Occasional HTTPS Mixed Content Warning

I just saw this problem myself on my site. The issue for me was that the site was available as both https://example.com/ and http://example.com. If the first request to a page was for the http version, the links to assets would be to http:

  • http://example.com/wp-content/themes/customizr/assets/front/img/thumb-standard-empty.png
  • http://example.com/wp-content/uploads/...
  • etc.

These http asset links would get put into the cache. When somebody requested the page over https and the cached page was returned, they would get mixed content due to the http links in the page cache.

If the first person to visit a page was over https, everything works as expected. The page cache would get built with https asset links.

I solved this problem by redirecting to https by putting the following code in the top my my .htaccess file and then purging all caches.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

That way WordPress never gets hit with http requests and the cache always gets built appropriately.

I had thought that setting the site URL to include https would be enough to prevent this problem. However, that does not appear to be the case. My “Settings” -> “WordPress Address (URL)” and “Settings” -> “Site Address (URL)” have always both been set to https://example.com. I had thought that WordPress itself issued redirects to HTTPS with that setting, but apparently it doesn’t. I had also thought that this setting would be used for writing the links to asset URLs, but apparently that is not true either.