Mixed Content Warning
Your site has SSL, but some pages still show "Not Secure" or a broken padlock because they load insecure images, scripts, or embeds over plain http.
Common signs of this issue
- The site has https:// and a certificate, but the padlock is broken, has a warning triangle, or says "Not Secure" on some pages.
- Certain images, fonts, or embedded items don't load on the secure version of a page.
- The browser's developer console mentions "mixed content" or "insecure resources" (that message names the exact files).
- It started right after switching the site to https — the classic timing.
- Only pages with a particular embed — an old map, video, slider, or pasted-in image — show the warning.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Map which pages warn and which don't — mixed content is per-page, so the warning pages share something: usually one embedded item or one batch of old content.
- Get the exact culprits named: on a warning page, open the browser's developer console (F12 → Console tab) and look for "Mixed Content" lines — each one names the exact http:// file being loaded. This turns the whole job from hunting into a checklist. A free "mixed content checker" website does the same scan without touching F12.
- Understand what you're looking for: items loading from
http://addresses inside an https page. On WordPress sites the usual sources are old post images pasted years ago, theme/customizer settings holding an http logo or background, and third-party embeds (maps, videos, widgets) added before your https switch. - Check the timing: if this appeared right after enabling SSL, it's expected — the certificate secured the page, and now every old http link inside your content stands out. That's cleanup, not a malfunction.
- For a single suspect embed, temporarily remove it and reload in a private window — warning gone means you've found it; re-add it with an https version of the same embed code.
- Check whether your https switch included a redirect and address update: if the site's own internal links still say http (they redirect, but some resources don't), a proper site-address update or an SSL plugin's content fixer addresses it wholesale.
What this usually means
The page itself travels encrypted, but it pulls in one or more items over plain http — and the browser downgrades the whole page's trust indicator until every item is secure. One forgotten http image is enough to break the padlock. Modern browsers also now block many insecure items outright rather than just warning — which is why a mixed-content page can have missing images and dead scripts, not merely a scary icon.
It's overwhelmingly a legacy artifact of the https switch: content written in the http era still references http addresses. The durable fix is updating those references to https — individually for a few (the console list), or wholesale via a careful search-and-replace or an SSL plugin's automatic rewriting for thousands.
There's a hierarchy of concern: insecure images are a trust/cosmetic problem; insecure scripts are an actual security concern (an attacker on the network could tamper with them), which is why browsers block those hardest. Either way the destination is the same — everything over https — and it's a finite, checkable list.
What not to do
- Don't ignore it — visitors see "Not Secure" on your https site (undermining exactly what SSL bought you), and browsers silently block some of your content from loading at all.
- Don't remove SSL to make the warning disappear — that's trading a partially-secure site for a fully-insecure one, plus the ranking and browser-warning penalties of http.
- Don't bulk-edit the database to swap http→https without a backup and a serialization-aware tool — naive find-and-replace corrupts settings in subtle ways.
- Don't fix by deleting content that warns — the images and embeds are fine; only their addresses need the s added.
- Don't stack multiple SSL/mixed-content plugins — one configured properly does the job; two rewrite each other's output unpredictably.
When to get help
A page or two of mixed content is a satisfying DIY fix — the console names each file; you update each address. A large older site with years of http-era content is worth one careful professional pass: a proper database-level address migration (with backup), theme settings audit, and a scan to verify zero warnings site-wide. It's tidy, well-bounded work, typically done within an hour or two, and it finishes the https switch your certificate only started.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
I have SSL — why does my site still say Not Secure?
Something on the page (an image, script, or embed) still loads over insecure http, and the browser flags the whole page until every item is https. The developer console (F12) names the exact files — it's a checklist, not a mystery.
How do I find which items are insecure?
Open the warning page, press F12, choose Console, and read the 'Mixed Content' lines — each names one http:// file. Free online mixed-content checkers scan whole pages the same way if F12 feels foreign.
Is mixed content dangerous or just ugly?
Both, by degree: insecure images mainly cost trust; insecure scripts are a real security issue (tamperable in transit), which is why browsers block them outright. Either way, the fix — https addresses for everything — is the same.
Why do some images just not load instead of warning?
Modern browsers auto-block or auto-upgrade many insecure items rather than merely warning. An http image that can't be served over https simply vanishes. Fixing the addresses restores them.
Can a plugin fix mixed content automatically?
On WordPress, yes — SSL plugins (like Really Simple SSL) rewrite http references to https on the fly, and it's a legitimate fix. The cleaner long-term approach also updates the stored content, but plugin rewriting plus a correct site address handles most sites well. Use one such plugin, not several.
Will fixing mixed content help my SEO?
Modestly and indirectly: fully-secure pages keep the https ranking benefit intact, stop browser blocking from breaking your content, and remove a visible trust penalty. Mainly, it finishes the job the SSL certificate was supposed to do.