SSL certificate installed but site still showing "Not Secure" or mixed content warning.

Resolution Steps

1. 1Confirm the SSL certificate is installed and active in the customer's SSL dashboard.
2. 2Verify the certificate is issued for the correct domain — check for www vs. non-www mismatch.
3. 3Check if the site is forcing HTTPS — without a redirect, browsers may still load HTTP.
4. 4Add a 301 redirect from HTTP to HTTPS in .htaccess or the hosting control panel.
5. 5Identify mixed content: open browser DevTools (F12) → Console tab — look for "Mixed Content" warnings.
6. 6Mixed content means the page loads over HTTPS but references HTTP resources (images, scripts, stylesheets).
7. 7For WordPress: use the Better Search Replace plugin to update all HTTP URLs in the database to HTTPS.
8. 8Check the SSL Labs test result — a grade below A usually indicates a configuration issue, not a certificate issue.
9. 9For certificate errors: check the expiration date and renew if within 30 days.
10. 10After making changes, clear the browser cache and CDN cache before retesting.

"I can see your SSL certificate is installed and valid — so the "Not Secure" warning isn't a certificate problem, it's a configuration issue. The good news is this is fixable. What's happening is your site has what's called "mixed content" — your page loads securely over HTTPS, but some of the images or scripts on the page are still being loaded over the old HTTP address. Browsers flag this as insecure even though your certificate is fine. Here's what we'll do: I'm going to walk you through checking your browser's developer tools to see exactly which resources are causing the warning. It takes about 3 minutes and we'll know exactly what needs to be updated. [walk through DevTools steps] Once we identify the resources, [for WordPress: we can fix all of them at once with a plugin / for custom sites: we'll update the URLs in your code]. Does that sound good?"

Quick Links

Related Issues