WordPress Mixed Content SSL Checklist
Mixed content happens when a HTTPS page still loads some resources over HTTP. Browsers may block these resources or show security warnings. In WordPress, this often comes from old URLs in content, theme files, plugin settings, cache or database values.
Core principle
SSL is not only about the certificate. Every image, script, stylesheet, iframe and API request on a HTTPS page should also use HTTPS or a safe relative URL.
Checklist
- Confirm the SSL certificate works.
- Open browser developer tools and check console warnings.
- Identify HTTP resources on HTTPS pages.
- Check WordPress Address and Site Address.
- Check old HTTP URLs in content or media.
- Check theme and plugin settings.
- Clear cache after fixes.
- Check CDN or Cloudflare settings.
- Test important pages again.
- Use search-replace carefully only after backup.
Reusable lesson
Mixed content is a content and configuration cleanup problem. Do not reinstall SSL if the certificate already works.
When to Use This Checklist
Use this checklist when a WordPress HTTPS page shows mixed content warnings or blocked insecure resources.
Required Tools
WordPress admin, browser developer tools, SSL certificate, cache plugin, database backup, CDN access
Before You Start
Back up the database before running search-replace operations on HTTP URLs.
Structured Checklist Steps
- Check SSL certificate.
- Open browser console.
- Find HTTP resources.
- Check WordPress URLs.
- Check content URLs.
- Check theme settings.
- Check plugin settings.
- Clear cache.
- Check CDN settings.
- Retest key pages.
Verification Steps
- No browser mixed content warning remains.
- Images load over HTTPS.
- CSS and JS load over HTTPS.
- Cache is cleared.
- Important pages are tested.
Rollback Plan
If search-replace breaks content, restore the database backup and repeat with a more precise replacement rule.
Common Mistakes
- Reissuing SSL unnecessarily.
- Forgetting cached HTTP URLs.
- Running search-replace without backup.
- Ignoring theme hardcoded URLs.
- Testing only the homepage.
Related Commands
curl -I https://example.com
wp search-replace 'http://example.com' 'https://example.com' --dry-run
wp search-replace 'http://example.com' 'https://example.com'
sudo nginx -t