apply_filters( 'wp_get_attachment_url', string $url, int $attachment_id )

More Information

wp_get_attachment_url() doesn’t distinguish whether a page request arrives via HTTP or HTTPS.

Using wp_get_attachment_url filter, we can fix this to avoid the dreaded mixed content browser warning:

add_filter('wp_get_attachment_url', 'honor_ssl_for_attachments');
function honor_ssl_for_attachments($url) {
	$http = site_url(FALSE, 'http');
	$https = site_url(FALSE, 'https');
	return ( $_SERVER['HTTPS'] == 'on' ) ? str_replace($http, $https, $url) : $url;
}