The 40-Minute HTTPS + Mixed Content Checklist for Small WordPress Sites

SSL is on. The padlock is still angry. On small WordPress sites that usually means HTTP leftovers, mixed content, or an insecure form — not a soft-404. This checklist is not a redirect-chain audit. Redirects show up only as one clean http→https hop. About 40 minutes.

Before you start (3 minutes)

Write five lines:

• Final host (HTTPS, www or apex — pick one)
• Certificate status (valid, covers that host)
• SEO / SSL plugin in use (Rank Math, Really Simple SSL, host panel, none)
• Top 5 money URLs that must look secure
• Whether staging still serves HTTP-only tools on the same brand host

Judge everything below against that list. Scheme/host confusion is the same class of problem as duplicate URLs — settle the intended HTTPS URL the way you settle canonical tags.

Part 1 — Scheme hop + WP addresses (7 minutes)

• http://YOUR-DOMAIN/ → one 301/302 to https:// on the intended host (no multi-hop theater)
• Apex vs www: one choice; HTTPS works on the chosen host
• WP Admin → Settings → General: WordPress Address and Site Address both https://
• No admin redirect loop when opening /wp-admin/ over HTTPS
• Certificate name matches the host users actually land on

Pass: single scheme hop; General settings HTTPS; admin reachable on HTTPS.
Fail: HTTP still serves content, or siteurl/home still HTTP.

Part 2 — HTTP leftovers in content and options (10 minutes)

• View-source Home: no same-host http:// in img, script, link, iframe
• View-source each money URL: same check
• Search content / widgets for hard-coded http://yourdomain
• Customizer CSS: no absolute HTTP asset URLs
• Plugin-stored full URLs (sliders, logos, OG) upgraded
• Dry-run DB replace http://yourdomain → https:// if needed (never blind-replace all http)

Pass: money HTML is HTTPS-clean for first-party assets.
Fail: hard-coded HTTP images or scripts on money pages.

Part 3 — Mixed content: active vs passive (8 minutes)

Open DevTools → Console + Security on Home and one money URL.

• Active mixed content (scripts, stylesheets, XHR, insecure iframes): zero blocked items
• Passive mixed content (images/video/audio over HTTP): none, or listed and scheduled to fix
• Third-party widgets/fonts/maps: HTTPS endpoints only
• Abandoned slider / analytics snippets on http:// removed or replaced
• Service worker / cache purged if it still maps old HTTP assets

Pass: no active mixed content; passive cleared or rare and documented.
Fail: menu/JS broken because a script was blocked as mixed active content.

Active breaks the page; passive mostly breaks trust. Fix active first.

Part 4 — Insecure forms + admin myths (7 minutes)

• Contact / newsletter / login / checkout forms: action is HTTPS (or empty/same-origin over HTTPS)
• AJAX to admin-ajax.php or REST over HTTPS
• Test submit once; Network tab shows no HTTP posts
• /wp-admin/ used over HTTPS (do not "fix" SSL by forcing admin back to HTTP)
• If admin looks broken: Console mixed content + siteurl + proxy X-Forwarded-Proto — not "HTTPS is unsafe for admin"

Pass: forms and admin stay on HTTPS without mixed active errors.
Fail: Chrome "Not secure" on a form page, or admin intentionally left on HTTP.

Part 5 — HSTS lightly + cleanup (5 minutes)

• HTTPS solid everywhere you need before HSTS
• Enable HSTS at host/CDN with a modest max-age first
• includeSubDomains only if every real subdomain is ready
• Skip preload until you are sure you will not need HTTP on that host
• Sitemap + internal links use HTTPS; GSC samples of leftover HTTP URLs noted
• External shares can use a URL shortener; on-site paths stay HTTPS. Other free utilities: tools

HSTS does not repair mixed content inside a page — it only trains browsers to skip HTTP next time.

Quick decision table

What "done" looks like

1. One clean http→https hop to the intended host
2. siteurl / home HTTPS
3. No active mixed content on money URLs
4. Forms post over HTTPS
5. Admin used over HTTPS
6. HSTS optional seatbelt after the above

That will not invent rankings. It stops Chrome and users from treating a "secured" WordPress site as half-migrated.

Repeat triggers

Rerun after: host/CDN changes, theme swaps, plugin installs that inject scripts, content imports, staging→prod URL replace, or any new "Not secure" screenshot from a client.

More practical technical notes: blog.

Riichi Mirza — SEO freelancer focused on small WordPress and service sites.