Installing an SSL certificate doesn't automatically make your site "secure" in the browser. If a single image, script or stylesheet still loads over http://, the browser flags mixed content and drops the padlock — sometimes blocking the resource entirely. The fix is two steps: scan your pages for insecure http:// resources, then rewrite the ones on your own domain to https://. External insecure resources you update or remove at the source. Do that and the padlock stays, and browsers stop warning your visitors. HTTPS is only "on" when everything on the page is HTTPS.
Why the padlock disappears even with SSL
Mixed content happens when an HTTPS page loads sub-resources over plain HTTP. It's extremely common after enabling SSL, because old content still contains hard-coded http:// image and link URLs from before the switch. The browser sees a secure page pulling insecure resources and either warns the user ("Not secure" / no padlock) or, for scripts and stylesheets, blocks them outright — which can break your layout. An SSL certificate secures the connection; it can't rewrite the http:// URLs baked into your posts.
Step one: know your posture
Before fixing, check where you stand:
Do the WordPress Address and Site Address both use
https://?Is the admin forced over SSL?
Is there an HSTS header telling browsers to always use HTTPS?
Does your homepage load any insecure resources right now?
That snapshot tells you whether it's a settings problem (URLs still http://) or a content problem (insecure resources on the page) — or both.
Step two: scan for insecure resources
A scan fetches a page and lists every http:// resource in it, separating your own domain (which you can fix) from external ones (which you can't rewrite — you update or remove them). Seeing the actual list turns "why is my padlock gone?" into a concrete checklist.
Step three: rewrite your own links safely
For the insecure resources on your own domain, the fix is to rewrite http://yourdomain to https://yourdomain inside your content. Two guardrails make this safe:
Own domain only. Never blanket-replace every
http://— external links may legitimately need to stay as-is, and rewriting them can break things.Dry-run first. Preview exactly which posts will change and how many occurrences before anything is written.
In GOMAX ULTIMATE these are built in: retrieve_ssl_status gives your HTTPS posture (site/admin scheme, HSTS, homepage mixed-content signal), scan_mixed_content lists the insecure resources on any page split by own vs external, and fix_mixed_content_urls rewrites your own-domain http links to https in post content — dry-run by default and limited to your domain. An AI assistant can run the scan and apply the safe fixes on your approval.
Key takeaways
An SSL certificate alone doesn't stop mixed-content warnings.
One http:// image or script on an HTTPS page breaks the padlock.
Check your posture: site/admin scheme, HSTS, and homepage insecure resources.
Scan pages to list insecure resources, separating your domain from external ones.
Rewrite only your own-domain links to https, with a dry-run first.
Frequently asked questions
Why does my WordPress site say "not secure" even with SSL? Because a resource on the page still loads over http://. The browser flags mixed content and drops the padlock even though your certificate is valid. Fixing the insecure resources restores it.
How do I fix mixed content in WordPress? Scan your pages for http:// resources, then rewrite the ones on your own domain to https://. Update or remove any external insecure resources at their source.
Should I replace every http:// with https://? No. Only rewrite links on your own domain. Blindly replacing all http:// URLs can break external links or resources that must stay as-is.
What is HSTS? An HTTP header that tells browsers to always use HTTPS for your site, preventing downgrade attempts. It's a good addition once your site is fully on HTTPS with no mixed content.
Will fixing mixed content change my content? Only the insecure own-domain URLs inside your posts, and only when you confirm — a dry-run shows exactly what will change before anything is rewritten.
Keep your padlock with GOMAX ULTIMATE — SSL status, mixed-content scanning and safe http-to-https rewriting, self-hosted and pay-once.
Top comments (0)