Initial assessment
WordPress Error Cases

Mixed Content: The page at '…' was loaded over HTTPS, but requested an insecure …

“Mixed Content: The page at … was loaded over HTTPS” in WordPress: causes and what to check

Updated 2026-10-31
# Common log entries
Mixed Content: The page at 'https://…/' was loaded over HTTPS, but requested an insecure image 'http://…/wp-content/uploads/…'.

Browsers show this console message, and often a “Not secure” label, when an HTTPS page loads images, scripts, or styles over http://. On WordPress sites the http:// addresses usually come from content and settings saved before the switch to SSL.

Which of these matches what you see?

Post content and post meta still store image URLs that start with http://. The browser console lists each one.

The theme, a widget, or page builder settings hold http:// URLs, and browsers block insecure scripts and styles.

The siteurl and home values in the options table still start with http://, so WordPress builds http:// links on every page.

Common causes

Old content URLs: Post content and wp_postmeta store http:// image and link URLs.
Site address settings: siteurl and home in wp_options still use http://.
Hardcoded theme URLs: Theme files, widgets, or page builder settings contain http:// URLs, some inside serialized data.
SSL at a proxy or CDN: SSL ends at a proxy, and WordPress does not detect HTTPS.

References

  1. Mixed content (MDN Web Docs)
  2. HTTPS (Advanced Administration Handbook)

What the system does

Insecure links left in the content are handled automatically: the system replaces internal http links with https across the site. Fixes are made on a copy of your site in the recovery station and written back only after re-verification passes. In your site’s database, the protected tables (members, comments, orders and form submissions) are copied as structure only. In SSH and FTP mode, the system creates a pre-recovery backup on your host before writing back and restores from it if verification after write-back fails. If the recovery cannot be completed, the recovery fee is refunded in full.

  1. Initial assessment: Enter the site URL
  2. Copy to the recovery station: Work runs on the copy
  3. Find the cause: Item-by-item checks
  4. Recover and re-check: Home and inner pages
  5. Write back or deliver: Only after re-checks pass

Use WP119 when the http:// addresses sit in post content and settings across many pages.

Assess my site →
Initial assessment →