Client Portal
Knowledge Base

How do I fix mixed content after enabling HTTPS?

Mixed content happens when a page opens over HTTPS but still requests an image, script, stylesheet or other resource over HTTP. Fix the insecure resource address in the website itself, then clear the relevant cache and check the page again. Renewing the page's certificate does not rewrite links stored in your website.

Check which warning you have

  • Open the exact affected page using https://. If the browser stops you with an expired-certificate or name-mismatch warning before showing the page, follow our SSL-certificate guide first. Do not bypass the warning. A certificate error and mixed content need different checks.
  • If the page loads but images, styling, fonts, scripts or an embedded item fail, note which pages and features are affected. A single old image reference may affect one page; a theme asset can affect the whole site.
  • Use the browser's developer console to identify the request. For a desktop example, in Firefox press Ctrl+Shift+K on Windows or Command+Option+K on a Mac to open Console. Reload the page and look for a message mentioning Mixed Content and an http:// address. Copy that address and the page URL. If you cannot inspect the page on your device, send us its URL and the warning so we can help identify the request.
  • Browsers can upgrade some insecure requests to HTTPS and block others. A page that looks correct can still contain old HTTP references. Use the console message to locate the reference rather than assuming every missing image has this cause.

Replace the specific insecure reference

  • Before editing files or changing stored website content, make a website backup. Note the affected page and the old resource address so the edit can be reversed.
  • Open the resource address with https:// in place of http:// and confirm that it loads the intended item without a certificate warning. Do not change the stored address until you have checked the replacement.
  • For an image or embed placed in a page, open that page in the website editor you use to maintain it. Find the item matching the address reported in Console, replace its HTTP address with the checked HTTPS address and save that page. Editing an unrelated image or only the page's visible link will not fix a request stored elsewhere.
  • For a resource supplied by another website, use its working HTTPS address. If it has no secure version, replace or remove that item. Do not allow insecure content in the browser to keep an old embed working.
  • If the address comes from a theme, plugin, stylesheet or database setting, give the exact request to the website maintainer. Ask them to change its source and test the affected feature. Do not run a plain database-wide text replacement: WordPress and other applications can store structured values that need an application-aware migration tool.
  • After a website move, several old addresses may remain in content or settings. Use our WordPress migration guide to review the wider move rather than fixing only the first visible warning.

Verify the fix

  • Follow our cache-clearing guide for the website and any delivery service you use. Then open the affected page in a private window and inspect Console again.
  • Check the home page and the pages sharing the changed item. Confirm that images, styling, menus, forms and embeds still work.
  • If the warning remains, open Support → New Ticket → Tech/Server. Include the affected page, full insecure resource address, console message and the edit you made. Do not send website-admin or database passwords.