11 WordPress ServicesView all
Website DesignBespoke hand-coded themesRedesign & AuditTransform underperforming sitesWooCommerceRevenue-driven ecommerce storesElementor DesignFlexible page-builder sitesSEO & Core Web VitalsPage one rankings, UK businessesSpeed Optimisation90+ PageSpeed score, guaranteedCare PlansMonthly maintenance & supportSecurity HardeningProtection against attacksMigrationZero-downtime site movesHeadless WordPressHeadless, multisite, APIsHire a DeveloperDaily or monthly developer hire
8 industry verticalsAll industries
Law FirmsProfessional ServicesDental PracticesHealthcareFinancial ServicesFinancial ServicesHotels & B&BsHospitalityRestaurants & CafesHospitalityGyms & FitnessHealth & FitnessEcommerce & RetailRetailAccountantsProfessional Services
12 UK locationsAll locations
LondonGreater LondonBirminghamWest MidlandsLeedsWest YorkshireBristolSouth West EnglandLiverpoolMerseysideEdinburghCity of EdinburghSheffieldSouth YorkshireGlasgowGreater GlasgowCardiffSouth WalesNewcastleTyne and WearNottinghamNottinghamshireLeicesterLeicestershire
Home/Blog/Security
Security10 November 2026· 6 min read

WordPress SSL and Mixed Content Errors: What They Mean and How to Fix Them

Your WordPress site has an SSL certificate but Chrome still shows "Not Secure" or a warning padlock. This is almost always a mixed content problem — here is how to fix it permanently.

You have installed an SSL certificate and your domain shows https:// — but Chrome still shows a padlock with a warning, or a "Your connection is not fully secure" message. This is almost always a mixed content error: some resources on your page are still being loaded over HTTP rather than HTTPS. The certificate is working; the problem is in your database or configuration.

What causes mixed content errors in WordPress

When you migrate from HTTP to HTTPS, all the URLs stored in your WordPress database still point to http://. This includes images in posts, embedded scripts loaded by plugins, fonts referenced in CSS and hardcoded URLs in theme files. Browsers block or warn about any page that loads a mix of HTTPS and HTTP resources.

Fix 1: Update WordPress and Site Address to HTTPS

In your WordPress dashboard, go to Settings → General. Change both WordPress Address and Site Address from http:// to https://. This is the first step — without it, WordPress continues generating HTTP URLs for new content even if you fix existing ones.

Fix 2: Run a database search-replace for HTTP URLs

Install Better Search Replace. Under Tools → Better Search Replace, search for http://yourdomain.com and replace with https://yourdomain.com across all database tables. This fixes all hardcoded HTTP URLs in one operation. Run it in dry-run mode first to preview the changes.

Fix 3: Add an HTTPS redirect in .htaccess

Open your .htaccess file via FTP and add a redirect rule that forces all HTTP traffic to HTTPS before WordPress processes the request:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Fix 4: Check for hardcoded HTTP URLs in theme files

Some themes have HTTP URLs hardcoded in PHP, CSS or JavaScript files. Use FTP to search your theme directory for http:// — most FTP clients support content search. Any hardcoded http:// reference to your own domain should be changed to https:// or replaced with a protocol-relative URL (starting with //).

ImportantIf you are using Cloudflare, check that your SSL/TLS encryption mode is set to Full or Full (Strict) — not Flexible. Flexible mode causes redirect loops on WordPress sites because Cloudflare connects to your server over HTTP even while serving HTTPS to visitors. This is a common cause of persistent HTTPS problems that has nothing to do with WordPress itself.

Frequently asked questions

Why does my WordPress site show "Not Secure" even though I have an SSL certificate?+

Having an SSL certificate is not enough — every resource loaded by the page (images, scripts, stylesheets, fonts) must also be served over HTTPS. If even one resource loads over HTTP, the browser shows a mixed content warning. This is usually caused by hardcoded HTTP URLs in your WordPress database or theme files.

What is a WordPress mixed content error?+

A mixed content error occurs when an HTTPS page loads some resources over HTTP. Browsers flag this as insecure because the HTTP resources are unencrypted even though the page itself is served over HTTPS. The fix is to ensure all resource URLs in your database and theme use HTTPS rather than HTTP.

How do I fix mixed content errors in WordPress?+

The quickest approach is to run a database search-replace using Better Search Replace — search for http://yourdomain.com and replace with https://yourdomain.com across all tables. Also update WordPress Address and Site Address in Settings → General to https://. For a one-click approach, Really Simple SSL handles the redirect and replaces HTTP references dynamically.

How do I force WordPress to use HTTPS?+

Update WordPress Address and Site Address in Settings → General to https://. Add a 301 redirect in .htaccess to force HTTP requests to HTTPS. Also check wp-config.php does not have conflicting SSL constants. If you are on Cloudflare, ensure SSL/TLS mode is set to Full or Full (Strict) — the Flexible mode causes redirect loops on WordPress sites.

Related service

SSL configuration is part of every security hardening project. If your site has certificate issues alongside other vulnerabilities, our security audit covers the full picture.

WordPress Security Service →

Next article

Troubleshooting

WordPress "Allowed Memory Size Exhausted": How to Fix the PHP Memory Error

→
← All articles