WordPress still shows “Not secure” after installing SSL

If WordPress still shows “Not secure” after you install a certificate, the database is usually the culprit: the WordPress Address and Site Address are still http://, and thousands of absolute http:// links sit inside posts, page-builder layouts, widgets and theme options. Change both addresses under Settings > General, then run a serialization-safe search and replace (Better Search Replace or WP-CLI) from http://yourdomain to https://yourdomain. Purge every cache afterwards and keep only one HTTPS redirect.

What you'll see

The host says the certificate is active and https:// loads, yet Chrome shows “Not secure” or a plain icon instead of a padlock. Some images, fonts or embedded maps fail to appear on the HTTPS version, and the console fills with “Mixed Content” warnings. Occasionally the admin area loops between http and https.

Why it happens

1. The two site URLs were never changed

WordPress builds most links from the WordPress Address (URL) and Site Address (URL) fields. If they still begin with http://, WordPress keeps generating insecure links even though the certificate works.

2. Old http:// links are stored in the database

Image URLs in post content, Elementor, Divi or Beaver Builder layout data, menu items, widgets and Customizer settings are saved as full addresses. Changing the site URL does not touch them, so every page that uses them pulls an insecure file.

3. A theme, plugin or embed hard-codes http

An old theme option, a Google Fonts call in header.php, or a third-party widget loaded with http:// keeps the warning alive even after the database is clean.

4. A proxy makes WordPress think it is on http

Cloudflare’s Flexible SSL mode encrypts only the visitor-to-Cloudflare leg, so WordPress sees plain http from the proxy. Combined with a redirect plugin, that produces redirect loops or mixed links. Cached pages from before the switch add to the confusion.

How to fix it

Open the page in Chrome, then DevTools > Console. Copy every URL in the “Mixed Content” messages; they tell you whether the leftovers are uploads, theme files or third-party embeds.
Go to Settings > General and change both WordPress Address (URL) and Site Address (URL) to https://, using the same www or non-www host you actually serve. If those fields are greyed out, they are defined as WP_HOME and WP_SITEURL in wp-config.php; edit them there.
Take a full database backup, install Better Search Replace, and search for http://yourdomain.com replacing with https://yourdomain.com across all tables with “Run as dry run” ticked. Review the counts, then run it for real. WP-CLI users can run wp search-replace with --dry-run first.
If you use Elementor, open Elementor > Tools > Replace URL and then Regenerate CSS & Data, because the builder keeps its own copies of URLs in generated CSS files.
Choose one way to force HTTPS (the host panel, an .htaccess rule, or Really Simple SSL) and remove the others. With Cloudflare, set SSL/TLS to Full (strict) rather than Flexible.
Purge the caching plugin, the host cache and the CDN. Use SSL Insecure Content Fixer only as a temporary bridge while you clean up, not as the permanent fix.

How to check it's fixed

Open the home page, a post, a page built with your page builder and any form page in a private window. Each should show a padlock.
Keep the Console open on those pages and confirm there are no Mixed Content warnings left.
Type the http:// address of an inner page and confirm it lands on the https:// version in a single hop.

What a QAlaunch scan shows for this

Whether the page is served over HTTPS and which security headers come back with it.
Mixed Content warnings in the console and insecure requests the browser blocked, listed with their URLs.
Images that fail to load on the HTTPS page, which is how leftover http:// uploads usually show up.
The scan reads the visitor side only; it cannot open your database, wp-config.php or Cloudflare settings.

See exactly what a full report contains in the sample report.

Frequently asked questions

Is Really Simple SSL enough on its own?

It handles the redirect and rewrites many insecure links on the fly, which hides the problem. The old http:// URLs are still in the database, so if the plugin is ever deactivated the warnings return. A one-time search and replace is the lasting fix.

Is it safe to run Better Search Replace?

Yes, with a backup and a dry run first. It understands serialized PHP data, which is how page builders and widgets store settings, so it updates lengths correctly. A raw SQL replace in phpMyAdmin can corrupt that data.

Why does my admin redirect in a loop after switching to HTTPS?

Usually a proxy like Cloudflare on Flexible mode is sending plain http to the server while WordPress forces https. Switch the proxy to Full (strict) with a valid origin certificate, or ask your host about forwarding the HTTPS header.

Done for you · not automated

Rather have a QA engineer test it by hand?

If this is a site you're launching or handing to a client, I'll go through it by hand, including the WordPress-specific issues a scan can't reach, like logged-in flows.

$299one-time · 3 business days

Up to 10 key pages tested by hand, not a scan
Every flow a customer uses: forms, sign-up, checkout, booking
Real mobile and desktop browsers
A written report in plain language, with screenshots
A 15-minute call to walk you through it
10 years of professional QA experience

Tell me about your site and I'll reply personally, usually the same day.

No payment now. I'll confirm scope and price first.

Written by Waqas Ahmad, QA engineer with 10 years of professional testing experience. Last checked October 26, 2026.

Sources: MalCare: fix WordPress mixed content · SSL Insecure Content Fixer plugin · WP Fix It: broken images after moving to HTTPS