What We Measured
Scope: 19,851 scans of HTTPS WordPress sites, part of a broader 86,895 scans across 66,016 unique small-business installations (July 18 – August 17, 2026).
Mixed Content Check Defined:
A site passes the ‘Mixed Content – Good’ threshold if it serves all resources—including images, scripts, and stylesheets—exclusively via HTTPS, with no HTTP elements present in publicly accessible pages.
Mixed content refers to situations where your HTTPS-encrypted page pulls in any resource over HTTP. Common examples: an embedded image from an old link (
http://...), non-secure font files, or third-party scripts inserted by outdated plugins.Why this matters: Browsers treat such combinations as less secure—sometimes blocking resources, sometimes allowing them with warnings. Attackers can potentially intercept downgraded, HTTP-served content, undermining the trust promised by your HTTPS padlock.
Key Findings: Mixed Content by the Numbers
Aggregate Mixed Content Results (Recent 30 Days)
| Pass/Fail | Graded Scans | Percentage |
|---|---|---|
| Not Good | 8,315 | 41.9% |
- 41.9% of measured HTTPS WordPress sites failed the mixed content check.
- These sites included at least one actively linked HTTP resource on public pages.
- This is not a rare edge case—over 8,000 small business sites fell short in just one scan window.
Full Security Grade Context
Grade Distribution: 86,895 Scans, 66,016 Unique Sites
| Grade | Graded Scans | Percentage |
|---|---|---|
| A | 373 | 0.4% |
| B+ | 1,279 | 1.5% |
| B | 719 | 0.8% |
| C+ | 17,767 | 20.4% |
| C | 8,377 | 9.6% |
| D | 21,462 | 24.7% |
| F | 27,661 | 31.8% |
- Only 2.8% of sites scored a B or better
- A full 56.5% of sites placed at D or F
- Even among sites with valid SSL certificates, most do not enforce all protections promised by HTTPS
Related Security Check Rates
| Check | Good (%) | What “Good” Means |
|---|---|---|
| Security Headers | 0.4% | All of CSP, X-Frame, X-Content, RefPol |
| Cookie Security | 81.1% | Secure, SameSite, HttpOnly flags |
| Mixed Content | 62.7% | No HTTP resources on HTTPS pages |
Only 5.5% earned a “Good” SSL/TLS rating—far fewer than those merely running HTTPS. Mixed content, therefore, isn’t just a result of “older” sites; it’s pervasive among those that appear modern at a glance.
Why Mixed Content Matters for WordPress Security
What Is Mixed Content?
Imagine a customer visiting your HTTPS site. Their browser signals a “secure” connection—padlock icon, no warning banners. But beneath the surface, your contact form script or a logo image links over plain HTTP. That split undermines all encrypted traffic protections:
Interception risk: HTTP is not encrypted. An attacker positioned between the visitor and your server—such as someone on the same Wi-Fi—can tamper with any HTTP-loaded content. This could mean swapped-out scripts, defaced images, or tracking scripts injected without your knowledge.
Browser behavior: Modern browsers block some (not all) HTTP resources on HTTPS pages. Blocked content can break important site functions, while allowed (or “passive”) mixed content is simply an open door for eavesdropping or tampering.
SEO and customer trust: Google and other search engines consider mixed content a negative ranking signal. Visitors may see mixed content warnings (“Not fully secure”), eroding trust even before a purchase.
How Mixed Content Occurs in WordPress
- Hardcoded HTTP links in theme templates
- Outdated plugin assets referencing old URLs
- Images, webfonts, or scripts from external providers over HTTP
- Database records (menus, widgets) set up pre-HTTPS migration
Even if your main site loads securely, one missed resource call can trigger a mixed content warning or, worse, silent content hijacking.
How Mixed Content Undermines Real-World Sites
Example Scenarios
A WooCommerce checkout page loads an insecure product image from an external CDN. If the CDN is compromised or someone conducts a “man-in-the-middle” attack, a script could be injected to intercept payment details—not because HTTPS failed, but because mixed content let a single resource load unprotected.
A contact form plugin references JavaScript over HTTP. Browsers may block it, tearing down form functionality, or let it run, risking script swapping by attackers.
An embedded review badge from a third-party service uses HTTP. SEO crawlers and privacy scanners flag the domain, hurting rankings and user trust.
Documented Attack Pattern
While not every instance of mixed content creates an immediate attack vector, researchers have documented cases where HTTP assets on HTTPS sites allowed session hijacking, content injection, or ad fraud. Automated scanners regularly sweep for such weak points when mapping sites with known mixed content issues.
Business Impact: Proportional, Avoidable Risk
SEO: Sites flagged with mixed content errors may drop in rankings, particularly for competitive queries. Clean HTTPS is a trust and ranking signal.
Conversions: Even one mixed content warning can chase off a would-be customer, who now doubts your site’s security. For eCommerce, this friction directly affects the bottom line.
Platform compliance: Many payment processors, GDPR auditors, and insurance risk underwriters treat mixed content as a security “failure” even if SSL is otherwise valid.
The 41.9% failure rate—representing over 8,000 small business sites in a single month—is not a theoretical issue. It’s a fixable problem with tangible impacts on trust and revenue.
Recommended Fixes for Mixed Content on WordPress
1. Automate Detection
Automated website security scans surface mixed content issues instantly, listing every HTTP resource on your site’s front end. Manual checks are error-prone and nearly impossible as your site grows.
2. Update All Links and Resources
- Scan your database, theme files, and plugins for
http://references; update tohttps://where the resource supports it. - If an external resource lacks HTTPS, replace it or host a local, secure copy.
3. Configure Plugins Correctly
- Use reputable mixed content fixer plugins for WordPress. These tools intercept requests and rewrite (upgrade) HTTP requests to HTTPS.
- Confirm plugins do not introduce HTTP references themselves, especially when pulling external scripts or fonts.
4. Enforce HSTS (HTTP Strict Transport Security)
Once all mixed content is fixed, HSTS prevents browsers from making any HTTP requests to your domain. This is essential for locking in HTTPS.
5. Educate Your Team
Train content editors and plugin updaters: always use HTTPS URLs. Periodically re-scan your site to catch new issues before they appear to visitors.
Table: Mixed Content Remediation Checklist
| Action | Description | Automation Options |
|---|---|---|
| Rewrite internal URLs | Update database records and settings | Partial (search/replace) |
| Review embedded media sources | Check menus, widgets, theme customizer | Manual |
| Update or change insecure plugins/themes | Seek updates or alternatives with HTTPS assets | Manual |
| Enable HSTS header | Enforce HTTPS-only requests | Hosting/panel or .htaccess |
| Re-scan regularly | Catch regressions after updates/content changes | Yes |
Frequently Asked Questions
What is “mixed content” and why is it a problem for WordPress sites?
Mixed content happens when a secure (HTTPS) WordPress site loads any resource—scripts, images, fonts, styles—from an insecure (HTTP) source. This breaks the all-or-nothing promise of HTTPS, allowing attackers to intercept unencrypted content or browsers to block important site features. For small business sites, it’s a practical trust and SEO risk.
Doesn’t having an SSL certificate mean my site is fully secure?
Not necessarily. While SSL certificates encrypt traffic to your main site, they don’t enforce that every piece of content is loaded safely. Mixed content is common among sites with “valid” HTTPS—making extra checks essential.
How can I fix mixed content automatically?
Start by running an external website security scan. This provides a clear map of insecure resources for each page. Depending on your technical ability, you can use dedicated “mixed content fixer” plugins or work with your agency or developer to update all resource URLs.
Will browsers warn visitors if I have mixed content?
Modern browsers handle this in multiple ways: blocking some insecure scripts (especially if they affect page functionality), quietly downgrading trust indicators, or showing warning messages. You may not see every instance yourself, but your visitors’ trust can be affected with even a single flagged resource.
What This Does Not Mean
- A failing mixed content check does not mean your site is already compromised or that sensitive data is leaking.
- Most flagged sites are fixable—no need to overhaul your site or start over.
- Mixed content isn’t always caught by default WordPress security plugins, highlighting the need for dedicated scans.
Final Thoughts
Mixed content persists as a real, measurable weakness in the current state of small business WordPress security. With 8,315 “Not Good” findings in just 30 days, this is not a niche problem—it is a widespread, fixable gap undermining the value of HTTPS.
Addressing mixed content is not about chasing technical perfection. It’s about aligning your security investment with the minimal standard customers, partners, and search engines expect. Consistent scanning, systematic URL upgrades, and enforcing HSTS form the practical path forward.
What You Can Do Right Now
Start by running a comprehensive website security scan targeting mixed content checks. These scans will surface every non-HTTPS resource—so you can prioritize updates, validate fixes, and prove to customers (and Google) that your site’s security is more than just a padlock icon.
Don’t lose trust or traffic over a problem that’s measurable and fixable. Close the mixed content gap for good—scan, remediate, and keep scanning.
Explore more actionable tips in our guide to quick security wins for WordPress.