How to fix mixed content errors after installing SSL

You have installed an SSL certificate and your website runs on HTTPS, but the browser shows a warning that the connection is "not fully secure". The padlock is gray or a warning triangle appears. This is a mixed content error: your page is loaded over HTTPS, but it contains elements that are still fetched over HTTP.

What is mixed content?

Mixed content occurs when an HTTPS page loads resources (images, scripts, stylesheets, fonts) over an unencrypted HTTP connection. The browser considers this a security risk and shows a warning.

There are two types of mixed content:

• Mixed passive content: images, videos and audio loaded over HTTP. The browser does load them, but shows a warning.
• Mixed active content: scripts, stylesheets and iframes loaded over HTTP. The browser blocks these by default, which can lead to a broken website.

Finding mixed content with Chrome DevTools

Follow these steps to find mixed content on your website:

1. Open Chrome DevTools

Go to your website in Google Chrome and press F12 (or right-click → Inspect). Click the "Console tab.

2. Look for warnings

Mixed content warnings are highlighted in yellow or red and look like this:

Mixed Content: The page at 'https://domein.nl/' was loaded over HTTPS, but requested an insecure image 'http://domein.nl/images/logo.png'. This content should also be served over HTTPS.

Each warning tells you exactly which file is loaded over HTTP and on which page.

3. Check multiple pages

Mixed content can differ from page to page. At a minimum, check your homepage, blog, product pages and contact page. If you like, use a tool such as WhyNoPadlock.com for a complete scan.

Fixing mixed content

1. Change hardcoded HTTP URLs in your database

Most mixed content in WordPress comes from URLs stored as http:// in the database. Use the Better Search Replace plugin:

1. Install and activate Better Search Replace
2. Search for: http://domein.nl
3. Replace with: https://domein.nl
4. Select all tables
5. First run a dry run to check how many replacements there are
6. Run the actual replacement

Note: Always make a database backup before you run a search-replace.

2. Use the Really Simple SSL plugin

The Really Simple SSL plugin fixes most mixed content automatically:

1. Install and activate Really Simple SSL
2. The plugin automatically detects your SSL certificate
3. Click "Activate SSL
4. The plugin rewrites HTTP URLs to HTTPS in the output

This is a quick fix, but it is better to change the URLs permanently in the database (method 1) so you don't depend on a plugin.

3. Force HTTPS via .htaccess

Make sure all traffic is redirected to HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This does not fix mixed content directly (it only redirects page requests, not embedded resources), but it does make sure visitors always end up on HTTPS.

4. Edit theme and plugin files

Sometimes theme or plugin files contain hardcoded HTTP URLs. Search your theme files for:

• http:// in image URLs
• http:// in script and stylesheet tags
• External resources that are only available over HTTP

Replace http:// with https:// or use protocol-relative URLs (//domein.nl/...).

5. Check external resources

If your website loads resources from external services (fonts, analytics, widgets), check whether they are available over HTTPS. Most modern services support HTTPS. If an external resource is only available over HTTP, find an alternative or host the file locally.

Preventing mixed content

• Install SSL right when you set up your website: then all URLs are stored as HTTPS from the start
• Use relative URLs: /images/logo.png instead of http://domein.nl/images/logo.png
• Set the WordPress Site URL to HTTPS: Settings → General → both URLs on https://
• Content Security Policy: add a CSP header that blocks mixed content: Content-Security-Policy: upgrade-insecure-requests

Frequently asked questions about mixed content

Is mixed content dangerous for my visitors?

Mixed passive content (images) is a limited risk. Mixed active content (scripts, stylesheets) is a serious security risk because an attacker can intercept and modify it. Modern browsers block mixed active content automatically, but this can break your website.

Why do I see mixed content after installing an SSL certificate?

Because your website content (pages, posts, widgets) still refers to resources via http://. Installing an SSL certificate encrypts the connection, but it does not automatically change the URLs in your database or files. You need to update these URLs manually or with a plugin.

Does Really Simple SSL fix all mixed content?

The plugin fixes most mixed content by rewriting URLs in the HTML output. But it is a runtime fix: the database still contains http:// URLs. It is better to run a search-replace for a permanent solution. The plugin is a good quick fix, though, if you want to solve the problem right away.

Can mixed content affect my SEO?

Yes. Google prefers fully secured HTTPS websites. Mixed content warnings can mark your website as "not fully secure", which reduces visitor trust and can indirectly affect your rankings. Always fix mixed content after installing an SSL certificate.