WordPress Mixed Content: Site Uses HTTPS but Assets Load Over HTTP

Home » Bug fixes » WordPress Mixed Content: Site Uses HTTPS but Assets Load Over HTTP
April 10, 2019 Bug fixes, WordPress
WordPress Mixed Content: Site Uses HTTPS but Assets Load Over HTTP

Your site runs on HTTPS, but images, scripts, or stylesheets are still loading over HTTP. Browsers block these “mixed content” requests — and in some cases they cause Gutenberg to fail saving. The root cause is almost always a hardcoded http:// URL somewhere in wp-config.php or the database.

Problem: After migrating a WordPress site to HTTPS, the browser shows a "mixed content" warning and the padlock icon disappears because some assets — images, scripts, or stylesheets — are still referenced with http:// URLs.

Solution: Fix the site URL constants in wp-config.php first, then run wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables with WP-CLI to update all hardcoded references in the database, including serialised data.

Open the browser console. If you see a Mixed Content warning, the first thing to check is wp-config.php. A common mistake is defining WP_SITEURL or WP_HOME with a hard-coded http:// scheme:

// ❌ Wrong — forces all asset URLs to use HTTP even on an HTTPS site
if ( $_SERVER['SERVER_NAME'] === 'example.com' ) {
    define( 'WP_SITEURL', 'http://' . $_SERVER['HTTP_HOST'] . '/' );
} else {
    define( 'WP_SITEURL', 'http://' . $_SERVER['HTTP_HOST'] . '/sitename/' );
}

// ✅ Correct — respects the current request scheme
if ( $_SERVER['SERVER_NAME'] === 'example.com' ) {
    define( 'WP_SITEURL', 'https://' . $_SERVER['HTTP_HOST'] . '/' );
    define( 'WP_HOME',    'https://' . $_SERVER['HTTP_HOST'] . '/' );
} else {
    define( 'WP_SITEURL', 'http://' . $_SERVER['HTTP_HOST'] . '/sitename/' );
    define( 'WP_HOME',    'http://' . $_SERVER['HTTP_HOST'] . '/sitename/' );
}

If the URLs in wp-config.php look fine, the problem may be in the database. Use WP-CLI's search-replace to fix all stored URLs at once:

# Dry run first — preview what would change
wp search-replace 'http://example.com' 'https://example.com' --dry-run

# Apply the replacement (handles serialized data correctly)
wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid

For a plugin or theme that enqueues an asset with a hardcoded http:// URL, use a protocol-relative URL or override the handle:

// Override a plugin's asset URL to be protocol-relative
add_filter( 'script_loader_src', function( $src, $handle ) {
    if ( $handle === 'some-plugin-script' ) {
        $src = set_url_scheme( $src, 'https' );
    }
    return $src;
}, 10, 2 );

NOTE: Gutenberg uses the REST API to save posts. If the REST API request is blocked by a mixed-content error or a redirect from HTTP to HTTPS, the save will fail with a generic "Updating failed" message. Fixing the mixed-content issue resolves the Gutenberg saving problem as well.

Related posts