HTTPS leftovers and mixed content mistakes that break small WordPress sites

Installing SSL is the easy part. On small WordPress sites the broken padlock usually comes later: hard-coded http:// in the database, mixed active content, forms that still post to HTTP, and myths about admin-over-HTTP. This is not a redirect-chain audit and not a soft-404 triage. It is TLS leftovers after go-live — what still loads insecurely, why Chrome complains, and which fixes are real.

Redirects appear only where http→https single-hop hygiene matters: one clean jump to HTTPS, then stop. Long chains belong to a different wave.

What "secure" actually means in the browser

A green-ish padlock (or at least no "Not secure") means roughly:

1. The page URL is https://
2. The certificate chain validates for that host
3. No active mixed content was allowed to run
4. Forms that collect data do not submit to http://
5. Passive mixed content (images, video, audio) is discouraged and often warned

Google can still crawl HTTP URLs. Users and Chrome treat them as second-class. Search prefers HTTPS when signals are equal; the practical win is trust, fewer warnings, and one canonical host scheme — settle scheme/host the same way you settle canonical tags for duplicates.

HTTP leftovers after SSL (the WordPress tax)

Freelancers often flip Let's Encrypt on, force HTTPS in Rank Math/Really Simple SSL, and call it done. The database still remembers the old world:

Leftover	Symptom
siteurl / home still http://	Admin loops, asset URLs wrong, mixed bag of schemes
Post content with hard-coded http://yoursite.com/...	Images/scripts break padlock on money pages
Widget / Customizer CSS with absolute HTTP URLs	Theme loads mixed
Old CDN / analytics snippet on http://	Active or passive mixed content
Plugin options storing full HTTP asset URLs	One plugin undoes the whole migration
Email templates / PDF generators baking HTTP links	Users land on HTTP, then bounce through a redirect

Do this: Settings → General → both addresses HTTPS. Dry-run DB search-replace for http://yourdomain only — not every http on the internet. Re-save permalinks once. Spot-check Home + money URLs in view-source for same-host http:// assets.

External campaign links can still use a URL shortener; on-site HTML and siteurl should be HTTPS-only.

Mixed content: active vs passive

Passive (mostly display): images, video, audio loaded over HTTP on an HTTPS page. Browsers may still show the page with a warning or block in stricter modes. Users see "Not fully secure."

Active (scripting / control): scripts, stylesheets, iframes, XHR/fetch, WebSockets over HTTP on an HTTPS page. Modern browsers block these. Your menu JS dies, your form validation vanishes, your pixel never fires — and the console fills with mixed-content errors.

WordPress-specific active traps:

• Old jQuery or slider plugins still pointing at http://
• Hotlinked third-party widgets that never upgraded
• Dusty child-theme font/icon kits on http://
• Insecure iframes for maps, booking, or payment sandboxes

Fix order: DevTools → Console / Security. List blocked URLs. Upgrade same-host assets to absolute HTTPS. Replace or remove third-party HTTP endpoints. Do not "fix" active mixed content by serving the page over HTTP again.

Insecure forms (the quiet conversion killer)

Chrome flags pages where a form action targets http:// even if the page itself is HTTPS. Contact forms, newsletter boxes, login, checkout — anything that posts credentials or PII over cleartext earns a hard warning.

Check:

• Form action= attributes in the HTML (plugins love absolute URLs)
• AJAX endpoints that still call admin-ajax.php via HTTP
• Payment or CRM embeds that open HTTP endpoints
• "Thank you" redirects that drop users onto HTTP (single hop back to HTTPS is hygiene; do not stack extras)

Cross-origin posts still need an HTTPS destination. There is no SEO prize for an insecure lead form.

Myth: "Never use wp-admin over HTTPS" / "Admin over HTTP is safer"

You will still hear that SSL breaks admin, or that HTTP admin somehow avoids cookie theft.

Reality:

• Admin over HTTP sends cookies and passwords in cleartext on shared networks — the opposite of safer.
• Most "SSL broke my admin" tickets are mixed content or wrong siteurl, not TLS: HTTP assets in /wp-admin/, a proxy missing X-Forwarded-Proto, or a cached redirect loop.
• FORCE_SSL_ADMIN and host-level HTTPS for admin are normal, not exotic.

If admin breaks after SSL: private window, Console for mixed active content, verify siteurl/home, confirm the proxy tells PHP the request was HTTPS. Fix those before disabling HTTPS for admin "temporarily."

Real broken-padlock causes (frequency order on small WP)

1. Hard-coded HTTP images in post content
2. Active mixed scripts from abandoned plugins
3. siteurl still HTTP or half-migrated
4. Insecure form actions
5. Third-party embeds stuck on HTTP
6. Service worker / cache serving old HTTP asset map
7. Certificate name mismatch (www vs apex) — different problem, same user panic

Not on this list: "Google hates my H1" or "I need a longer redirect chain." Prefer one 301 from HTTP to HTTPS on the final host. Apex↔www is a separate single choice. Multi-hop HTTP→HTTPS→www→slash theater is redirect-wave territory — here the scheme hop just needs to be clean and immediate.

HSTS basics (lightly)

HTTP Strict Transport Security tells browsers: for this host, speak HTTPS only for a while (max-age), optionally including subdomains, optionally preloadable.

On small sites: enable HSTS after HTTPS works everywhere you care about; start with a modest max-age; use includeSubDomains only if every real subdomain is ready; skip preload until you are sure. HSTS does not fix mixed content inside a page — it is a seatbelt after migration, not the migration itself.

30-minute hygiene pass

1. Visit http://yoursite.com — one hop to HTTPS? Same host you intend?
2. Settings → General: both URLs HTTPS.
3. View-source Home + 3 money URLs: no same-host http:// assets.
4. DevTools Security/Console: zero active mixed content.
5. Submit a test contact form: action and AJAX over HTTPS.
6. Log into /wp-admin/ over HTTPS; Console clean.
7. Optional: enable HSTS at host/CDN once the above is green.
8. Spot-check GSC for leftover HTTP URLs; ensure internal links and sitemap entries use HTTPS.

Closing

SSL is a certificate. HTTPS hygiene is database URLs, asset schemes, forms, admin, and one clean http→https hop. Mixed active content breaks pages; insecure forms break trust; admin-over-HTTP myths break security. Fix leftovers before you rewrite copy.

More practical technical notes: blog.

— Riichi Mirza