How to fix mixed content warnings after installing ssl

Summary

This guide helps you troubleshoot and resolve: How to fix mixed content warnings after installing ssl. Follow the steps below to fix the issue.

Common Causes

When an SSL certificate is installed on your domain but some images, scripts, or stylesheets continue to load via HTTP instead of HTTPS, browsers may display a "Not Secure" warning or block those assets entirely. This is known as mixed content. It occurs when a website is accessed over a secure connection, but certain elements on the page are still being requested over an insecure connection. This article explains how to identify mixed content and update your site so that every asset is served securely.

Quick Fix Steps

1. Visit your website using https:// in your browser.
2. Open the browser developer tools to identify which resources are loading over HTTP.
3. Update your site URLs and resource links from http:// to https://.
4. Clear your website cache and reload the page to verify the warning is gone.

Detailed Instructions

Identify Mixed Content in Your Browser

1. Open your website in Google Chrome, Microsoft Edge, or Mozilla Firefox using https://yourdomain.com.au.
2. Right-click anywhere on the page and select Inspect, or press F12 to open developer tools.
3. Click the Console tab. Look for warnings that say "Mixed Content" or "Blocked mixed content." These messages list the exact URLs being loaded insecurely.
4. Alternatively, click the Network tab, refresh the page, and look for any requests starting with http:// instead of https://.

Update Your Site Address and Resource Links

1. Log in to your website's admin dashboard or content management system.
2. Navigate to the general settings or site URL configuration.
3. Change the site address and home URL from http:// to https://, then save your changes. (For WordPress, these are the WordPress Address and Site Address fields.)
4. If you use a website builder or e-commerce platform, check the domain or SSL settings and ensure the primary URL is set to HTTPS.
5. For hard-coded links in your theme or template files, update any http:// references to https://, or use protocol-relative URLs such as //yourdomain.com.au/image.jpg.

Use a Search and Replace Tool (WordPress)

1. Install a reputable search and replace plugin from your WordPress plugin repository.
2. Run a search for your old domain using http://yourdomain.com.au and replace it with https://yourdomain.com.au.
3. Pay close attention to the database tables that store post content, widget settings, and theme options.
4. After the replacement is complete, deactivate and remove the plugin to keep your site lean.

Force HTTPS with a Redirect

1. Access your website files via FTP or your hosting control panel's file manager.
2. Locate the .htaccess file in your root directory (for Apache servers). If your server uses Nginx, contact support for the correct redirect rule.
3. Add a redirect rule that sends all HTTP traffic to HTTPS, ensuring visitors and search engines always use the secure version of your site.
4. Save the file and test your website by visiting http://yourdomain.com.au to confirm it automatically redirects to HTTPS.

Troubleshooting

Warning Persists After Updating URLs

• Clear your website cache, including any caching plugin, server-side cache, or CDN cache.
• Clear your browser cache or test in an incognito/private window.
• Check that external resources, such as embedded videos, fonts, or analytics scripts, support HTTPS. If an external resource only works over HTTP, contact the provider or host the asset locally.

Green Padlock Still Not Showing

• Ensure every single asset on the page—including images, CSS, JavaScript, and iframes—is loaded over HTTPS.
• Use an online mixed content checker to scan your page for remaining insecure resources.
• Confirm your SSL certificate is installed correctly and covers both the root domain and the www subdomain if needed.

Still Having Issues?