Why does a Mixed Content warning appear?

Mixed content occurs when an HTTPS page requests another resource over insecure HTTP. The resource might be an image, style sheet, script, font, video, iframe, or API call. Browsers often block active content such as scripts because it could be altered in transit, while other insecure items may display with a warning.

Open the browser developer console and network panel to find the exact HTTP requests. Check the page content, theme templates, CSS files, JavaScript, widgets, and database settings where those URLs may be stored. A cached page can continue showing an old request after the source has been corrected.

Change each resource to a valid HTTPS address. Protocol-relative URLs are less clear than explicit HTTPS and do not fix a service that lacks a working certificate. For third-party content, use the provider’s secure endpoint, replace the service, or host an authorized local copy when licensing and maintenance allow it.

Run a controlled search and replacement for internal URLs, then clear WordPress, server, CDN, and browser caches. Test the home page along with products, old articles, page-builder layouts, and other page types. Insecure links may appear only on specific URLs or inside inline styles.