5

I changed my site address from HTTP to HTTPS by simply changing the URL in Settings -> General (Wordpress address and Website address.) Absolutely no issue in the admin area, anything works fine.

What happens in the public facing portion of the website: there's a lot of "mixed content", so that Firefox complains the website isn't secure. I noticed (view source) almost any image that I have uploaded to the media gallery still is "rendered" with HTTP instead of HTTPS.

What can I do to serve the images, fonts, etc. with an HTTPS URL?

[UPDATE] I found a couple of issues can be fixed by editing two theme files with hardcoded "http://". Problem is with the images, if you don't want to alter the database there's apparently no solution

Improve this question
0

5 Answers 5

Reset to default
8

This is happening because WordPress saves URLs in content absolutely by default (meaning that it's actually got your urls saved as http://example.com in the database). So to fix this you'll want to run a search and replace in your database to fix those errors.

I like to use the plugin Better Search Replace because it has a nice feature to let you try out your search/replace as a dry run to test. There are lots of other search/replace methods, and you could also make the changes in PhpMyAdmin, but I'll just put instructions for using the Better Search Replace plugin.

Assuming you are using Better Search Replace:

  1. BACK UP YOUR DATABASE! Always always always. Use whatever tool you want to do this (UpdraftPlus, or dump (NOT DROP) it from PhpMyAdmin or straight from MySQL are all options).
  2. Head to tools > Better Search Replace
  3. Add the non SSL version of your website to the search field http (eg. http://example.com) and the SSL version of your website to the replace field Search Replace Example 1
  4. Select the tables you want to update. Most likely all you'll need is the wp_posts and wp_postmeta table but you can add them all if you like. Just know that it could take longer and time out depending on your server specs.Select your tables
  5. Do a dry run to make sure that it works Dry run
  6. If it works, then uncheck the dry run option and run it for real.
  7. Check your website to verify the errors have been fixed. If they have, awesome!

Note: Any time you search/replace there's a chance you could cause massive problems to your website. Hence step one, back up your website. If something goes wrong, you have a way to restore your data.

Improve this answer
14
  • 1
    I recently upgraded to SSL and Better Search Replace was a life changer. Backup your database before using it.
    – Christine Cooper ♦
    Commented Apr 4, 2017 at 16:23
  • 1
    @3000 in reality the people that tell you "just use lets encrypt" or the likes of that, just sell you snake oil. HTTPS is complicated for all kind of reasons, for example you might need to use dome JS library that is being served only on HTTP which will stop wordking on HTTPS (actually an issue a client of mine had). To be fully HTTPS it is not enough to handle your internal urls correctly but also those of external resources used on your site, which usually might just require changing HTTP to HTTPS ....
    – Mark Kaplun
    Commented Apr 5, 2017 at 9:30
  • 1
    ... (if it is supported) but for some of them you will need to use a totally different url to get the same resource. Bottom line, it is totally none trivial and there is no "one size fits all", therefor even if core would have wanted to handle it, there is basically no way to do it right for everybody. I personally just ignore mixed content warning, their security implication are negligible if you login over HTTPS and it is just super hard to clean them all.
    – Mark Kaplun
    Commented Apr 5, 2017 at 9:33
  • 1
    changing the images to use neutral protocol is probably the easiest biggest win you can have on this front, and you can do it with small snippet or by search replace, but one that specifically targets media urls.
    – Mark Kaplun
    Commented Apr 5, 2017 at 9:35
  • 1
    Definitely don't understand the downvote. This is a legit answer even if it's not what the OP was hoping for. Given the importance of SSL these days especially for SEO this is a good way to fix those mixed content warnings. There are other answers on this question that don't use the search and replace method, great! The entire purpose of this website is to provide high quality questions and answers to help each other!
    – Ian
    Commented Apr 5, 2017 at 13:26
1

You will have to need to redirect all your traffics from HTTP to HTTPS. A rewrite rule can do this for you. Use this code instead of WordPress's original rewrite rule (if you are not using cache) in your .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

RewriteCond %{ENV:HTTPS} !=on
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

# BEGIN WordPress
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

There are plugins that can do this for you too, such as Easy HTTPS Rediction.

Improve this answer
5
  • This is a really good way to go without messing with the database!
    – Ian
    Commented Apr 4, 2017 at 16:05
  • @Jack Johansson I redirect the website this way but there's mixed content too. For some reason, images path must have been hard-coded somewhere (I can't find where this "somewhere" actually is) :-)
    – 3000
    Commented Apr 4, 2017 at 16:41
  • @3000 Are the images under the same domain of yours? Even if they are hardcoded, the rewrite rule must redirect them. Are you using any type of CDN?
    – Johansson
    Commented Apr 4, 2017 at 16:43
  • @JackJohansson I noticed I have three kind of issues: images (under the same domain), fonts (CDN) and a Flickr widget that doesn't work anymore (served from external http address too)
    – 3000
    Commented Apr 4, 2017 at 16:46
  • 3
    This will work to redirect the URLs (and is a good idea if you're switching to all-HTTPS), but at that point it's too late to prevent the mixed content warnings. The URL on the page needs to be HTTPS to start with.
    – Matthew Crumley
    Commented Apr 4, 2017 at 20:08
1

I used Better Search Replace and Really Simple SSL and the winner is:

Really Simple SSL

Just do this:

  1. Install it
  2. Activate it
  3. Allow SSL

Done

It also fixed all the problems with image redirection

Improve this answer
-1

Install this plugin: https://wordpress.org/plugins/http-https-remover/

Despite the name - HTTP / HTTPS Remover - the latest version will force all http to https, and your mixed content warnings will be gone.

Improve this answer
2
  • Problem with a plugin like this is: I must know what it does "at a low level" (if a plugin breaks my website I must create the website again)
    – 3000
    Commented Apr 4, 2017 at 16:50
  • 1
    downvoted as as it is right now it is not a very useful answer. This might be the best plugin to handle the issue, but people that read the answer should get a good idea what it does and how
    – Mark Kaplun
    Commented Apr 5, 2017 at 9:01
-1

I just moved my company site to the secure only version last Friday. I used the Really Simple SSL Plugin and then added a 301 redirect into my .htaccess file.

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Don't forget to also verify the HTTPS version of your site in Search Console / Webmaster Tools

Improve this answer
5
  • redirect to your htaccess file???
    – 3000
    Commented Apr 4, 2017 at 16:48
  • 1
    I added the code to my .htaccess file that would redirect anything http to https.
    – fwho
    Commented Apr 4, 2017 at 16:51
  • Anyway, this code is not working for me: images etc. are still served with http:// not https://. I'm supposing - correct me if I could be wrong - a cache issue
    – 3000
    Commented Apr 4, 2017 at 17:30
  • I could be completely wrong, but I do not think an image would cache and load over https from an unsecured version. Are you linking with the full URL, as in example.com/image.png in the text itself?
    – fwho
    Commented Apr 4, 2017 at 17:41
  • WP directly creates link with http:// prepended: I downloaded the database and the links are everywhere
    – 3000
    Commented Apr 5, 2017 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.