You've moved your site to HTTPS, your SSL certificate is valid — yet visitors still see a "Not secure" warning or a padlock with a triangle. The likely culprit: mixed content.
What is mixed content?
Mixed content happens when a page loaded over secure HTTPS pulls in resources over plain HTTP — images, scripts, stylesheets, fonts, or iframes. Because those pieces travel unencrypted, the browser can't fully trust the page, even though the main document is secure.
Why it matters
- Active mixed content (scripts, iframes) is the dangerous kind. Attackers can intercept or replace an unencrypted script, so modern browsers block it outright — which can quietly break sliders, forms, and widgets.
- Passive mixed content (images, audio) won't be blocked, but it downgrades your security indicator and erodes visitor trust.
- It creates real blind spots: if a script was tampered with in transit, you may never notice.
How it happens
The usual suspects: hardcoded http:// URLs left behind after an HTTPS migration, third-party embeds or widgets served over HTTP, and CMS content that copied absolute URLs instead of relative ones.
How to find and fix it
- Open your browser's DevTools and look in the Console tab for "Mixed Content" warnings — they'll list every insecure resource.
- Replace hardcoded http:// URLs with https:// (or relative URLs) in your theme, plugins, and database.
- Run a free vulnerability scan — a quick scan of your site flags insecure resource loading alongside the bigger vulnerabilities worth fixing first. Try a free check at https://vulnerabilitytools.com/ before your next audit.
- Add the Content-Security-Policy: upgrade-insecure-requests header so browsers automatically upgrade stray HTTP requests, and enable HSTS to lock the site to HTTPS.
Bottom line: HTTPS is only as strong as its weakest resource. Clean up mixed content, and your padlock — and your visitors' trust — stay intact.
