Serve everything over HTTPS and fix mixed content

The problem

The site is reachable over plain HTTP without a permanent redirect to HTTPS, or HTTPS pages load scripts, styles or images over http://.

How to spot it

• Browsers show "Not secure".
• Images or scripts are missing on HTTPS pages, with mixed-content warnings in the browser console.

Why it matters

HTTPS protects visitors from tampering and eavesdropping. Browsers warn about or block insecure resources on secure pages.

What happens if you leave it

Lost trust, broken page elements, and duplicate HTTP/HTTPS versions of every page.

How to fix it

1. Install a TLS certificate. Most hosts offer free automatic certificates (Let's Encrypt).

2. Add a 301 redirect from every http:// URL to the same https:// URL.

   Nginx:

   server {
       listen 80;
       server_name example.com www.example.com;
       return 301 https://www.example.com$request_uri;
   }
   

3. Update hard-coded http:// links to scripts, styles, images and iframes to https:// (or protocol-relative paths you control).

4. Update the canonical tags, sitemap and internal links to HTTPS.

5. Once HTTPS works everywhere, consider HSTS (see the security headers tutorial).

Platform-specific notes

• WordPress: update the site address to https:// under Settings → General, then search and replace old http:// URLs in content.
• Cloudflare: enable "Always Use HTTPS" and use "Full (strict)" SSL mode.

Common mistakes

• Using 302 (temporary) redirects.
• Forgetting embedded content such as old YouTube embeds or fonts.

How to check the fix worked

curl -I http://example.com/ should return 301 with a Location: https://… header. Open the browser console on key pages to check for mixed-content warnings. Re-run the audit.