Understanding the two different warnings
“Not Secure” typically means the site has no SSL at all, or the certificate is invalid/expired.
Mixed content warnings mean SSL is active, but some resources on the page (images, scripts, stylesheets) are still being loaded over plain HTTP.
Fixing “Not Secure” (no valid SSL)
- Confirm SSL is actually installed and valid: Security → SSL/TLS Status in cPanel.
- If expired, follow our renewal guide above.
- If never installed, follow our free AutoSSL installation guide.
Fixing mixed content warnings
- Open your browser’s developer console (F12) and check the Console tab — it will list every HTTP resource blocking or triggering the warning.
- For WordPress sites, the most common cause is hardcoded http:// URLs saved in the database from before SSL was installed. Use a plugin like Better Search Replace or WP-CLI’s wp search-replace to update all instances from http://yourdomain.com to https://yourdomain.com.
- For custom-coded sites, search your theme/template files for any hardcoded http:// references (especially in <script>, <link>, and <img> tags) and update them to https:// or protocol-relative (//) URLs.
- Check any third-party embeds (fonts, widgets, ad scripts) — some older embed codes still default to http://.
Confirming the fix
Reload the page in an incognito window and check the address bar for a padlock with no warning icon, and confirm the developer console shows no remaining mixed content errors.
