Fixing Mixed Content Warnings After Enabling SSL

You've installed an SSL certificate and your site loads over https://, but the browser still shows "Not fully secure" or a broken padlock. This is almost always mixed content — your page is loading some resources over the old insecure http:// protocol. Here's how to find and fix every instance.

What causes mixed content

When a page served over HTTPS references an image, script, stylesheet or iframe using a hardcoded http:// link instead of https://, browsers flag it as mixed content and may block it outright. This is common after enabling SSL on a site that previously ran on plain HTTP, since old content and settings often still reference the http:// version.

• Images, CSS or JavaScript pulled in with a full http:// URL
• A "site URL" or "home URL" setting in your CMS still saved as http://
• Third-party embeds (fonts, ad scripts, widgets) whose provider still serves over HTTP

How to find every instance

• Open your site in Chrome, right-click → Inspect → Console tab — mixed content warnings list the exact URL causing the issue
• Run a free scan with a tool like whynopadlock.com, which lists every insecure resource on the page
• If you're on WordPress, search your database for hardcoded http:// links using a plugin like "Better Search Replace" or "Really Simple SSL"

Fixing it

• Update your CMS's site URL/home URL setting to https:// (in WordPress: Settings → General)
• Replace hardcoded http:// links in page content, theme files, or the database with https:// versions, or use protocol-relative (//) or relative paths where possible
• Enable a "Force HTTPS" or "Fix Insecure Content" setting if your CMS/plugin offers one, which rewrites http:// resource URLs on the fly
• Add a redirect from HTTP to HTTPS in your .htaccess (cPanel does this automatically when you enable "Force HTTPS Redirect" in the SSL/TLS Status page)
• Clear any page caching plugin and your browser cache after making changes, then re-check the padlock