How to Diagnose and Fix a Mixed Content Warning on Your Small Business Website

Summary

This guide helps you troubleshoot and resolve: How to Diagnose and Fix a Mixed Content Warning on Your Small Business Website. Follow the steps below to fix the issue.

Common Causes

Your website may display a security warning in visitors' browsers even though your SSL certificate is active and installed correctly. This is known as a mixed content warning. It occurs when a secure HTTPS page loads certain resources—such as images, stylesheets, scripts, or fonts—over an insecure HTTP connection. Modern browsers block or flag this content to protect users, which can damage visitor trust and harm your business reputation. This guide explains how to identify mixed content and update your website so every resource loads securely.

Quick Fix Steps

1. Open your website in Google Chrome or Microsoft Edge.
2. Press F12 to open Developer Tools.
3. Select the Console tab.
4. Refresh the page and look for warnings labelled Mixed Content.
5. Note the insecure HTTP URLs listed in each warning.
6. Edit your website files or content management system to change those URLs from http:// to https://.
7. Save your changes and clear your website cache.
8. Reload your website and verify the padlock icon appears in the address bar.

Detailed Instructions

Identify Mixed Content Using Browser Developer Tools

1. Open your website in Google Chrome or Microsoft Edge.
2. Press F12 (Windows) or Command + Option + I (macOS) to open Developer Tools.
3. Click the Console tab at the top of the Developer Tools panel.
4. Refresh your website page.
5. Scan the console output for messages beginning with Mixed Content:. Each message will show the insecure resource URL being blocked or downgraded.
6. Copy the full list of HTTP URLs so you can update them in the next step.

Update Insecure Links to HTTPS

1. Log in to your website's hosting control panel or content management system (for example, WordPress, Joomla, or your site's file manager).
2. Open the affected page, post, theme file, or template where the insecure resource is embedded.
3. Locate every instance of http:// in image sources, script tags, stylesheet links, iframe embeds, or font references.
4. Change http:// to https:// for each resource, ensuring the destination domain actually supports HTTPS.
5. Save the file or publish the page.
6. If your website uses a database, search and replace all instances of your site's HTTP URL with the HTTPS equivalent using a trusted search-and-replace tool or plugin.

Force HTTPS Across Your Website

1. Check with your hosting provider for the correct method to force HTTPS on your server, as configuration varies between Apache, Nginx, and other web servers.
2. If your hosting uses Apache with .htaccess support, add a redirect rule that sends all HTTP traffic to HTTPS, or enable the Force HTTPS option if your control panel provides one.
3. Save the file and test that visiting http://yourdomain.com.au automatically redirects to https://yourdomain.com.au.

Troubleshooting

Warnings Persist After Updating Links

• Clear your website cache, server cache, and any caching plugin (such as WP Rocket or W3 Total Cache).
• Clear your browser cache or test in an incognito/private window.
• Check that external resources (such as embedded videos, fonts, or analytics scripts) are loaded from HTTPS sources. If a third-party service does not support HTTPS, contact that provider or host the resource locally.
• Review your Content Security Policy (CSP) headers, as they may block or report mixed content even after links are updated.

Padlock Still Not Showing

• Verify your SSL certificate is valid and not expired.
• Run your domain through an online SSL checker to confirm the certificate is installed correctly across the full certificate chain.
• Ensure your website's home URL and site URL settings are configured to use https://.

If you updated your content but still see warnings, check hard-coded links in your theme files, header, footer, and widget areas. These are often overlooked when updating pages through a visual editor.

Do not simply disable mixed content blocking in your browser to hide the warning. Visitors will still see security alerts, and your website remains vulnerable to content injection attacks.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

If you have followed these steps and your website continues to display security warnings, contact our support team for further investigation.

Still Having Issues?