Mixed Content Warnings Explained

You enabled HTTPS, yet the browser still flags "not fully secure" — or the padlock is grey. The cause is mixed content: your page loads over https, but some of its resources still load over http. Browsers treat that as insecure, and in many cases silently block the insecure bits.

Passive vs active content

Blocked active content is the dramatic one: sliders not working, forms not submitting, or styles missing. Passive content just keeps a grey padlock.

Why it happens

Somewhere on your site, a resource is referenced with a full http:// address. Common sources:

• Old theme and plugin settings that hard-code http://yourdomain.com.
• Widgets and posts with pasted URLs still in http.
• Third-party embeds (maps, video, fonts) loaded with http.
• A site URL setting in the CMS still pointing at http.

Finding the offenders

1. Open your site in the browser.
2. Press F12 to open developer tools and switch to the Console tab.
3. Refresh the page. Messages like "Mixed Content: The page at https://... was loaded over HTTPS, but requested an insecure script http://..." name the culprit URL directly.

Fixing them

• Easiest global fix: in your CMS or theme settings, rebuild URLs to be scheme-relative or https. For WordPress, the plugin/theme settings plus updates usually resolve most entries; a generic "find and replace http:// to https://" in the database is a well-known one-shot cure.
• Third-party embeds: edit the widget to use https:// or the provider's https embed code.
• Content you pasted: edit posts and swap http:// to https://.

Confirm it's fixed

Reload the page, re-check the Console for mixed content messages, and confirm the padlock is solid. Repeat for each page — pages can differ if your templates hard-code old URLs.