How to Fix "Not Secure" Warnings and Force HTTPS on Your Website

You installed a valid SSL certificate, but the browser still says "Not secure", or the padlock appears on some pages and not others. The certificate is almost certainly fine. The problem is that your pages are still requesting some resources over plain HTTP, or your site is not redirecting visitors to HTTPS at all. This guide fixes both, in the right order.

Step 1 - Find the mixed content

Mixed content means an HTTPS page pulling in an image, stylesheet, script or font over HTTP. Browsers block the dangerous ones outright and withhold the padlock for the rest.

1. Open the affected page in Chrome or Firefox.
2. Press F12 to open developer tools and select the Console tab.
3. Reload the page.
4. Look for warnings containing "Mixed Content". Each one names the exact URL being loaded insecurely.

Write down every offending URL before changing anything. There are usually only two or three distinct sources, repeated many times.

Step 2 - Fix it at the source

Hard-coded URLs in your own templates

Search your theme and template files for http:// and change your own URLs to https://, or make them root-relative:

<!-- Before -->
<img src="http://yourdomain.com/images/logo.png">

<!-- After: relative, so it always matches the page -->
<img src="/images/logo.png">

URLs stored in a database (WordPress and similar)

Most CMS mixed content comes from URLs saved in post content years ago. The safe way to fix it:

1. Take a backup first. A partial backup of the database from cPanel takes under a minute.
2. In Settings → General, set both the WordPress Address and Site Address to the https:// form.
3. Use a reputable search-and-replace plugin, or WP-CLI over SSH, to rewrite the remainder. Always run a dry run first:

# Preview the changes
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --dry-run

# Apply them
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com'

Third-party resources

If an external script or font is only available over HTTP, either switch to the provider's HTTPS endpoint, host the file yourself, or stop using it. There is no way to load HTTP content on an HTTPS page safely.

Step 3 - Force HTTPS for every visitor

With mixed content resolved, redirect all HTTP traffic to HTTPS. Edit .htaccess in public_html using cPanel's File Manager (enable Show Hidden Files in Settings first), and add this at the very top:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

To also standardise on the www form (or the bare domain) in the same pass, use one of these instead:

# Force HTTPS and www
RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.yourdomain.com%{REQUEST_URI} [L,R=301]

# Force HTTPS and drop www
RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://yourdomain.com%{REQUEST_URI} [L,R=301]

cPanel also offers a Force HTTPS Redirect toggle under Domains. If you enable that, do not add the rewrite rules above as well.

Step 4 - Verify

1. Visit http://yourdomain.com and confirm it redirects to HTTPS.
2. Check the padlock appears with no console warnings.
3. Test several pages, not just the homepage - mixed content is often confined to one template.
4. Test in a private window, so no cached redirect masks the result.
5. Confirm the redirect is a 301, not a 302, so search engines transfer ranking signals.

curl -I http://yourdomain.com

Step 5 - Housekeeping after the switch

• Update the site URL in Google Search Console and Bing Webmaster Tools, and resubmit your sitemap.
• Update the property URL in your analytics platform.
• Update any hard-coded links in email templates, social profiles and printed material.
• Check that your sitemap lists the HTTPS URLs.
• Update canonical tags if your CMS does not do it automatically.

Troubleshooting

Frequently asked questions

Why does one page show the padlock and another does not?

Mixed content is per page. A single HTTP image on one page is enough to withhold the padlock there while the rest of the site is fine.

Should I use HSTS?

Only once HTTPS has been working reliably for a while. HSTS tells browsers to refuse HTTP for your domain for a set period, and it cannot be undone quickly if something breaks. Start with a short max-age.

Do I have to update every old link on the internet?

No. The 301 redirect handles inbound links from anywhere. Update the ones you control - email templates, social profiles, ads.

Will this affect my SEO?

Positively, as long as you use 301 redirects and register the HTTPS property in Search Console. Expect a brief fluctuation while search engines recrawl.

Does Fast Hive do this for me?

The certificate is automatic. The redirect and the mixed content are inside your site's code, so they are yours to change - but our team will happily add the redirect rule for you if you ask.