Mixed content on HTTPS

Mixed content happens when an HTTPS page loads resources (images, scripts, stylesheets) over the unsecured HTTP protocol. This creates security problems and can trigger browser warnings.

What mixed content is

There are two types of mixed content:

• Active mixed content — scripts, stylesheets and iframes that can change the page
• Passive mixed content — images, audio and video

Modern browsers block active mixed content and warn about passive mixed content.

Signs of the problem

• Warnings in the browser console about insecure content
• A padlock in the address bar that isn’t closed
• Parts of the page not displaying correctly
• Messages such as “Mixed Content Warning”

Diagnosing the problem

Step 1: Check in the browser

1. Open your site in a browser (Chrome or Firefox)
2. Press F12 to open the developer tools
3. Go to the Console tab
4. Look for mixed content warnings

Step 2: Online tools

Use a specialist service:

• Why No Padlock?
• SSL Check

Fixing it through cPanel

Method 1: Using .htaccess

1. Log in to cPanel
2. Open File Manager
3. Go to your site’s root directory (usually public_html)
4. Find the .htaccess file (create it if it doesn’t exist)
5. Add the following code at the top of the file:

# Force a redirect to HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Content-Security-Policy header to upgrade insecure content
<IfModule mod_headers.c>
    Header always set Content-Security-Policy "upgrade-insecure-requests"
</IfModule>

Method 2: SSL/TLS settings in cPanel

1. Log in to cPanel
2. Find the Security section
3. Open SSL/TLS Status
4. Click Run AutoSSL to install a certificate automatically
5. Make sure all your domains have an active SSL certificate

Method 3: Fixing the database (for WordPress)

If you use WordPress:

1. Open phpMyAdmin in cPanel
2. Select your site’s database
3. Run an SQL query to replace the URLs:

UPDATE wp_options 
SET option_value = REPLACE(option_value, 'http://yoursite.com', 'https://yoursite.com') 
WHERE option_name = 'home' OR option_name = 'siteurl';

UPDATE wp_posts 
SET post_content = REPLACE(post_content, 'http://yoursite.com', 'https://yoursite.com');

UPDATE wp_postmeta 
SET meta_value = REPLACE(meta_value, 'http://yoursite.com', 'https://yoursite.com');

Method 4: Editing theme files

1. In File Manager, go to the theme directory
2. Find files with hard-coded HTTP links
3. Replace every http:// with https://, or use relative paths
4. Save your changes

Checking after the fix

1. Clear your browser cache (Ctrl+F5)
2. Clear your site’s cache (if you use one)
3. Check the browser console for errors
4. Make sure the padlock in the address bar is closed

Further recommendations

• Use relative URLs — instead of http://example.com/image.jpg, use /image.jpg
• Protocol-relative URLs — use //example.com/style.css instead of http://
• Check regularly — scan your site for mixed content from time to time
• CDNs and external resources — make sure all external libraries are loaded over HTTPS

Troubleshooting

Problem: .htaccess isn’t working

Solution:

• Check that mod_rewrite is enabled
• Make sure AllowOverride is enabled in the Apache configuration
• Check the syntax of the .htaccess file

Problem: no SSL certificate is installed

Solution:

1. In cPanel, open SSL/TLS
2. Use Let's Encrypt (free SSL)
3. Or install a certificate manually through Manage SSL sites

Problem: mixed content from external sources

Solution:

• Upload the resources to your own server
• Use the HTTPS versions of external resources
• Use the Content-Security-Policy header

Useful links

• MDN: Mixed Content
• cPanel Documentation
• Let's Encrypt

See also

• SSL certificates
• Website security
• HTTPS configuration
• cPanel guides