View plans

SSL and security

How to fix "Not secure" warnings and mixed content errors

If the padlock is missing after SSL is installed, either the certificate does not cover the name you visited, or the page still loads some images, scripts or styles over http://. Check the certificate first, then find and update the insecure links.

Updated 3 min readApplies to: cPanelApplies to: Plesk

What is happening

After you switch to HTTPS, the browser may still show "Not secure", a warning triangle, or a full page warning. There are two separate problems, and they need different fixes:

What you see Problem
Full page warning such as NET::ERR_CERT_COMMON_NAME_INVALID or ERR_CERT_DATE_INVALID The certificate is missing, expired, or does not cover this name
ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH The server is not serving a certificate for this name on port 443, or only offers outdated settings
Page loads, but padlock missing or "Not fully secure" Mixed content: some files still load over http://

ODHOST shared plans include a free SSL certificate. For how certificates work in general, see how SSL certificates work.

Part 1: check the certificate

  1. Click the padlock or warning icon in the address bar and open the certificate details. Note which names it covers and its expiry date. Also check your computer's date and time; a wrong clock causes false date errors.
  2. Open Security > SSL/TLS Status in cPanel. It lists each domain and subdomain and whether it has a valid certificate. Make sure both yourbusiness.in and www.yourbusiness.in are covered. Depending on how the server is set up, this page may offer an option to request or renew certificates. In Plesk, check the domain's SSL/TLS Certificates page. Menus vary by version and host configuration.
  3. Check DNS if a name is not covered. Certificates can only be issued for names that point to the server, so a www record pointing elsewhere blocks it. See A record vs CNAME.
  4. Wait and recheck if you changed DNS recently, because issuance runs after DNS has updated.

Part 2: find mixed content

  1. Open the page in Chrome or Firefox and press F12 to open developer tools.
  2. Read the Console tab. Each insecure file appears as a "Mixed Content" message naming the http:// address.
  3. Repeat on your key templates: home page, a blog post, a product page, the cart and the contact form.

  1. Back up files and the database first.

  2. Update WordPress settings. In Settings > General, change both URLs to https://. If this causes a loop, follow fixing too many redirects.

  3. Replace old URLs stored in the database. With WP-CLI (if your hosting offers command line access), always run a dry run first:

    wp search-replace 'http://yourbusiness.in' 'https://yourbusiness.in' --all-tables --dry-run
wp search-replace 'http://yourbusiness.in' 'https://yourbusiness.in' --all-tables

    Without command line access, use a reputable search and replace plugin. Do not run a plain SQL REPLACE on WordPress tables; it breaks serialised data such as widget settings.

  4. Edit hard coded links in theme files, custom CSS (background: url(http://...)), page builder settings and widgets.

  5. Change third party embeds (old video, map or font codes) to their https:// versions, or remove them if the provider has no HTTPS version.

  6. Add a temporary safety net if needed. The header Content-Security-Policy: upgrade-insecure-requests asks browsers to fetch http:// resources over HTTPS. It does not fix links to sites without HTTPS.

Part 4: HSTS, last and carefully

HTTP Strict Transport Security (HSTS) tells browsers to use only HTTPS for your domain for a set time. Add it only after everything works, starting with a short time:

Header always set Strict-Transport-Security "max-age=300"

Raise max-age gradually. Do not add includeSubDomains or submit to the preload list until every subdomain, including mail and old staging names, has a valid certificate. Removing a domain from browser preload lists is slow. More hardening tips are in how to secure a website.

How to confirm it worked

  • The padlock shows on every page you tested, with no Console warnings.
  • Certificate details list all names you use and a future expiry date.
  • http:// addresses redirect to https:// once, without a loop.

If it still fails

Open a support ticket and include:

  • The exact URL and the full browser error code
  • A screenshot of the certificate details or the SSL/TLS Status page
  • Console messages listing the insecure URLs
  • Whether you use a CDN or proxy
  • When you enabled SSL or changed DNS (IST)

Frequently asked questions

What is mixed content?

A page loaded over HTTPS that also pulls images, scripts, styles or fonts over plain HTTP. Browsers block insecure scripts and styles and mark the page as not fully secure.

Does www need its own certificate?

The certificate must list every name visitors use. If it covers yourbusiness.in but not www.yourbusiness.in, the www address shows a name mismatch warning.

Is a plugin enough to fix mixed content?

A plugin can rewrite links on the fly, but it adds work to every page view and hides the real problem. Updating the stored URLs once is the cleaner fix.

Should I turn on HSTS?

Only after every page and subdomain works over HTTPS, and start with a short max-age. HSTS makes browsers refuse HTTP for your domain until it expires, so mistakes are hard to undo.

Sources and further reading

Contact us