Task Library
Serve the entire site over HTTPS with zero mixed-content warnings so browsers, Google, and visitors trust every page.
Category: Digital Plumbing
Use this when any page shows "Not secure," a broken padlock, or console mixed-content warnings – or when HTTPS has never been verified end-to-end.
Inputs
- Hosting control panel access (SSL certificate management)
- WordPress admin access
- List of key templates to test: homepage, contact page, a service page, a blog post
Steps
- Confirm a valid SSL certificate covers both the apex domain and www, and that it auto-renews at the host.
- Force HTTPS site-wide: 301-redirect every http:// URL to https:// (host setting or server config). Test by loading the plain http:// version – it must redirect.
- In WordPress, set both the WordPress Address and Site Address to https://.
- Hunt mixed content: open each key template, check the browser console for mixed-content warnings, and search page source for hard-coded http:// references in images, scripts, stylesheets, and embeds.
- Fix offenders at the source – update URLs in content and theme settings (a search-replace on http://yourdomain works for legacy content). Re-check third-party embeds.
- Re-test all key templates: full padlock, no warnings, no console errors. Then confirm Google Search Console tracks the https property.
Definition of done (QA checklist)
- Valid certificate on apex and www, auto-renewing
- http:// URLs 301-redirect to https:// (tested)
- Homepage, contact, service page, and a blog post all show the padlock with zero mixed-content console warnings
- No hard-coded http:// asset references remain in source on tested templates
- Linked back to the definitive article and relevant siblings
- Complies with Blog Posting Guidelines (if it publishes content)
Example(s)
- Example needed – run the Meta-Article Prompt after first real run.
File in the zip: skills/digital-plumbing/configure-https-with-no-mixed-content.md. Download the Task Library zip.
Index: Task Library. Article guidelines.