My site shows "mixed content" or isn't "fully secure" after switching to HTTPS. Why?
What's happening
Your site is indeed on HTTPS, but the browser shows a crossed-out padlock, a "not secure" warning, or a mixed content message. This means your page is loaded over HTTPS but still calls some resources — images, stylesheets, scripts, fonts, videos — via old HTTP addresses. The browser flags (and sometimes blocks) these unsecured elements, because they weaken the page's protection.
In practical terms: the SSL certificate is working, the problem comes from the content of your pages, which still contains http:// links. This is common right after a migration to HTTPS.
Step 1: Identify the resources involved
- Open the page in question in your browser.
- Open the developer tools (press
F12, or right-click › Inspect). - Look at the Console tab: warnings such as "Mixed Content: The page was loaded over HTTPS but requested an insecure resource…" list precisely which
http://URLs need to be fixed.
This tells you exactly which files or links are causing the problem.
Step 2: Fix the links
The principle is simple: every resource your site calls must be loaded over https:// (or as a relative link).
- Hardcoded links in your code (theme, templates, HTML): replace
http://votre-domaine.fr/...withhttps://..., or with relative paths (/images/logo.png). - External resources (scripts, fonts, widgets from other sites): check that they are available over HTTPS and update the URL. If a third-party service doesn't offer HTTPS, replace it.
- Content stored in the database (posts, images, inserted links): this is often where
http://URLs are hiding, especially on a WordPress site.
Updated on: 17/07/2026
Thank you!