The problem fixed after I enabling force HTTPS in Discourse. Add an option on the WordPress end will be good though.
BTW, even if my post published to Discourse only has a link (followed instruction on WP Discourse template customization). There is still a “show full post” button under the Onebox. And if I click it the link will expand to a full article in plain text. This is not good. I’m a freshman to Discourse. Is this how Discourse treat external links?