Padlock Missing After Installing SSL? Look for Mixed Content

You put an SSL certificate in place, the address bar shows https://, and the browser still labels the site "Not Secure". Mixed content is usually why: an https page that still pulls some images, styles or scripts over plain http://.

Three points worth knowing first:

Browsers do not treat every request the same way. Scripts and stylesheets loaded over http:// are blocked, which can leave the page looking broken. Images may still load, but with a warning that drops the padlock. You can list every offender yourself. Open the browser console on the page, reload, and each blocked http:// address is named. On WordPress the source is often older content. Links saved before SSL remain http:// until you run a search-and-replace on the database, after a backup and a dry run.

Before you start that work, rule out a certificate error. "Connection is not private" is a different problem from a missing padlock.

The full walkthrough, including the WordPress commands, the .htaccess safety net and the redirect to https, is in ShoHost's mixed content fix for WordPress and other sites. The guide was tested in a sandbox on a real WordPress install, not written from memory.

ShoHost Team