I'm building an aggregator of sorts in WordPress that pulls posts using the new API from specific sites. Most if not all of these sites will not have SSL, thus HTTP. Of course, I'm getting "Mixed Content: The page [xxx] was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint [yyy]. This request has been blocked; the content must be served over HTTPS."

For the record, I'm utilizing the posts API to pull in the feeds, i.e., "http://somesite.com/wp-json/wp/v2/posts"

I've tried various CORS methods (setting headers in functions.php, CORS plugins, you name it), as well as adding origin sites to the allowed origins:

add_filter( 'allowed_http_origins', 'add_allowed_origins' );
function add_allowed_origins( $origins ) {
    $origins[] = 'http://somesite.com';
    return $origins;

I don't own the other sites, so I can't very well insist that they get an SSL cert. But it seems I'm stuck, unless someone has a fix I haven't tried? Any help appreciated.

  • not sure how the question is related to wordpress at all. You want to pull info from sites which are not yours, so at best this is a JS question ? Commented Feb 15, 2017 at 19:49
  • Because I'm developing in WordPress, and specifically with the updated WP API. Commented Feb 15, 2017 at 20:07

1 Answer 1


I think your only option is to build a small proxy, a PHP function on your own site to which you pass the URL you want to grab. That call, being to your own site (ajax call) will be using the same protocol as your site.

The PHP code receives the ajax call, turns around and gets the remote content (either using file_get_contents or cURL) and returns the content of the response as its ajax call response.

It's not pretty, and you will take a speed hit for this, but you now totally bypass the browser's security warnings...

Hope this helps!

  • Hehehe... yeah, I was really hoping to avoid that mainly due to the speed hit, but it is what it is. Thanks! Commented Feb 15, 2017 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.