Load scripts, styles and frames over HTTPS on WordPress
Why it matters
Browsers block http:// scripts, stylesheets and frames on an https page, so parts of the page break, and anything loaded that way could be altered on the network. Every such resource must come from an https:// URL.
The fix
- Set WordPress Address and Site Address to https:// (Settings, General, or the HTTPS button in Tools, Site Health). WordPress 5.7 and later then rewrites old http links to your own site in content on the fly.
- Make the change permanent in the database with WP-CLI: back up first, run a dry run, then the real replacement as below; run it for each host name the site used (www and apex). Search-replace handles serialized data; skip the guid column.
- Third-party http:// URLs in the theme, widgets, page-builder settings or custom HTML have to be edited one by one; change them to https:// or replace the service.
- Clear the page cache, the CDN cache and any optimisation plugin's cache, then reload the page with the developer console open.
bash
wp db export before-https.sql wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid wp cache flush
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.