Mixed content warnings
You bought the padlock. Your page keeps propping the door open.
Mixed content is an HTTPS page loading pieces of itself — images, scripts, styles — over plain HTTP. Browsers respond by breaking your padlock, hiding images, or silently refusing to run scripts. The certificate is fine; the page's own shopping list is what's insecure.
Same-day diagnosis. Flat quote before any fix.
What’s actually happening
When your secure page requests an insecure resource, the browser faces a contradiction: it promised the user an encrypted session, and the page is asking it to fetch something eavesdroppable. Browsers resolve this by tiers — 'passive' content like images may load with a degraded padlock, while 'active' content like scripts and stylesheets is blocked outright. That's why mixed content shows up as anything from a subtle warning to a visually broken, half-functional page.
The HTTP references live in three habitats. The database: years of content with hardcoded http:// image URLs, plus theme options saved before the SSL era. The code: themes and plugins with http:// baked into templates. And third parties: embedded widgets, fonts, or trackers served insecurely. A proper fix sweeps all three, because fixing two of them keeps the warning alive and the diagnosis confusing.
The usual causes, ranked
After twenty-seven years of these calls, the odds are well mapped. Start at the top.
Hardcoded HTTP URLs in old content
Every image inserted before the SSL migration carries its http:// address in the database. The migration changed the site's address, not the content's memory of itself.
An incomplete HTTPS migration
The certificate installed, the URLs never rewritten — the half-migration that produces years of intermittent warnings.
Theme and plugin hardcoding
Templates echoing http:// asset paths regardless of the site's protocol — invisible until you view source.
Insecure third-party embeds
That old widget or map embed served over HTTP — your page inherits its insecurity, and only they can truly fix their end (though we can often swap or shim it).
What you can safely try first
Nothing below can make things worse — that’s the selection criterion. Anything riskier belongs in professional hands, on a backup.
- 1
Open the browser console on an affected page
F12 → Console. Mixed-content warnings name the exact insecure URLs — the browser hands you the complete shopping list of offenders.
- 2
Sort the list by habitat
Your own domain with http://? Database or code. Someone else's domain? Third-party embed. The split decides the fix route.
- 3
Check whether the padlock breaks sitewide or per-page
Sitewide implicates templates and theme options; scattered pages implicate content. Another free halving of the search space.
Stop and call when…
- The database rewrite is the fix — serialized-data-safe search-replace is tooling work, not a find-and-replace
- Warnings persist after the obvious fixes — hunting stragglers through minified code and CSS files is patience work
- An e-commerce checkout shows the warning — trust at the payment moment is worth expert hands today
From there it’s our job: same-day look, flat quote, and the $229 flat repair covers most cases of exactly this.
Single Error Fix — buy it now, skip the hunt.
One error, hunted down and fixed — 500s, white screens, redirect loops, broken pages.
Covers one specific error or broken behavior on one site. Diagnosis, the fix, and a plain-English note on what happened. If we can't fix it, you get a full refund.
Questions we hear a lot.
Does mixed content actually matter if the site works?
It costs you twice. Trust: the broken padlock or 'Not Secure' flicker lands exactly where visitors decide whether to submit a form or a card number. Function: browsers hard-block insecure scripts and styles, so features quietly fail — often blamed on everything but the real cause. It reads as cosmetic; it behaves as structural.
I installed an SSL certificate — why isn't that enough?
The certificate secures the connection to your server; it says nothing about where your pages fetch their pieces from. A migration has two halves — encrypt the channel, then update every internal reference to use it. Most 'SSL problems' years after an install are the second half never having happened.
What does the $229 fix include?
The console-level audit, a serialization-safe database rewrite of HTTP references, template and settings corrections, third-party embeds swapped or secured, and verification page-by-page until the padlock holds everywhere — including checkout, if you have one. Documented before and after.
Related symptoms & help
Errors travel in packs. If this one visited, check its friends.
Make the padlock mean it. Every page.
Send the symptom, get a same-day look and a flat quote from the developer who's fixed this exact thing more times than either of us can count.