My site shows "mixed content" or isn't "fully secure" after switching to HTTPS. Why?

What's happening

Your site is indeed on HTTPS, but the browser shows a crossed-out padlock, a "not secure" warning, or a mixed content message. This means your page is loaded over HTTPS but still calls some resources — images, stylesheets, scripts, fonts, videos — via old HTTP addresses. The browser flags (and sometimes blocks) these unsecured elements, because they weaken the page's protection.

In practical terms: the SSL certificate is working, the problem comes from the content of your pages, which still contains http:// links. This is common right after a migration to HTTPS.

Step 1: Identify the resources involved

1. Open the page in question in your browser.
2. Open the developer tools (press F12, or right-click › Inspect).
3. Look at the Console tab: warnings such as "Mixed Content: The page was loaded over HTTPS but requested an insecure resource…" list precisely which http:// URLs need to be fixed.

This tells you exactly which files or links are causing the problem.

Step 2: Fix the links

The principle is simple: every resource your site calls must be loaded over https:// (or as a relative link).

• Hardcoded links in your code (theme, templates, HTML): replace http://votre-domaine.fr/... with https://..., or with relative paths (/images/logo.png).
• External resources (scripts, fonts, widgets from other sites): check that they are available over HTTPS and update the URL. If a third-party service doesn't offer HTTPS, replace it.
• Content stored in the database (posts, images, inserted links): this is often where http:// URLs are hiding, especially on a WordPress site.

Updated on: 17/07/2026