A mixed-content warning appears when an HTTPS WordPress page references some resources over HTTP. After switching to Cloudflare, the browser can block scripts, fonts or images even while the site’s padlock appears otherwise correct.
This guide focuses on the practical decision points for wordpress mixed content after cloudflare ssl. The examples are educational and should be adapted to your site, provider, client agreement or application requirements rather than copied without verification.
WordPress Mixed Content After Cloudflare SSL: Practical Guide
Before you start: gather the right information
Write down the current environment, version numbers or business requirements. For a live website, create a known-good backup and make potentially disruptive changes on staging first. For business documents, confirm the client, scope and acceptance criteria before using a sample.
Step-by-step walkthrough
- Verify that the origin server has a valid certificate and choose an appropriate Cloudflare SSL/TLS mode, preferably Full (strict) when supported.
- Confirm WordPress Address and Site Address use https:// on the production site.
- Open the browser Console and record which HTTP resources are being requested.
- Update hard-coded URLs in theme settings, page builders and content with a serialization-aware replacement workflow where appropriate.
- Inspect third-party widgets, embedded scripts, CSS background images and font URLs.
- Use Cloudflare HTTPS features as supplementary safeguards, not as substitutes for fixing source URLs.
- Purge Cloudflare and WordPress caches; retest a new private browser window and important checkout or form pages.
Worked example or reference template
Mixed-content debugging map
HTTPS page → HTTP image may be upgraded or blocked; HTTPS page → HTTP script is usually blocked by the browser. The durable fix is to serve all required assets from valid HTTPS URLs and keep the origin certificate and proxy mode consistent.
How to verify the result
Check the output from the perspective of the person who will use it. Test the critical workflow, note what was changed and preserve enough evidence to reverse a failed update. For public-facing sites, repeat the check while logged out and on a mobile browser. For templates, verify totals, wording and payment or ownership terms before sharing.
Common mistakes to avoid
- Avoid relying on Flexible SSL as a permanent workaround for origin HTTPS problems.
- Do not disable browser security or downgrade the site to HTTP.
- Do not replace every string in the database without a tested backup.
Related BDKick tutorials
For the next step, see Cloudflare Blocking WordPress Admin AJAX: Diagnose the Exact Rule, WordPress Images Not Showing After Migration: Fix Broken Media. These pages are part of the same article batch; publish the linked posts before promoting this page.
Official documentation and references
Frequently asked questions
Will Always Use HTTPS fix mixed content?
It redirects page requests to HTTPS; it does not necessarily repair every hard-coded HTTP asset.
Should I use Full (strict)?
Yes when the origin certificate is valid and meets Cloudflare’s requirements.
Why does Elementor still load HTTP images?
Saved widget values or generated CSS can retain old resource URLs.
Can Cloudflare Automatic HTTPS Rewrites help?
It may upgrade eligible URLs but you should still correct the source of mixed-content references.
Final checklist
Confirm the instructions match your specific environment, save a backup or clean document copy, test the main outcome and record any remaining risks. If you are publishing technical guidance, revisit it after major product updates.
Frequently Asked Questions
Will Always Use HTTPS fix mixed content?
It redirects page requests to HTTPS; it does not necessarily repair every hard-coded HTTP asset.
Should I use Full (strict)?
Yes when the origin certificate is valid and meets Cloudflare’s requirements.
Why does Elementor still load HTTP images?
Saved widget values or generated CSS can retain old resource URLs.
Can Cloudflare Automatic HTTPS Rewrites help?
It may upgrade eligible URLs but you should still correct the source of mixed-content references.