WordPress SSL Error: The Best Proven Fix (2026)
A WordPress SSL error whether it’s “Your connection is not private,” a mixed content warning, or the padlock simply missing from your address bar is one of those problems that looks simple but has several different possible causes. Most guides online cover the basic fix and stop there. This one goes further, covering the edge cases (mixed content, HSTS, Cloudflare conflicts) that actually cause most of the repeat SSL issues I see on client sites.
What’s Actually Causing Your WordPress SSL Error
Before jumping to fixes, it helps to identify which type of SSL issue you’re facing, since the fix is different for each:
- “Not secure” warning with no padlock usually mixed content (some resources still loading over HTTP)
- “Your connection is not private” / NET::ERR_CERT usually an expired, missing, or misconfigured SSL certificate
- SSL works on some pages but not others; usually hardcoded HTTP links or unsecured embedded content
- SSL error only right after a hosting/DNS change; usually a propagation delay or certificate reissue needed
Step 1: Confirm You Actually Have a Valid SSL Certificate
Log into your hosting control panel and check the SSL/TLS section. Confirm:
- A certificate is actually installed (not just “available”)
- It hasn’t expired
- It matches your exact domain (including www vs non-www, if relevant)
Most hosts offer free SSL certificates (often via Let’s Encrypt) that auto-renew if yours shows as expired, it likely means auto-renewal failed, which your host’s support can usually fix quickly.
Step 2: Force HTTPS in WordPress Settings
Even with a valid certificate installed, WordPress needs to be told to actually use HTTPS.
- Go to Settings > General
- Confirm both “WordPress Address (URL)” and “Site Address (URL)” start with
https:// - Save changes
Step 3: Fix Mixed Content (The Most Common Repeat Issue)
This is where most WordPress SSL error guides stop, but it’s usually the actual root cause of the “not secure” warning persisting even after installing SSL. Mixed content happens when your page loads over HTTPS, but some resources on it (images, scripts, embedded content) are still called via http:// instead of https://.
Common sources of mixed content:
- Images uploaded before SSL was installed, with hardcoded
http://URLs in the database - Embedded YouTube videos or third-party widgets using HTTP links
- Custom CSS/JS files linked with an absolute HTTP path
Fix: Use a search-and-replace tool (many hosts and plugins offer a database search-and-replace feature) to update all http://yourdomain.com references to https://yourdomain.com across your database. Always back up your database before running this.
Step 4: Add a 301 Redirect From HTTP to HTTPS
Even after fixing mixed content, visitors (or old bookmarks/backlinks) landing on the HTTP version need to be redirected automatically. Add this to your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]This ensures every visitor lands on the secure version regardless of which link they clicked.
Step 5: Clear Your Cache (Browser, Site, and CDN)
A stubborn SSL warning that persists after fixing the certificate and mixed content is very often just a caching issue.
- Clear your WordPress caching plugin’s cache
- Clear your CDN cache if you’re using one (Cloudflare, etc.)
- Test in an incognito browser window to rule out browser-level caching
Step 6: Check for Cloudflare SSL Mode Conflicts
If you’re using Cloudflare, this is a common and frustrating cause of SSL loops or errors that other guides rarely mention. Cloudflare’s SSL/TLS mode needs to match your actual server setup:
- Flexible only use this if your origin server has no SSL certificate at all (not recommended long-term)
- Full use this if your server has any SSL certificate, even self-signed
- Full (Strict) use this if your server has a valid, trusted SSL certificate (the safest, most correct option for most sites)
A mismatch here like using “Flexible” mode when your server already has a valid certificate commonly causes redirect loops or intermittent SSL errors.
Step 7: Enable HSTS (Once Everything Is Confirmed Working
HSTS (HTTP Strict Transport Security) tells browsers to only ever connect to your site over HTTPS, even if someone types the HTTP version. Only enable this after confirming HTTPS works reliably across your entire site, since HSTS is cached aggressively by browsers and hard to undo quickly if something’s still broken.
Diagnostic Checklist
| Symptom | Likely Cause | Fix Step |
|---|---|---|
| No padlock, “not secure” | Mixed content | Step 3 |
| NET::ERR_CERT error | Invalid/expired certificate | Step 1 |
| Works on some pages, not others | Mixed content or hardcoded links | Step 3 |
| Redirect loop | Cloudflare SSL mode mismatch | Step 6 |
| Warning persists after fixing | Caching | Step 5 |
Frequently Asked Questions
Why does my WordPress SSL error say “fixed” but still shows a warning? This is almost always a caching issue (browser, plugin, or CDN) or leftover mixed content that hasn’t been fully cleaned from the database.
Do I need to pay for an SSL certificate? No, most hosts provide free SSL certificates (typically via Let’s Encrypt) that are perfectly secure for the vast majority of sites and auto-renew.
Can a WordPress SSL error hurt my SEO? Yes, Google flags non-HTTPS sites as “not secure” in the browser, which increases bounce rate, and HTTPS has been a confirmed ranking signal since 2014.
How do I check if I still have mixed content after fixing it? Reload the page and check your browser’s developer console (F12) for “mixed content” warnings, or use an online mixed content scanner to check the full site at once.
Final Thoughts
Most WordPress SSL error guides only cover installing a certificate and forcing HTTPS, but the actual persistent cases almost always come down to mixed content, caching, or a Cloudflare SSL mode mismatch. Work through the diagnostic table above to identify your specific symptom, then apply the matching fix. If your SSL issue has been dragging on and none of this resolves it, get in touch here and I’ll diagnose and fix it directly.
Recommended Tools & Plugins
Every tool below is something I actually use on client projects, not a random affiliate list.
- Hosting: Cloudways fast, managed WordPress hosting
- Theme: GeneratePress lightweight, built for speed
- Page Builder: Elementor Pro the builder behind most of my client sites
- Forms: WPForms reliable, beginner-friendly form builder
- Directory/Listing Sites: Directorist for business directory or listing projects
- Elementor Add-ons: Crocoblock (JetEngine) for dynamic, database-driven sites
- Keyword Research: Mangools is the SEO tool I use for keyword research
- Backups: UpdraftPlus never launch a site without a backup plan
- Course Platform: Tutor LMS is the LMS plugin
- Free Speed Test: Google PageSpeed Insights is the free tool I use to check real Core Web Vitals data
