SSL Insecure Content Fixer


Clean up your WordPress website’s HTTPS insecure content and mixed content warnings. Installing the SSL Insecure Content Fixer plugin will solve most insecure content warnings with little or no effort. The remainder can be diagnosed with a few simple tools.

When you install SSL Insecure Content Fixer, its default settings are activated and it will automatically perform some basic fixes on your website using the Simple fix level. You can select more comprehensive fix levels as needed by your website.

WordPress Multisite gets a network settings page. This can be used to set default settings for all sites within a network, so that network administrators only need to specify settings on sites that have requirements differing from the network defaults.

See the SSL Insecure Content Fixer website for more details.


Many thanks to the generous efforts of our translators:

If you’d like to help out by translating this plugin, please sign up for an account and dig in.


SSL Insecure Content Fixer does not collect any personally identifying information, and does not set any cookies.



  1. Either install automatically through the WordPress admin, or download the .zip file, unzip to a folder, and upload the folder to your /wp-content/plugins/ directory. Read Installing Plugins in the WordPress Codex for details.
  2. 「プラグイン」メニューからプラグインを有効化します。

If your browser still reports insecure/mixed content, have a read of the Cleaning Up page.


Installation Instructions
  1. Either install automatically through the WordPress admin, or download the .zip file, unzip to a folder, and upload the folder to your /wp-content/plugins/ directory. Read Installing Plugins in the WordPress Codex for details.
  2. 「プラグイン」メニューからプラグインを有効化します。

If your browser still reports insecure/mixed content, have a read of the Cleaning Up page.

How do I tell what is causing the insecure content / mixed content warnings?

Look in your web browser’s error console.

NB: after you open your browser’s console, refresh your page so that it tries to load the insecure content again and logs warnings to the error console.

Why No Padlock? has a really good online test tool for diagnosing HTTPS problems.

I get “insecure content” warnings from some of my content

You are probably loading content (such as images) with a URL that starts with “http:”. Take that bit away, but leave the slashes, e.g. //; your browser will load the content, using HTTPS when your page uses it. Better still, replace “http:” with “https:” so that it always uses https to load images, e.g.

If your page can be used outside a web browser, e.g. in emails or other non-web documents, then you should always use a protocol and it should probably be “https:” (since you have an SSL certificate). See Cleaning up content for more details.

My website is behind a load balancer or reverse proxy

If your website is behind a load balancer or other reverse proxy, and WordPress doesn’t know when HTTPS is being used, you will need to select the appropriate HTTPS detection settings. See my blog post, WordPress is_ssl() doesn’t work behind some load balancers, for some details.

I get warnings about basic WordPress scripts like jquery.js

You are probably behind a reverse proxy — see the FAQ above about load balancers / reverse proxies, and run the SSL Tests from the WordPress admin Tools menu.

I changed the HTTPS Detection settings and now I can’t login

You probably have a conflict with another plugin that is also trying to fix HTTPS detection. Add this line to your wp-config.php file, above the lines about ABSPATH. You can then change this plugin back to default settings before proceeding.

I still get “insecure content” warnings on my secure page

Post about it to the support forum, and be sure to include a link to the page. Posts without working links will probably be ignored.

You listed my plugin, but I’ve fixed it

Great! Tell me which plugin is yours and how to check for your new version, and I’ll drop the “fix” from my next release.


It works

I had the “The website is not fully secure” warning, and now it’s gone

Fantastic – Solved all my problems

I’ve been trying to remove some unsafe scripts for days. I had to use capture all and even a different detection setting to standard but finally the sites are good. Thank you very much, five stars plus…

Does the job – just takes some time to propagate on mobile (Jupiter theme 6.1.5)

UPDATE Sept. 6 – this DOES work on mobile, it just takes longer for the HTTPS changes to propagate there! I’ve used it on two sites so far and it’s worked excellently. I have upgraded my rating from 3 to 5 stars and can confidently recommend this hidden gem of a plugin to fix any sort of SSL mixed-content issues, as a last resort.

I am using this plugin on Jupiter theme version 6.1.5, where my website’s blog page had mixed content. I installed this plugin and while the blog page SSL errors got fixed on the desktop side (Even though initially it took a long time for the images to load), the blog page still shows up as mixed content on both iOS and Android. This is really important to consider since more than 50% of internet traffic comes from mobile devices, so be mindful when you install this and take note of the theme you’re using when you write anything about it.

Simple and Fast

I found this plugin to secure my content site, installed, and secured the site on general settings by adding https. A few errors showed up, so I adjusted the settings on the plugin for a deeper fix, and I was done in less than ten minutes. Amazing!



SSL Insecure Content Fixer はオープンソースソフトウェアです。以下の人々がこのプラグインに貢献しています。


“SSL Insecure Content Fixer” は14ロケールに翻訳されています。 翻訳者のみなさん、翻訳へのご協力ありがとうございます。

“SSL Insecure Content Fixer” をあなたの言語に翻訳しましょう。

開発に興味がありますか ?

コードを閲覧するか、SVN リポジトリをチェックするか、開発ログRSS で購読してみてください。


The full changelog can be found on GitHub. Recent entries:

2.7.0, 2018-06-30

  • added: fix for responsive images loaded by JavaScript from image data attributes
  • fixed: call to undefined function hash_equals() on environments with obsolete PHP versions (i.e. < 5.6)
  • fixed: don’t run the fixer when a WooCommerce download request is detected