I have a Wordpress installation hosted for free on Openshift. I'm using CloudFlare so I can force HTTPS on login/admin pages (more details about my setup can be found here). I got "mixed content" errors at first because of images and other static files but the "SSL Insecure Content Fixer" plugin solved the issue. Recently, however, I tried customizing my theme and realized I was still getting mixed content errors for that page. /wp-admin/customize.php is loaded via HTTPS but when it tries to load the non-admin page /2016/02/some-post/, it throws the mixed content error.

How can I fix this?

  • These kind of plugins have pretty big impact (negative, not positive). I can't belive theme developers still fail to use // instead of http://... You have 2 options: 1. eliminate plugin and sources of mixed content (which is not a good idea if you don't develope theme yourself) 2. These plugins usually have several levels of SSL forcing in options, use "stronger" forcing level. – N00b Feb 23 '16 at 8:53
  • Either you protect the whole site or nothing at all. Your setting makes no sense, which might cause the problems with the plugin. – Mark Kaplun Feb 23 '16 at 9:44
  • @MarkKaplun, how do they not make sense? I'm securing login/admin, the sensitive parts of the website, while leaving the rest accessible through regular HTTP. That's exactly how stackexchange sites work if you haven't noticed. It's not a coincidence that Wordpress exposes a FORCE_SSL_ADMIN setting. – Ariel Feb 23 '16 at 9:53
  • @TwerkingN00b, eliminate what plugin? The "customize" tool is a native Wordpress feature, and so is FORCE_SSL_ADMIN. – Ariel Feb 23 '16 at 9:56
  • @Ariel, you are supposed to secure the cookies, not the URLs. Securing URLs without securing the cookies is pointless if you do it for security – Mark Kaplun Feb 23 '16 at 10:20

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.