How to Fix Mixed Content Warnings After Installing an SSL Certificate

If you just installed an SSL certificate and your website still shows a "Not Secure" warning or a broken padlock icon instead of a full green lock, you likely have a mixed content problem. This happens when your page loads over a secure HTTPS connection but some of its resources, such as images, scripts, or stylesheets, are still being pulled in over the old unencrypted HTTP protocol.

What Causes Mixed Content

Mixed content usually happens because your website's pages, database, or theme files still contain hardcoded links that start with http:// instead of https://. This is common right after you install a new certificate on a site that was previously running on plain HTTP, since none of the old content updates itself automatically.

Typical culprits include:

• Images or media uploaded before the SSL certificate was installed
• Theme or plugin files that reference external scripts and stylesheets over HTTP
• A database that still stores your old http:// site address
• External resources such as fonts, ad scripts, or embedded videos loaded from a non-secure source

How to Check What Is Causing the Warning

1. Open your website in a browser and click the padlock or warning icon in the address bar.
2. Look for an option such as Connection is secure or Site information, then check for a mixed content or insecure content notice.
3. Open your browser's developer tools (usually the F12 key), go to the Console tab, and reload the page. Any mixed content resources will be listed as warnings, usually showing the exact HTTP URL that needs to be fixed.

Fix the URLs shown in the console one at a time. Trying to guess which resource is insecure without checking the console usually wastes time on the wrong file.

How to Fix Mixed Content

The fix happens in your website's content and code, not in your hosting control panel, so the steps below are the same whether your account is on cPanel or DirectAdmin.

If Your Site Runs on WordPress

1. Log in to your WordPress admin area and go to Settings then General.
2. Make sure both the WordPress Address (URL) and Site Address (URL) fields start with https://, then click Save Changes.
3. Install a search-and-replace plugin, or use one already installed on your site, to update any old http:// links stored in your database to https://.
4. Clear your site's cache (and your browser cache) if you use a caching plugin, then reload the page and re-check the browser console.

If Your Site Is Custom-Built or Not on WordPress

1. Open the page's source code or template files and search for any hardcoded http:// links pointing to your own domain.
2. Replace them with https://, or better, with relative paths so they always match whatever protocol the page is loaded with.
3. If the insecure resource is loaded from an external third-party site, check whether that provider also offers an https:// version of the same resource and switch to it.

Once the browser console no longer lists any insecure resources, reload the page and confirm the padlock icon shows as fully secure.

If you haven't installed a certificate yet or still need to force all traffic onto HTTPS, see How to Install a Free SSL Certificate with AutoSSL and How to Force HTTPS and Redirect All Traffic to Your Secure Website.