Fix mixed content warnings
Some assets on your HTTPS page are still loaded over insecure HTTP.
What it means
Mixed content means an HTTPS page loads images, scripts, or iframes over plain HTTP. Browsers downgrade the padlock and may block the asset entirely.
Why it matters
The 'Not fully secure' warning erodes trust at the exact moment visitors check who you are, and blocked assets can silently break images, fonts, or embeds.
How to fix it
- Open DevTools → Console; Chrome lists every insecure URL on the page.
- Update those references to https:// — most are old image links, fonts, or embed code pasted years ago.
- In WordPress, a search-and-replace plugin (or Better Search Replace on the database) fixes bulk http:// links.
- Add a Content-Security-Policy upgrade-insecure-requests directive as a safety net (see our security headers guide).
Helpful tools
- Chrome DevTools Console
- Why No Padlock
Not sure if this affects your site? Analyze your website for free or compare it with a competitor.
Related guides
- Serve the site over HTTPS: The padlock in the address bar — table stakes for trust, SEO, and browser features.
- Add a privacy policy: Legally required in most jurisdictions, and a visible honesty signal.
- Add missing security headers: A few lines of server config that block common attacks and remove browser warnings.