Mixed content after forcing HTTPS

Mixed content means your page loads over HTTPS, but something inside it still points to http://. Browsers block active mixed content such as scripts and iframes, and they may warn on images or stylesheets. The certificate is usually fine; the stored HTML still has old URLs. That is why a slider fails, styles drop out, or a plugin looks broken after you force HTTPS.

Before you add another force-HTTPS plugin, check what the browser actually receives:

curl -sL https://example.com | grep -oE ‘http://[^”47 >]+’ | head

That command shows leftover HTTP links in the homepage HTML. Theme CSS and plugin scripts are the ones that break layout. Images often only show as insecure in the console. If the homepage list is empty but inner pages still break, the strings sit in post content, a page-builder widget, or a serialized option rather than a theme file you already edited.

Search-replace the URLs in storage

WordPress stores siteurl and home in the options table, plus years of http:// inside posts, widgets, and theme mods. Set siteurl and home to HTTPS first. Then run a proper search-replace on the content so the database itself is clean. WP-CLI search-replace handles serialized data correctly. A plugin that only rewrites on the fly can hide the problem until a cache miss or a feed shows the raw HTTP link again.

Page-builder global headers are a common miss after you fix posts. Open those templates and any slider or CDN hostname that was hardcoded years ago. WP Toolkit on WordPress accounts can help with database rewrites; pick one tool and do not run two replacements back to back.

What a force plugin cannot fix

A plugin that sends 301 redirects does not rewrite attributes inside HTML you already stored and served. LiteSpeed Cache will keep sending the old page until you purge it. After the search-replace, purge LiteSpeed Cache and any CDN, then run the curl check again.

When that grep list is empty and DevTools Network shows only HTTPS requests, mixed content is resolved. Turning on HSTS after that is a separate hardening step, not the fix for leftover URLs. View source on a product or inner page as well as the homepage, because sliders and widgets often live there. If curl is clean but the browser console still shows http://, purge the cache once more and recheck.