Fix mixed content warnings
The padlock is missing because something on the page still loads over HTTP. Here is how to find it.
Mixed content means the page came over HTTPS but an image, script or stylesheet on it was requested over HTTP. Browsers block the risky ones and drop the padlock on the rest.
Find the culprit
- Open the browser console
The warning names the exact URL that was loaded insecurely.
- Decide where it comes from
Your own content, a theme or plugin, or a third-party embed.
- Fix content in the database
Old posts often contain absolute
http://image URLs.
wp search-replace 'http://example.com' 'https://example.com' --dry-run
wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guidThe guid column is an identifier, not a link. Rewriting it makes feed readers treat every old post as new.
Theme and plugin code
Hard-coded http:// in a template is a bug in that theme or plugin. Report it to the author, and in the meantime use a protocol-relative or HTTPS URL in a child theme.
Third-party embeds
If an external service only serves HTTP, there is no safe fix. Ask them for an HTTPS endpoint, or remove the embed. Do not weaken your own site to accommodate it.