadmap for a prioritized action plan

This guide is part of the SEO Roadmap knowledge base – your complete resource for WordPress SEO optimization.