> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.hodi.host/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# My site shows "mixed content" or isn't "fully secure" after switching to HTTPS. Why?

### What's happening

Your site is indeed on HTTPS, but the browser shows a crossed-out padlock, a "not secure" warning, or a **mixed content** message. This means your page is loaded over HTTPS but still calls some resources — images, stylesheets, scripts, fonts, videos — via old **HTTP** addresses. The browser flags (and sometimes blocks) these unsecured elements, because they weaken the page's protection.

In practical terms: the SSL certificate is working, the problem comes from the **content of your pages**, which still contains `http://` links. This is common right after a migration to HTTPS.

### Step 1: Identify the resources involved

1. Open the page in question in your browser.
2. Open the **developer tools** (press `F12`, or right-click › *Inspect*).
3. Look at the **Console** tab: warnings such as *"Mixed Content: The page was loaded over HTTPS but requested an insecure resource…"* list precisely which `http://` URLs need to be fixed.
This tells you exactly which files or links are causing the problem.

### Step 2: Fix the links

The principle is simple: **every resource your site calls must be loaded over** **`https://`** (or as a relative link).
* **Hardcoded links in your code** (theme, templates, HTML): replace `http://votre-domaine.fr/...` with `https://...`, or with relative paths (`/images/logo.png`).
* **External resources** (scripts, fonts, widgets from other sites): check that they are available over HTTPS and update the URL. If a third-party service doesn't offer HTTPS, replace it.
* **Content stored in the database** (posts, images, inserted links): this is often where `http://` URLs are hiding, especially on a WordPress site.

|| If you're using WordPress, first check Settings › General: the WordPress address and site address must both be https://. For links saved in your content, use a search-and-replace plugin (such as Better Search Replace) to replace http://votre-domaine.fr with https://votre-domaine.fr throughout your database.