A site can have a valid certificate and still show a broken or missing padlock. The usual cause is mixed content: the page itself loads over HTTPS, but something on it, often an old image or embed, still loads over http://. It is common after a site moves to HTTPS, and it is usually quick to fix.
Active vs passive mixed content
| Type | Examples | What browsers do |
|---|---|---|
| Active | Scripts, stylesheets, iframes, fonts, fetch requests | Block it. Parts of the page may break. |
| Passive (display) | Images, audio, video | Try to upgrade to HTTPS automatically; block it if the HTTPS version fails. |
Active mixed content is the one to fix first. A script loaded over HTTP can be replaced in transit, and a replaced script controls the page. Hookgap reports active and passive mixed content as separate findings for that reason.
Finding it
- Open the page, then the browser's developer tools (F12), then the Console. Browsers log each mixed content request.
- View the page source and search for
http://insrc=andhref=attributes on scripts, stylesheets and images. - Check templates and theme settings, not only page content: logos, background images and footer embeds are frequent culprits.
Fixing it on WordPress
- Settings → General: make sure both the WordPress Address and Site Address start with
https://. - Replace old URLs in the database. With WP-CLI:
wp search-replace 'http://example.com' 'https://example.com' --dry-run, check the counts, then run it without--dry-run. Back up first. A well-known search-and-replace plugin does the same job. - Check the theme and page builder for hard-coded
http://asset URLs. - Update or replace embeds from third parties that only offer HTTP.
Fixing it elsewhere
- Static and custom sites: search the codebase for
http://and switch tohttps://or a relative path. - A safety net: the CSP directive
upgrade-insecure-requeststells browsers to fetch every resource over HTTPS. It is useful while you clean up, but it does not fix resources that do not exist over HTTPS. - Cloudflare has an "Automatic HTTPS Rewrites" setting that rewrites many links on the fly.
Then lock in HTTPS
Once the page is clean, add HSTS so browsers never load the site over HTTP again. Website security headers explained covers HSTS and the other headers in a safe order. A free Hookgap check shows whether mixed content is still present on the homepage, alongside the certificate and headers.
Frequently asked questions
What is mixed content?
Mixed content is an HTTPS page that loads some resources, such as images, scripts or stylesheets, over plain HTTP. Those resources travel unencrypted and can be read or changed in transit.
Is mixed content dangerous?
Active mixed content (scripts, stylesheets, iframes) is the serious kind, because whoever alters it can change the whole page; browsers block it. Passive mixed content such as images is lower risk, and modern browsers try to upgrade it to HTTPS automatically.
How do I find mixed content on a page?
Open the browser's developer tools and look at the Console: browsers log every mixed content request they block or upgrade. Searching the page source for "http://" also finds most of it.
Keep reading
Guide · 12 min read
Website security headers explained for small business sites
Each header in plain English, a safe starting value, how to add it on common hosts, and how to avoid breaking the site.
SSL certificate validity 47 days · 6 min read
SSL certificates are moving to 47 days: what MSPs should tell clients
The CA/Browser Forum schedule, why it is happening, and why manual renewals stop being viable for client websites.
security.txt · 4 min read
security.txt: what it is and how to add one in 10 minutes
A short file that tells people how to report a security problem. The required fields, an example, and what to do with reports.