Your page loads on https, but the padlock shows a warning — or images and styles look broken. That's mixed content: the page is secure, but something ON it (an image, script or stylesheet) is still loading from an old http:// address.
Why it happens
When the site ran on http, links and media were saved with http addresses — inside page content, menus, theme settings and the database. Moving to https doesn't rewrite history. The browser protects your visitors by blocking or flagging those insecure items.
How to fix it
- Find the culprits: open the page, press F12 in your browser, and read the Console tab — every mixed-content warning names the exact http address being loaded.
- WordPress sites — the database fix: most items live in the database. A search-and-replace plugin (search for "search replace" in Plugins) can swap http://yourdomain.com → https://yourdomain.com across the whole site. Back up first (see the UpdraftPlus guide).
- Check the stubborn spots manually: theme Customizer settings, header/footer logo fields, menu links, widgets, and any address you typed into a page builder — these are the usual hiding places.
- Hard-coded files: if the console points to your theme's files, the theme is loading an http address in its code — update the theme, or ask its developer; switching themes briefly confirms the diagnosis.
- Reload and re-check the console until no mixed-content warnings remain.
✅ Result: The padlock shows clean on every page, with no warnings, and all images and styles load. Your visitors see the fully secure site you intended.
⚠ Common mistakes & fixes
- Only fixing the homepage: old addresses hide in inner pages and posts too. The database-wide replace handles them all at once — spot checks on a few inner pages afterwards are still wise.
- Searching for the wrong domain form: both www and non-www versions may exist in the database. Replace both variants.
- A "force https" plugin AND manual edits fighting: use one main method for the fixes, then verify — layered half-fixes create confusing results.
Related articles
- How to Force HTTPS (Redirect http to https)
- How to Fix SSL Certificate Errors
- How to Back Up Your WordPress Site (UpdraftPlus)