Security
Mixed content warning: why an HTTPS page can still be insecure
An HTTPS page can still request images, scripts, stylesheets, frames, or other resources using plain HTTP. Browsers may block active mixed content or warn because part of the page would bypass the encrypted connection.
Use browser developer tools to identify the exact URL
The console and network panel can show which resource is loaded insecurely and which page requested it. Fixing the certificate will not rewrite an `http://` URL embedded in HTML or application data.
Check application and database URLs
CMS migrations commonly leave old absolute URLs inside content, theme settings, widgets, generated CSS, or serialized configuration. Use application-aware replacement tools rather than blind text substitution on a database.
Update third-party dependencies or remove them
If an external script, font, iframe, or image source does not support HTTPS, replace it or host an appropriate asset through a secure path. Do not weaken browser security to preserve an obsolete dependency.
Verify redirects do not hide the problem
A resource requested over HTTP may redirect to HTTPS, but the initial insecure request can still be undesirable and security policies may block it. Update source URLs to the canonical secure address directly.