If your site loads over https:// but the browser still shows Not secure or a broken padlock, the cause is almost always mixed content: the page itself is secure, but it loads an image, stylesheet or script over plain http://. Browsers either block that content or mark the whole page as not secure.
Check the basics first
- Your domain must point to GUDHOST and your free certificate must be issued. If you see a certificate warning rather than "Not secure", see "My site shows a certificate warning".
- In WordPress, open Settings → General and check that both WordPress Address (URL) and Site Address (URL) start with
https://. Only change these oncehttps://works on your domain.
Find the insecure content
- Open the page in Chrome, press F12 and look in the Console tab for "Mixed Content" messages. Each one names the
http://address causing it. - Or test the page with a free tool such as Why No Padlock?.
Fix it
- In WordPress, go to Plugins → Add Plugin, search for SSL Insecure Content Fixer, then install and activate it.
- Open Settings → SSL Insecure Content and choose Simple. If messages remain, try Capture or Capture All.
- For addresses you typed yourself, in posts, widgets or theme settings, edit them to start with
https://. - Check the page again in a private browser window.
If you still see the old version, contact support and we'll clear the cache. If visitors who type http:// aren't sent to https:// automatically, contact support and we'll switch on the HTTPS redirect for your site.