Fix SSL, HTTPS and mixed content warnings
HTTPS encrypts the connection between your visitors and your site. Browsers warn users when a site does not use it properly, which hurts trust.
SSL certificate problems
If the browser shows a certificate error, the common causes are:
- No certificate has been issued for your domain yet.
- The certificate does not cover the exact name, for example www versus the bare domain.
- The certificate has expired.
- The domain's DNS does not point to your server yet, so a certificate cannot be issued.
Ask us in our Discord how certificates are handled on your plan, since this depends on the setup. Many hosts use free automatic certificates, but do not assume yours does.
What is mixed content?
Your page loads over HTTPS, but some images, scripts or stylesheets still load from http:// addresses. Browsers block or flag these, and the padlock may disappear.
Finding mixed content
- Open your site and press F12 to open the developer tools.
- Look at the Console tab for messages about mixed content.
- Each message names the file that is loaded insecurely.
Fixing it
- Change http:// links in your HTML, CSS and JavaScript to https://, or to a relative path like /images/logo.png.
- In WordPress, set the WordPress Address and Site Address to https, then use a search-and-replace plugin to update old http URLs stored in the database. Take a backup first.
- Update links to outside resources, such as fonts and scripts, to their HTTPS versions.
- Clear any caching plugin and your browser cache.
Redirect HTTP to HTTPS
Once the certificate works, redirect all http traffic to https so there is only one version of your site. How you do this depends on the web server and plan, so check before editing rules.
Redirect loops
If the page keeps reloading with a too many redirects error, your site and a proxy may both be forcing HTTPS. Remove one of the redirect rules.