Skip to main content
Your site has a certificate, but the browser says it’s “not fully secure”, or the padlock has a warning. This usually means the page loads some images, scripts or styles from http:// addresses. This is called mixed content. This guide shows you how to find and fix it.

​
Find the insecure content

1

Open the page in Chrome or Edge

Go to the page that shows the warning.
2

Open the developer console

Press F12 (or Cmd + Option + J on a Mac) and click the Console tab.
3

Read the warnings

Look for messages containing “Mixed Content”. Each one shows the http:// address of an item loaded insecurely.
You can also use a free online “why no padlock” checker, which lists the insecure items for you.

​
Fix it in WordPress

1

Check your site address

In Settings → General, make sure both addresses start with https://. See Force your website to use HTTPS.
2

Update old links in your content

Older posts and pages still contain http:// links to your own images. Install a search-and-replace plugin, take a backup first, then replace http://yourdomain.com with https://yourdomain.com across your database.
3

Check your theme and plugins

If warnings remain, they may come from your theme’s settings (such as a logo or background image address), a page builder, or a plugin. Update those addresses to https://.
4

Clear your caches

Clear your caching plugin’s cache and your browser cache, then reload the page.
Search-and-replace changes your whole database at once. Download a backup first, so you can undo it if something goes wrong. See Restore and download backups.

​
Fix it on other websites

Edit your site’s files and change http:// links to https://, or to start with // so they follow the page. Check:
  • Image, script and stylesheet addresses in your HTML templates
  • Addresses in your CSS files, such as background images
  • Embedded videos, maps and widgets from other websites
If an item comes from another website that doesn’t support HTTPS, you’ll need to host it yourself, replace it, or remove it.
Still stuck? Open a ticket with the address of a page that shows the warning.