Why does my HTTPS page still show a security warning?

Start with the message, not the padlock

If the browser stops you before the page opens, read the certificate error. An expired certificate, a hostname mismatch or an untrusted issuer will not be fixed by changing image URLs. Check the certificate actually served for the hostname you visited, including the www version if you use it.

If the page opens but parts of it fail or the browser reports mixed content, inspect the page's requests instead.

Find the request that still uses HTTP

Open the browser's developer tools and look at the console. Mixed-content messages identify the insecure URL and often help you find the script, stylesheet or page element responsible.

A typical cause is an image, form endpoint or third-party script saved with an old http:// address. Browsers handle different resource types differently: some requests can be upgraded to HTTPS, while others are blocked. Do not assume that a page which looks normal has no insecure references.

Check the template, content field or plugin that generates the URL. Changing only the homepage redirect does not rewrite hardcoded addresses inside the HTML or JavaScript.

Fix the original reference

Use the working HTTPS destination where the remote service supports it. If it does not, replace or remove the dependency rather than asking visitors to weaken browser security.

For a CMS, check its site URL settings and stored content, then clear the relevant page caches. Use the CMS's supported replacement process and take a backup before a bulk database edit; some stored values need more care than a plain text replacement.

Finally, reload the affected page and repeat the action that produced the warning. A warning on a checkout form or embedded widget may not appear on the homepage. Check the pages visitors actually use, not just the address shown in the navigation bar.