You installed an SSL certificate, the site loads on HTTPS, and yet the browser still shows a “Not secure” warning. The usual reason is mixed content. Some links and images inside your pages still use http://. This guide shows you how to change HTTP to HTTPS in Elementor safely, so the padlock stays on every page.
Why Elementor still shows HTTP after you add SSL
An SSL certificate and a redirect make your site load over HTTPS. They do not rewrite the addresses saved inside your content. Elementor stores every image, button link, and background as a full URL in the page data. If the page was built before SSL, those addresses still begin with http://.
The browser sees an HTTPS page that asks for an HTTP image. It treats that as mixed content and can block the file or remove the padlock. The MDN guide to mixed content explains how browsers handle this.
Step 1: Confirm WordPress uses HTTPS
Before you touch Elementor, check the basics.
- Go to Settings > General.
- Make sure both “WordPress Address” and “Site Address” start with
https://. - Save the page.
If these still show http://, update them first. Everything else depends on this step.
Step 2: Find the mixed content
Open a page that shows the warning. Press F12 to open developer tools and look at the Console tab. Each warning names the exact file that loads over HTTP. Write down the pattern, which is usually your own domain, such as http://example.com.
Step 3: Back up before you replace anything
A site-wide replace edits many pages. Take a backup of your database first. The Pro version of the plugin below has a backup tool built in, covered in our guide to backing up and importing your database.
Step 4: Replace HTTP with HTTPS
You can change HTTP to HTTPS in Elementor in two ways.
- Elementor’s Replace URL tool. Go to Elementor > Tools > Replace URL. Enter
http://example.comas the old URL andhttps://example.comas the new one. - A search and replace plugin. Search & Replace for Elementor Free works page by page. Pro works across all pages with a dry-run preview, so you see every change before it is saved.
Replace your full domain with the protocol included. Do not search for just http://, because that would also change links to other sites that may not support HTTPS.
For the single-page steps, follow our guide to searching and replacing links in Elementor.
Step 5: Check the places Replace URL may miss
Some addresses live outside normal widget settings.
- Custom CSS with
url(http://...)values - Custom code and embed snippets
- Theme Builder headers and footers
- Popups and saved templates
- Menus and widgets in the WordPress customizer
Search for your domain in each place and fix what you find.
Step 6: Regenerate and clear caches
Go to Elementor > Tools > Regenerate CSS & Data and run it. Purge your caching plugin and CDN, then test in a private window. Background images in CSS files often keep the old address until the files are rebuilt.
Step 7: Add a permanent redirect
Content fixes handle your own pages. A server-level redirect from HTTP to HTTPS handles everyone else, including old links from other sites. Most hosts offer a one-click force HTTPS option. Google also recommends consistent HTTPS URLs in its site move documentation.
Common mistakes to avoid
- Running a replace without a backup.
- Replacing only the home page and forgetting templates.
- Skipping the cache purge, then thinking the fix failed.
- Changing links to external sites that do not support HTTPS.
Change HTTP to HTTPS in Elementor: common questions
Do I need a plugin to fix mixed content?
Not always. The built-in Replace URL tool handles many sites. A search and replace plugin helps when addresses sit in places the tool does not cover.
Will this change affect my SEO rankings?
Moving to HTTPS is a normal practice, and consistent HTTPS addresses make your site easier to crawl. Pair the content fix with a redirect so old HTTP links still work.
Why does the padlock still show a warning after I replaced the URLs?
Usually a cache. Regenerate Elementor files, purge your caching plugin and CDN, and test in a private window. If the warning stays, look at the console for the one file that still loads over HTTP.
Quick recap
The whole job comes down to four moves. Set both WordPress addresses to HTTPS. Take a backup. Replace your own domain with its secure version in every page, template, and popup. Then rebuild the files, clear every cache, and check the console for anything still loading over HTTP. If the console is clean, the work is done.
Conclusion
To change HTTP to HTTPS in Elementor, confirm your WordPress settings, back up, replace the saved addresses, rebuild the files, and add a redirect. Once the console shows no mixed content warnings, the padlock returns.
Start with the free plugin on your busiest page, then use Pro to finish the rest in one pass.
