Certain header elements not served over https

Question

I have forced SSL on each page of my site using WordPress HTTPS. This works perfectly and isn't throwing up any mixed content warnings.

However, when I visit the page source, I can see a whole bunch of resources being served over http in the header. These are not resources that I control, but what I assume to be coming from the WordPress core. Here they are:

<link rel="profile" href="http://gmpg.org/xfn/11">

<link rel="alternate" type="application/rss+xml" title="Website &raquo; Feed" href="http://www.example.com/feed/" />

<link rel="alternate" type="application/rss+xml" title="Website &raquo; Comments Feed" href="http://www.example.com/comments/feed/" />

<link rel='https://api.w.org/' href='http://www.example.com/wp-json/' />

<link rel='shortlink' href='http://www.example.com/' />

<link rel="alternate" type="application/json+oembed" href="http://www.example.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.example.com%2F" />

<link rel="alternate" type="text/xml+oembed" href="http://www.example.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.example.com%2F&#038;format=xml" />

What are these elements doing and should I be concerned that they are not being served over https?

Answer 1

I'm not sure about the first one, the profile, but the rel="alternate"s and the rel='shortlink' provide different formats for different readers, like XML and RSS feeds. These should be generated by your site URL. In your dashboard, go to Settings > General, and make sure you're using https:// instead of http:// in the URL. You may then need to clear your site cache to see the change.