Fixing mixed content warnings
Your certificate is fine, the page loads over HTTPS, and the padlock still isn't there. That's mixed content — here's how to find it and fix it.
Mixed content means a page served over https:// is loading something over plain http:// — an image, a script, a stylesheet, a font or an iframe. The browser refuses to call the page fully secure, and modern browsers block insecure scripts and stylesheets outright, which is why a page can also look broken.
Find what is insecure
- Open the page in your browser.
- Open the developer tools (usually F12, or right-click → Inspect).
- Look at the Console tab. Mixed content warnings name the exact URL being loaded insecurely.
- The Network tab shows the same thing: sort by the request URL and look for anything starting with
http://.
Note the offending URLs before you change anything — the fix depends on where they come from.
Fix the source
- Your own files on the same site: change
http://yourdomain.com/image.jpgto/image.jpg. A root-relative path always follows whatever protocol the page used, so it can never go stale again. - Files on another site you control: change
http://tohttps://. Confirm the other site actually serves that file over HTTPS first, or it will simply fail to load. - Third-party embeds (analytics, ads, fonts, maps, chat widgets): use the provider's current HTTPS snippet. Anything that genuinely cannot be served over HTTPS has to be replaced — there is no safe way to keep it.
- Hardcoded links in themes and CSS: search your theme files and stylesheets for
http://and fix the ones pointing at assets.
WordPress specifically
- Go to Settings → General and make sure both WordPress Address and Site Address start with
https://. - Old posts and page-builder content often contain hardcoded
http://URLs saved in the database. Take a backup first, then use a search-and-replace tool that understands serialized data — a plain SQL find-and-replace will corrupt serialized fields. - Clear any caching layer (a caching plugin, and your browser) afterwards, or you will keep seeing the old markup.
Finish the job
In Plesk, open the domain's Hosting settings and enable Redirect from HTTP to HTTPS, so nobody reaches the insecure version of the page in the first place.
Still seeing the warning?
Open a ticket from the Support section of your dashboard and paste the exact console warning, including the insecure URL. Do not just say “the padlock is missing” — the URL is what tells us where to look.