I'm building an aggregator of sorts in WordPress that pulls posts using the new API from specific sites. Most if not all of these sites will not have SSL, thus HTTP. Of course, I'm getting "Mixed Content: The page [xxx] was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint [yyy]. This request has been blocked; the content must be served over HTTPS."
For the record, I'm utilizing the posts API to pull in the feeds, i.e., "http://somesite.com/wp-json/wp/v2/posts"
I've tried various CORS methods (setting headers in functions.php, CORS plugins, you name it), as well as adding origin sites to the allowed origins:
add_filter( 'allowed_http_origins', 'add_allowed_origins' );
function add_allowed_origins( $origins ) {
$origins[] = 'http://somesite.com';
return $origins;
}
I don't own the other sites, so I can't very well insist that they get an SSL cert. But it seems I'm stuck, unless someone has a fix I haven't tried? Any help appreciated.