I'm getting a strange error on my live WordPress website. On the admin homepage, I'm getting a mixed content warning that points to the doctype. If I copy this entire website and database to my local machine, I'm unable to produce the error. It only occurs on the home page of wp-admin, and prevents other things from working - for example, when hovering over Posts or other links on the left-nav, I don't get the sub-navigation on hover - but if I right click, they appear.

The warning seems to point to itself:

Mixed Content: The page at 'https://domain.co.uk/wp-admin/index.php' was loaded over HTTPS, but requested an insecure script 'http://domain.co.uk/'. This request has been blocked; the content must be served over HTTPS.

This error started to appear after upgrading to WordPress 4.9.

WordPress Mixed Content Error

  • Can you see any scripts in the source code that are loading with the insecure protocol http:// ? Nov 18, 2017 at 11:17
  • There aren't any http requests in the source code of wp-admin. The error seems to say that the script it's trying to load is http://www.domain.co.uk, without the https - which is really odd. It doesn't actually show that it's trying to load a file, just the domain itself. Nov 18, 2017 at 11:22

1 Answer 1


It turned out to be Wordfence causing the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.