Fixing "Not secure" and mixed content warnings

If your browser shows a warning on your website, the message tells you where to look.

What you see	What it means	Where to start
"Your connection is not private" or a full-page warning	There's no valid certificate for this address, often for `www` or a subdomain	Free SSL certificates (Let's Encrypt)
"Not secure" and the address starts with `http://`	Visitors aren't being sent to the secure version	Forcing HTTPS on your website
"Not secure" or no padlock, but the address starts with `https://`	Mixed content: some images, scripts or styles still load over `http://`	This article

Finding mixed content

Open the page in Chrome, Edge or Firefox.
Open the developer tools (F12 on Windows or Cmd + Option + I on a Mac) and click Console.
Look for "Mixed Content" warnings. Each one shows the http:// address of the item causing the problem.

Fixing it in WordPress

Back up your website first.
Go to Settings > General and make sure both addresses start with https://.
Replace old http:// links in your content with a search and replace plugin, such as Better Search Replace. Search for http://yourdomain.com and replace it with https://yourdomain.com. Run it as a test first to see how many changes it will make.
Check your theme settings, widgets, custom CSS and page builder settings for any http:// addresses. If you use a page builder, regenerate its CSS files.
Clear your cache, including LiteSpeed Cache if you use it.

Fixing it on other websites

Edit your HTML and CSS files so that images, scripts and styles use https:// addresses or relative addresses such as /images/logo.png.

Items from other websites

If an image or script comes from another website that doesn't support https://, replace it with a secure version or remove it.

We'll do our best to help troubleshoot WordPress, plugins, themes and other third-party software, but for in-depth help, please contact the software's developer or its official support forum.

Knowledge Base