Google Chrome has flagged a client's Wordpress site as Not Secure. So we are trying to remove a Mixed Content warning that we get using the Inspect feature of the browser.

Mixed Content: The page at 'https://www.CLIENT.com/' was loaded over HTTPS, but requested an insecure image 'http://www.CLIENT.com/wp-content/uploads/2018/05/CompanyLogo.png'. This content should also be served over HTTPS.

When we contacted the company who has built the template, they told us to refer to the template code's CSS and located a file in which the following definition was made:

****************** LOGO **********************

.site-header .logo {
    position: relative;
    margin:0 auto;
    width: 140px;
    height: 65px;

.site-header .logo_image {
    width: 100%;
    height: 100%;
    z-index: 999;
    background: url('../../images/logo.png') no-repeat left;
    background-size: contain;

Now, the resource URL that is causing the Mixed Content warning does not have the name logo.png but http://www.CLIENT.com/wp-content/uploads/2018/05/CompanyLogo.png (of course I have changed the real names of the files) as stated in the warning message above.

Moreover, I found a few other files in the CSS code's header definition that contains the logo.png file.

This has not removed the warning.

So my question is, where, in the code can I find the real source of this file that is, for some reason, still under HTTP?

I need to add that we have cleared the cache on both Wordpress and the browser to no avail.

  • 1
    that's an uploaded file, it isn't the file in your CSS you refer to, you should look at the page to see where the CompanyLogo.png actually is for clues to where it's coming from, then reupload it. Otherwise I don't believe it's possible for people online to answer your question if they can neither see the site, or the code, the number of places it could be coming from with such limited information, it could be anywhere. – Tom J Nowell Mar 31 at 9:36
  • I would suggest that instead of searching for the cause of it, you solve all potential future issues of it as well: force https on all resources loaded from your server. You can either use any of the free plugins to do that, or just edit your .htaccess file on the server as described here. – dboris Mar 31 at 9:51
  • @TomJNowell I agree. But how, by mere looking at the page in the browser, can I find where the resource is uploaded? I can easily find the HTTPS version of the CompanyLogo.png file in the Media library. But I can't seem to find where we have dictated the same resource using HTTP. – disasterkid Mar 31 at 10:18
  • @dboris Yes, we certainly have to apply/enforce such policies in the future. But for now, we need to get rid of this HTTP resource that is causing the site to be flagged "No Secure". – disasterkid Mar 31 at 10:20
  • As I said, it's impossible to tell from just the information you've provided, this isn't something people online can answer without full access to the code of your site to conduct a search or identify. Otherwise, if you don't know where on the page it is, right click and view source then press ctrl+f/cmd+f and type in CompanyLogo.png. The surrounding markup should give clues as to where to look or what to do, but as I said, it is not possible for people online to help you with this with such limited information. The "do X and you will find it" answer you seek does not exist – Tom J Nowell Mar 31 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.