No padlock or 'not secure': fixing mixed content

Your certificate works, your site opens via https, and yet there's no padlock or there's a warning? Then your page is probably still loading elements via http://: images, fonts, scripts or videos. This is called mixed content. The browser doesn't consider the page fully secure.

How to find what's still loading via http

1. Open your site in Chrome, Edge or Firefox via https.
2. Click the icon to the left of the address. There you can see whether the connection is secure.
3. Press F12 and open the Console tab. There you'll see messages with Mixed Content, including the address of each element still loading via http.

You can also use an online checker, such as whynopadlock.com.

Fixing it in WordPress

1. In WordPress, go to Settings and then General.
2. Under WordPress Address (URL) and Site Address (URL), enter https:// instead of http://.
3. Replace the old addresses in your posts and pages. You can do this with a plugin such as Better Search Replace: search for http://yourdomain.com and replace it with https://yourdomain.com. Make a backup first.
4. Then clear the cache of your caching plugin and of your browser.

Please note: If you set the addresses in WordPress to https before the certificate is working, you won't be able to access your admin area. So first check whether https://yourdomain.com works.

Fixing it in other websites

• Search your HTML files, your theme and your settings for http:// and replace it with https://.
• If you're loading something from another website (a font, a video, a widget), use the https address of that site. If it only works via http, look for an alternative.
• For your own links, it's best to use addresses without a domain, such as /images/logo.png. These work via both http and https.

Other causes of 'not secure'

• The certificate has expired or belongs to a different name. Click the icon to the left of the address and view the certificate. Then check Let's Encrypt not working: causes and solutions.
• You're opening the site via http. Automatically redirect visitors to https (see Always redirect visitors to https).
• You're opening a name that's not included in the certificate, for example www while only the domain without www has a certificate (see Certificate for www, subdomains and wildcard).