Fix mixed content after enabling SSL
The padlock is missing because something on the page still loads over http://.
Updated 29 Aug 2026
Your certificate is valid; the browser is complaining that part of the page arrives unencrypted.
Find it. Open the browser console — every blocked request is listed with its URL.
Fix it at the source. In WordPress, update the site and home URLs, then run a search-and-replace across the database for http://yourdomain → https://yourdomain. Editing only the settings leaves old image paths behind.
Then force HTTPS. Redirect at the server rather than with a plugin.
Why is the padlock missing on one page only?
Because one asset on that page is still requested over http:// — nearly always an image pasted with a full URL, or a script a theme hard-codes. The rest of the site is fine, which is why a site-wide setting did not catch it. The console names the file.
Should I turn on HSTS?
Yes, but last, and not while anything is still loading over http://. HSTS tells a browser to refuse the unencrypted version of your site for months, and it is remembered by the visitor rather than by the server — so a mistake cannot be undone by changing the setting back. Fix mixed content first, run for a week, then enable it. Our WordPress hosting plans ship the redirect already configured.