Is this the same as “why isn’t Google indexing my pages”?

No. The indexing guide covers crawl and index blocks. This page is only padlock and mixed-content cleanup after the certificate exists.

Will a plugin “Really Simple SSL” fix everything?

It can force HTTPS redirects and help some URL rewrites. It will not fix a hard-coded http image on a CDN you do not control. Always scan the page source.

SEOPublished 2026-08-163 min read

Mixed Content Cleanup: SSL and HTTPS for Bloggers

Q: What is mixed content on a blog?

The page loads over HTTPS, but some images, scripts, or iframes still use http://. Browsers may block the insecure file or show a broken padlock. Fix the asset URLs or the CDN, not by turning HTTPS off.

Q: Does HTTPS alone rank a new blog?

HTTPS is a baseline, not a content strategy. Google treats it as a light ranking signal among many. A secure empty site still will not rank. See Google’s HTTPS documentation for current guidance.

Q: Do I need to buy an SSL certificate?

Most small-blog hosts include Let’s Encrypt or equivalent at no extra fee. Confirm on your host’s official SSL help page. Paid certs are optional unless you have a specific compliance need.

Q: Should I use Cloudflare Flexible SSL forever?

No. Flexible (HTTPS to the visitor, HTTP to the origin) is a temporary crutch. Prefer Full (strict) once the origin has a valid certificate. See the Cloudflare small-blogs guide for the CDN job map.

Q: What if only one old post is broken?

Fix that post’s media URLs. A sitewide search for http://yoursite.com is enough for most WordPress blogs. Do not search-replace http on third-party APIs that are still HTTP-only.

Q: Where does Google document HTTPS?

Google Search Central: HTTPS and secure sites. Use that page as the source of truth when advice conflicts.

SSL and HTTPS for bloggers: run a Padlock Sweep for mixed content—http images, old embeds, and redirects—without treating HTTPS as an SEO trophy.

By CashPilot Editorial · Practical guides for AI, SEO, blogging & digital growth

Mixed Content Cleanup: SSL and HTTPS for Bloggers

The padlock is not a trophy. SSL / HTTPS means the browser and the server agreed on encryption. Mixed content means you spoiled that agreement with one leftover http:// image.

This page is a Padlock Sweep for small blogs. It is not why Google isn’t indexing your pages and not a hosting bake-off. Get a certificate from your host first—see Web Hosting for Small Blogs if you do not even have HTTPS on the plan.

Official reference: Google Search Central on HTTPS. Feature names in plugins change; the browser error text is the ground truth.

Disclosure: Security and CDN products are commercial. CashPilot may earn a commission through links we add later. No invented “HTTPS boosts rankings 5%” claims.

Certificate vs mixed content
The Padlock Sweep
WordPress-shaped fixes
CDN and Flexible SSL
FAQ

Certificate vs mixed content

No padlock / “Not secure” on the whole site: the certificate is missing, expired, or the visitor is still on http:// without a redirect.

Padlock with a warning, or blocked images: the HTML is HTTPS, but an asset is not. That is mixed content.

Fix the first problem at the host (issue/renew cert, force HTTPS). Fix the second in content and theme.

Chrome’s address bar and DevTools → Console will name the blocked URL. Trust that more than a plugin dashboard.

The Padlock Sweep

Work top to bottom. Stop when the console is quiet on three key URLs: home, one post, one image-heavy post.

              PADLOCK SWEEP
  1. Cert live?  Host panel → HTTPS on
  2. Redirect    http → https (host or server)
  3. Search      old http://yourdomain in posts
  4. Theme       hardcoded http in header/footer
  5. Embeds      old players, maps, ads
  6. Console     zero mixed-content errors

Do not “fix” a third-party script by loading it over HTTP. Replace the embed or drop it.

If pages are indexed but look broken to users, that is a trust problem, not an orphan page problem.

WordPress-shaped fixes

Typical leftovers:

Media library URLs saved as http:// from an old setting
A page builder background image
A custom logo path in the customizer
An ad or affiliate script still on HTTP

Site URL and Home URL in Settings → General should both be https://. Then run a careful search-replace only for your own hostname. Backup first—see the backup basics post in this cluster.

A force-HTTPS plugin can help redirects. It cannot invent an HTTPS version of a dead HTTP CDN.

After cleanup, spot-check Core Web Vitals. Some “fixes” load a second copy of every image.

CDN and Flexible SSL

If Cloudflare (or similar) sits in front, Flexible SSL can create mixed content: the visitor sees HTTPS, the origin still serves HTTP assets that rewrite badly.

Prefer Full (strict) when the origin certificate is valid. Job map: Cloudflare for Small Blogs. Official SSL modes: Cloudflare encryption modes.

FAQ

What is mixed content on a blog?

The page is HTTPS, but some files still load over HTTP. Browsers may block them or break the padlock.

Does HTTPS alone rank a new blog?

No. It is a baseline. Helpful content still does the ranking work. See Google’s HTTPS documentation.

Is this the same as the indexing guide?

No. This page is padlock cleanup only.

Do I need to buy an SSL certificate?

Most small-blog hosts include a free certificate. Confirm on the host’s official SSL help.

Should I use Cloudflare Flexible SSL forever?

No. Move to Full (strict) once the origin has a valid cert.

Will a plugin fix everything?

It can force redirects. Hard-coded HTTP assets still need a URL fix.

What if only one old post is broken?

Fix that post’s media. Sitewide replace only your own hostname, after a backup.

Where does Google document HTTPS?

Search Central — HTTPS.

When the console is quiet, stop. The padlock’s job is to disappear so readers can finish the post.