Why is my secure website showing mixed content warnings?

Summary

This guide helps you troubleshoot and resolve: Why is my secure website showing mixed content warnings?. Follow the steps below to fix the issue.

Common Causes

Mixed content warnings occur when a website loads over a secure HTTPS connection but pulls certain resources—such as images, scripts, stylesheets, or fonts—over an insecure HTTP connection. Even with a valid SSL certificate installed, browsers flag these insecure elements to protect visitors, often displaying a “Not Secure” indicator or blocking the content entirely. This undermines visitor trust and can negatively impact your site’s search engine optimisation.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Quick Fix Steps

1. Open your website in Google Chrome or Microsoft Edge.
2. Press F12 to open Developer Tools.
3. Click the Console tab.
4. Look for messages marked Mixed Content that list insecure HTTP URLs.
5. Update those resource references to use HTTPS.
6. Clear your browser cache and reload the page to verify the warning is gone.

Detailed Instructions

Identify insecure resources

Modern browsers block or flag mixed content automatically. To find exactly which files are causing the warning:

1. Visit your website using https://.
2. Right-click anywhere on the page and select Inspect, or press F12.
3. Open the Console tab in Developer Tools.
4. Refresh the page.
5. Review the list of warnings. Each entry will show the insecure URL being blocked or downgraded.

You can also check the Security tab in Chrome DevTools for a summary of the page’s secure and insecure origins.

Update internal links and resource references

Once you have identified the insecure URLs, edit your website’s source files or content management system to replace http:// with https:// for:

• Image src attributes
• Stylesheet href attributes
• JavaScript src attributes
• iframe src attributes
• Font and icon references
• Internal page links and canonical tags

Where possible, use protocol-relative URLs (for example, //example.com/image.jpg) so the browser automatically matches the page’s protocol.

Note: If you use a content management system such as WordPress, a search-and-replace plugin can help update database references from HTTP to HTTPS across posts, pages, and media attachments.

Check external assets

Third-party resources such as embedded videos, analytics scripts, or advertising networks must also support HTTPS. If an external provider does not offer a secure version, contact them or replace the asset with a secure alternative.

Enforce HTTPS site-wide

After fixing mixed content, make sure all traffic is redirected to the secure version of your site:

1. Log in to your hosting control panel or domain registrar.
2. Locate the SSL/TLS or HTTPS settings.
3. Enable Force HTTPS or HTTPS Redirect.
4. Save the changes and test your website.

Warning: Do not hardcode http:// links in your theme or template files. Always use relative paths or https:// to prevent mixed content from returning after future updates.

Troubleshooting

Warning persists after updating links

• Clear your browser cache or test in an incognito/private window.
• Purge any caching plugin or CDN cache (such as Cloudflare).
• Check hardcoded links in your theme files, not just page content.

Padlock still shows as insecure

• Verify every resource on the page loads over HTTPS, including images in headers and footers.
• Use an online SSL checker to confirm your certificate is installed correctly and not expired.
• Ensure your site’s WordPress Address (URL) and Site Address (URL) are set to https:// if applicable.

Content blocked by browser

Some browsers actively block mixed content rather than just warning about it. If scripts or images fail to load entirely, the steps above—updating every reference to HTTPS—are required to restore functionality.

If you prefer not to manage this yourself, remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?