Permalinks, HTTPS, and mixed content

WordPress permalinks, HTTPS, and mixed content usually fail for three separate reasons. Pretty permalinks need a working .htaccess rewrite so paths like /about load instead of /?p=12. Your siteurl and home options must use the canonical https:// address, or admin sessions and redirects break. Mixed content is leftover http:// URLs stored in posts, widgets, and builder data, not a bad certificate.

Check siteurl and home

Start by confirming what WordPress thinks the site address is. Both values should match the HTTPS URL you want visitors to use.

wp option get siteurl; wp option get home

Use one host form only, with or without www, and avoid trailing-slash mismatches. If siteurl still says http:// while the rest of the stack forces HTTPS, cookies and logins often fail. A “force SSL” plugin does not rewrite the options table. Use WP-CLI or WP Toolkit search-replace so serialized data stays intact. After a clone, also check wp-config.php for WP_HOME or WP_SITEURL constants, because those override the database.

Flush the .htaccess rewrite rules

Pretty WordPress permalinks need LiteSpeed or Apache rewrite support. WordPress writes the rules when you save Settings → Permalinks. After a restore or migration, open Permalinks and click Save again to flush them. If /about returns 404 while /?p=12 still works, .htaccess is missing, not writable, or replaced by a bad security-plugin copy. In File Manager, confirm the file exists at the site root and that WordPress can update it.

Replace leftover http:// content

Posts, widgets, Gutenberg blocks, and page-builder JSON often store full URLs. A valid certificate will not stop the browser from blocking images or scripts still requested over http://. That is the mixed-content warning, and it looks like a broken padlock even when TLS is fine. Search-replace http://example.com with https://example.com using a tool that understands serialized PHP.

Work in this order: options (siteurl and home), rewrite (.htaccess), then post content. Purge LSCache afterward so old HTML is not still served. Keep www versus non-www redirects in one place only, either LiteSpeed or WordPress, so the two layers do not fight each other.