Switch your website to HTTPS and fix mixed content

Your SSL certificate is installed, yet the browser still shows "Not secure", a crossed-out padlock or a warning in the console? It is almost always mixed content: the page is served over HTTPS, but some elements are still loaded over HTTP. This guide explains how to move your website fully to HTTPS and fix those elements, especially on WordPress.

Before you start

• The free certificate must be active on your domain, see Activate the free SSL certificate.
• Create a backup of your website from Backups before changing addresses in bulk, see Restore a backup of your website.
• Keep your website admin login (WordPress or other) at hand.

Switch your website to HTTPS step by step

1. Open your hosting in your client area, then SSL.
2. If the domain is marked not secure, click Install.
3. Turn on Redirect HTTP to HTTPS.
4. In your website admin, replace the http:// address with https://. On WordPress: Settings, General, fields "WordPress Address (URL)" and "Site Address (URL)".
5. Replace the old http:// addresses in your content (images, internal links, menus, widgets).
6. Clear the caches: caching plugin, browser, and any content delivery network (CDN).
7. Open several pages in a private window and check that the padlock appears everywhere.

What is mixed content?

Mixed content happens when a page loaded over https:// calls resources over http://: an image, a font, a script, an embedded video, a stylesheet. Those resources are not encrypted, so the browser treats the page as only partly secure.

There are two kinds:

• Passive mixed content (images, videos, audio): the browser often displays it, but removes the padlock or shows a warning.
• Active mixed content (scripts, stylesheets, iframes): the browser blocks it. The result: a broken layout, a menu that no longer opens, a form that will not submit.

How do you find the HTTP elements?

1. Open the page in Chrome, Firefox, Edge or Safari.
2. Open the developer tools (F12, or right-click then "Inspect").
3. Go to the Console tab: every mixed content element is listed with its full address.
4. Note where each address comes from: a post, the theme, a plugin, a widget.

You can also view the page source and search for http:// to spot the remaining calls.

Fix mixed content on WordPress

• Site addresses: check in Settings, General that both addresses start with https://.
• Content already published: images inserted before the switch keep their old address in the database. A search and replace plugin lets you replace http://your-domain.com with https://your-domain.com across the whole database. Make a backup right before.
• Theme and page builder: some themes store full addresses in their own settings (logo, background image, fonts). Open their options and save the images again.
• Old plugins: a plugin that loads an external script over http:// must be updated or replaced, see Update WordPress, plugins and themes.
• Custom code: in your child theme files, replace hard-coded addresses with https:// or relative addresses.

Fix mixed content on a hand-built website

Open your website files in Files or over FTP, see Connect with FTP or SFTP, and replace the http:// addresses of your images, scripts and stylesheets. For your own resources, a relative address (/images/logo.png) works whatever the protocol. For an external resource (font, library, video), use its https:// version: almost every service offers one.

Does switching to HTTPS hurt SEO?

No, if it is done properly. The redirect sends visitors and search engines to the secure version, and Google transfers rankings to the new addresses. To speed things up:

• Add the https:// version of your website in Search Console and submit your sitemap there.
• Update the links on your profiles (social networks, directories, business listing).
• Check that your canonical tags and your sitemap use https://.

Frequently asked questions

Why is my website "Not secure" when I have an SSL certificate?

Either the HTTPS redirect is not turned on and you are viewing the http:// version, or the page contains mixed content. Turn on Redirect HTTP to HTTPS, then check the browser console to find the elements still on HTTP.

How do I force HTTPS on my website?

Open your hosting, then SSL, and turn on Redirect HTTP to HTTPS. All visitors then land automatically on the secure version.

Why is my layout broken after switching to HTTPS?

A stylesheet or script is probably still loaded over http:// and blocked by the browser. The developer tools console tells you exactly which one.

I can no longer log in to WordPress after changing the address, what should I do?

Check that the certificate is installed and that the address you typed is correct, with no typo. If you are locked out, restore the backup made before the change, see Restore a backup of your website, or open a ticket.

Do I need to switch to HTTPS again at each certificate renewal?

No. The certificate is renewed automatically and the redirect stays active. You switch to HTTPS only once.