How to Fix Mixed Content SSL Warnings (http:// to…
You installed a free Let’s Encrypt or Cloudflare SSL certificate on your domain, yet Chrome or Safari still shows a “Not Secure” warning—or your styles break when visiting https://. When you open your browser’s Developer Console (`F12`), you see yellow and red warnings saying: “Mixed Content: The page was loaded over HTTPS, but requested an insecure image/script ‘http://…'”
Before editing your files, test your live certificate chain in our Free SSL Certificate & DNS Checker.
Is Free Hosting Holding Your Website Back?
Free hosting is great for testing, but strict CPU, inode, and Entry Process limits can knock your site offline once Google starts indexing your pages. Run our 60-second check to see what your site actually needs:
Step 1: Verify WordPress Site URLs in `Settings → General`
Log into your WordPress dashboard, open Settings → General, and confirm that both WordPress Address (URL) and Site Address (URL) start with https:// instead of http://.
Step 2: Add a Clean HTTPS Redirect & Upgrade-Insecure-Requests Header in `.htaccess`
Instead of installing a heavy SSL plugin that rewrites HTML output in PHP on every page load, let your web server handle HTTPS automatically:
- Open our Free .htaccess Rule Generator (or test custom patterns in our .htaccess RewriteRule Simulator).
- Enable the Force HTTPS (301 Redirect) rule.
- Add this single security header to `.htaccess` so modern browsers automatically upgrade any leftover `http://` image or script links to `https://` seamlessly:
<IfModule mod_headers.c>
Header always set Content-Security-Policy "upgrade-insecure-requests;"
</IfModule>Step 3: Fix Cloudflare “Too Many Redirects” Loop
If enabling HTTPS causes an `ERR_TOO_MANY_REDIRECTS` error while using Cloudflare, log into Cloudflare → SSL/TLS → Overview and change encryption mode from Flexible to Full (Strict) (if your cPanel host has a valid SSL certificate installed).
Frequently Asked Questions (FAQ)
What is a Mixed Content SSL warning in WordPress?
A Mixed Content warning happens when your webpage loads over HTTPS, but one or more hardcoded images, stylesheets, or JavaScript files on the page are still requested over insecure HTTP://.
How do I force all HTTP traffic to HTTPS in WordPress without a plugin?
Update both your WordPress Address and Site Address to https:// in Settings -> General, and add a 301 HTTPS redirect rule at the top of your .htaccess file.
How can I verify that my SSL certificate and HTTPS redirects are working?
Run your domain through the free SSL Certificate & DNS Checker and .htaccess Generator at FreeHosting.live.