WordPress SSL: How to Fix “Not Secure” and Mixed Content Warnings

Almost every host now includes a free SSL certificate, so having one is no longer the issue. The usual problem is that the certificate is installed and the browser still shows "Not Secure", or the padlock is missing on some pages. This guide explains why that happens and how to fix it.

What SSL does

SSL encrypts the connection between a visitor's browser and your site, so passwords, form entries and payment details cannot be read on the way. Browsers warn visitors about sites without it, and search engines prefer secure sites. For any site with a form or a login, it is not optional.

Why a site shows "Not Secure" with SSL installed

1. WordPress is still set to http

Go to Settings > General and check that both the WordPress Address and Site Address start with https://.

2. There is no redirect from http to https

Both versions of the site may be reachable. Visitors who arrive on the old http address stay on it. Your host's control panel usually has a "force HTTPS" switch. Turn it on.

3. Mixed content

This is the most common cause. The page itself loads securely, but an image, script, font or stylesheet inside it is still requested over http. Browsers then remove the padlock or block the file.

4. The certificate does not cover the address

A certificate issued for example.com may not cover www.example.com or a subdomain. Reissue it to include every address you use.

5. The certificate expired

Free certificates renew automatically, but renewal can fail after a DNS or hosting change. Check the expiry date in your hosting panel.

How to find and fix mixed content

1. Open the page in Chrome, right-click, choose Inspect, and open the Console tab. Mixed content warnings list the exact files.
2. If the files are your own images or links, the old http address is stored in the database. Run a search and replace from http://yourdomain.com to https://yourdomain.com. Take a backup first.
3. If you use a page builder, run its own URL replacement tool too, and regenerate its CSS files. Builders store addresses in their own data. In Breakdance this is under Settings > Tools.
4. If the file comes from another website, update the embed code to its https version or remove it.
5. Clear every cache: plugin cache, host cache and CDN.

After the fix

• Load the home page, a blog post, a form page and the checkout, and check the padlock on each.
• Test both http:// and https://, with and without www. All should land on one secure address.
• Update the site address in Google Search Console and in your analytics if it changed.

SSL is not the whole of security

A padlock means the connection is encrypted. It does not mean the site is safe from being hacked. Outdated plugins and weak passwords are still the main risks. Our guide on how to secure a WordPress site covers those.

Still seeing warnings?

Mixed content hidden in builder data, hard-coded theme files or old plugins can be stubborn. Our bug fixing and technical support team fixes these regularly. Book a free call and send us the address.