If parts of wp-admin load over HTTP while the rest of the site uses HTTPS, you get mixed content warnings or broken admin assets.
Security Ninja does not force HTTP. It uses the WordPress and Site Address URLs from Settings → General.
- Go to Settings → General.
- Set WordPress Address (URL) and Site Address (URL) to
https://…. - Save changes and hard-refresh wp-admin.
A redirect plugin, host HTTPS force, or .htaccess redirect alone does not fix how WordPress builds admin asset URLs. The two URL fields must use HTTPS.
