Mixed content occurs when an HTTPS page requests assets through HTTP. The main certificate can be valid while browsers block scripts, styles, images or embedded resources referenced insecurely.
IN THIS ARTICLE
01 What you need before you begin
Back up application settings and identify a reproducible page. Open browser developer tools and inspect the Console and Network views for blocked HTTP requests.
02 Find mixed content when HTTPS works through Cloudflare
- List the exact insecure resource URLs and identify whether each is generated by your theme, database content, plugin, stylesheet or an external service.
- Confirm the resource is actually available over valid HTTPS before changing its URL.
- Update the application’s canonical site URL and correct the source references using its supported tools. Use a serialization-aware migration tool where the application requires one.
- Review Cloudflare’s Automatic HTTPS Rewrites as an additional aid where available, without assuming it can fix every dynamic or third-party reference.
- Clear the relevant application and CDN caches, then reload the affected pages and test forms, menus and embedded content.
03 Confirm the expected result
The page should load required resources over valid HTTPS without mixed-content warnings. Check several templates because an issue may appear only on older articles or one plugin’s output.
04 Troubleshoot unexpected results
If an external resource has no HTTPS support, replace it or remove that integration rather than disabling browser protection. Do not perform an unreviewed global database string replacement that can corrupt application data.
05 Example: replace an insecure image URL without breaking the page
Open browser developer tools on the affected HTTPS page and identify a specific mixed-content request. Record the original URL and whether it belongs to your website or an external service.
For your own content, confirm the resource works over HTTPS before updating its reference in the application. Use the application's supported editing or search-and-replace method. Do not run an unrestricted text replacement across serialized data or files you have not backed up.
Why does the browser still report a problem after the change?
Check whether the response is cached, whether another page template still contains the insecure URL, or whether a third-party script generates the request. A valid certificate at Cloudflare does not automatically rewrite every URL stored in your website.
After correcting the source, purge only the relevant caches where practical and test the page in a fresh session. Check forms, fonts and scripts as well as images. Send us the public page and blocked resource URL when you need help, without including authentication cookies or private account pages. We can help identify the source of the insecure request while keeping your HTTPS protection in place.
Does an HTTPS redirect fix every mixed-content request?
No. Browsers can block certain insecure requests before following a redirect. Correct the original resource references and verify the resulting page.