Hosting Rules and Security Plugins
For older HTTP image addresses, distinguish between content, theme setting, and hard-coded template. Changes to serialized data require an appropriate procedure.
A security plugin can complement headers, while hosting or CDN already delivers other values. Check the final answer for conflicting or duplicate defaults before activating another plugin feature.
Where to check the setting in WordPress
Check the response headers outside of a logged-in session and compare Origin and upstream CDN. Headers are not set by a text field in the post. For changes to hosting rules, the actual server or proxy configuration must be responsible.
Example of this specific finding
Illustrative control case: An HTTPS page integrates a script via http://. Browsers can block this insecure resource; a form may not work then.
follow-up audit in WordPress
Test frontend, login and embedded content separately. Do not adopt a blanket blocking rule that interrupts the required functions of the installation.
Switch the responsible integration to an actually functioning HTTPS resource and re-check the browser console and the affected function.
Derogations and scope
Simply replacing the http string with https does not help if the target does not offer a valid HTTPS.
Related: WordPress with classic or block theme. SEO plugins and page builders are different; there is no universal menu path for all installations.
Classify the general error
Definition, system-independent causes and further correction examples: Track the causal involvement to the source