I'm having the SSL warning messages all over my website after switching to SSL for several assets:
Mixed Content: The page at 'https://example.com' was loaded over HTTPS, but requested an insecure script 'http://example.com/script.js'. This request has been blocked; the content must be served over HTTPS.
None of these things showed a single http:// request. I'm out of ideas to try and find what is causing this. Any ideas or suggestions?
When seeing a mixed-content message about a http://example.com/script.js
(non-https) URL that doesn’t actually appear anywhere in your sources, the basic strategy to follow is:
http
in the URL with https
and put that into the address bar in your browser: https://example.com/script.js
https://example.com/script.js
URL back to (non-https) http://example.com/script.js
, then you’ve found the cause: example.com/script.js
isn’t actually available from an https
URL, and ends up getting served from a http
URL even though your source is requesting the https
URL.