Originally published on wp-nota.com.
You installed an SSL certificate and moved your WordPress site to HTTPS — but the browser still shows "Not Secure" in the address bar, or a padlock with a warning. This is the classic mixed content problem: your pages load over secure HTTPS, but some resources on them — images, scripts, or stylesheets — are still being requested over insecure HTTP. Browsers flag the whole page as not fully secure until every resource is served over HTTPS. Here's how to fix it for good.
What "Mixed Content" Actually Means
When a single page mixes secure (HTTPS) and insecure (HTTP) resources, that's mixed content. The page itself may be secure, but if it pulls in an image or script over http://, the browser can't guarantee the whole page is safe — so it drops the padlock or shows a warning. The cause is almost always old http:// URLs still saved in your database or hardcoded in your theme.
Step 1: Confirm the Certificate and Site URLs
