Initial assessment
WP119 home › Lab records

Capability sweep (recipe r62): HTTP links to the site's own address left in content after a move to HTTPS

Recipe 20261108-sweep-r62 (r62) · Latest run 2026-11-11 · First published 2026-11-09 · Updated 2026-11-11 · Capability sweep

What the site owner saw

The site had been switched to HTTPS, but post content still contained HTTP links to the site's own address, which browsers flag as mixed content.

Source: capability sweep (one or more problem types from the "What we fix" page planted on one test site); there is no single forum thread.

Test setup and what we observed after the failure

Test site: WordPress 7.1, PHP 8.3. The table shows the HTTP status of the homepage and the login page after the recipe recreated the failure.

Server setupHomepageLogin pageNote
Apache + PHP-FPM200302
Apache + php-cgi (mod_cgid)200302
Apache + mod_php200302
nginx + PHP-FPM200302

Outcome of each run

Date (UTC)Server setupConnection modeOutcomeProduct versionNoteResult per problem type
2026-11-08Apache + PHP-FPMSSHNot detected2.1.438mixedContent: Still present
2026-11-08Apache + php-cgi (mod_cgid)SSHNot detected2.1.438mixedContent: Still present
2026-11-08Apache + mod_phpSSHNot detected2.1.438mixedContent: Still present
2026-11-08nginx + PHP-FPMSSHNot detected2.1.438mixedContent: Still present
2026-11-09nginx + PHP-FPMFTPNot detected2.1.447mixedContent: Still present
2026-11-09Apache + PHP-FPMFTPNot detected2.1.447mixedContent: Still present
2026-11-09Apache + mod_phpFTPNot detected2.1.447mixedContent: Still present
2026-11-09Apache + php-cgi (mod_cgid)FTPNot detected2.1.447mixedContent: Still present
2026-11-10nginx + PHP-FPMFTPRecovered2.1.448mixedContent: Still present
2026-11-10nginx + PHP-FPMFTPRecovered2.1.448mixedContent: Cleared
2026-11-10Apache + PHP-FPMFTPRecovered2.1.448mixedContent: Cleared
2026-11-10Apache + mod_phpFTPRecovered2.1.448mixedContent: Cleared
2026-11-10Apache + PHP-FPMSSHRecovered2.1.448mixedContent: Cleared
2026-11-10Apache + php-cgi (mod_cgid)FTPRecovered2.1.448mixedContent: Cleared
2026-11-11nginx + PHP-FPMFTPRecovered2.1.455mixedContent: Cleared

Gaps and the version that fixed them

Every run that did not end in "recovered" is listed here: what we changed, the version it shipped in, and the re-test date and outcome.

FoundServer setupConnection modeWhat we changedFixed inRe-test
2026-11-08Apache + PHP-FPMSSHThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page showed "Link security: All content links use a secure connection". The case page now leaves this row out when it cannot tell, and the count is now read correctly.2.1.4482026-11-10 · Recovered
2026-11-08Apache + php-cgi (mod_cgid)SSHThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page showed "Link security: All content links use a secure connection". The case page now leaves this row out when it cannot tell, and the count is now read correctly.2.1.448—
2026-11-08Apache + mod_phpSSHThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page showed "Link security: All content links use a secure connection". The case page now leaves this row out when it cannot tell, and the count is now read correctly.2.1.448—
2026-11-08nginx + PHP-FPMSSHThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page showed "Link security: All content links use a secure connection". The case page now leaves this row out when it cannot tell, and the count is now read correctly.2.1.448—
2026-11-09Apache + PHP-FPMFTPThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page did not show this check. The count is now read correctly. In these runs, write-back also switched the site to HTTP (see the notes).2.1.4482026-11-10 · Recovered
2026-11-09Apache + php-cgi (mod_cgid)FTPThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page did not show this check. The count is now read correctly. In these runs, write-back also switched the site to HTTP (see the notes).2.1.4482026-11-10 · Recovered
2026-11-09Apache + mod_phpFTPThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page did not show this check. The count is now read correctly. In these runs, write-back also switched the site to HTTP (see the notes).2.1.4482026-11-10 · Recovered
2026-11-09nginx + PHP-FPMFTPThe health check could not count the affected links, so the problem was not listed, the links were not changed, and the case page did not show this check. The count is now read correctly. In these runs, write-back also switched the site to HTTP (see the notes).2.1.4482026-11-10 · Recovered
2026-11-10nginx + PHP-FPMFTPThe links were fixed, but write-back switched the whole site back to HTTP because the site address was entered as HTTP when the case was opened. Write-back now keeps HTTPS in this case.2.1.4512026-11-11 · Recovered

Problem types this case covers

Notes

The 2026-11-08 runs and the later 2026-11-10 runs entered the site address as HTTPS when the case was opened. The 2026-11-09 runs, the first 2026-11-10 run, and the 2026-11-11 run entered it as HTTP; the 2026-11-11 run checks that write-back keeps HTTPS. After the fix, all four setups were re-run over FTP; over SSH, only Apache + PHP-FPM was re-run. The 2026-11-08 runs used the small test site; the runs from 2026-11-09 on used the copy of the online store test site. WP admin mode was not run in this series.

Changes to this record

These are records from our test servers, for a given product version on a given day. They are not a promise about the result on any site. Other hosts, PHP versions, and WordPress versions can behave differently.

Initial assessment →