The answer to both issues in the title of this help article is the same: if you’ve recently forced HTTPS on your site and are noticing some broken images or assets—or if they’re loading properly, but you’re seeing “insecure content” warnings and not seeing the padlock in the browser bar—this is likely due to images and other assets being called into the page insecurely.
When you’re forcing HTTPS, your browser tries to require all site assets to be served via the secure HTTPS protocol. But if you have hard-coded HTTP URLs or active plugins that are using HTTP explicitly, you’ll likely see a warning in the browser address bar instead of the famous padlock, meaning that while your site is loading over HTTPS, it’s calling insecure assets over plain HTTP.
There are a few ways to go about addressing this problem. The best way is to use your browser’s developer tools (and console, specifically) to determine what assets are being called via HTTP. Once you’re aware of those URLs, you can track them down in your site’s content, settings, template files or plugins, and switch them to HTTPS.
In most cases, you can also use relative links with WordPress. For example, if you have a link that looks like this:
You can either replace “http” with “https” to force the image to load securely, or you can make it a relative link by removing the domain entirely, like so:
Relative links follow the lead of whatever protocol the page is already using, so if you’re forcing HTTPS, a relative link will always load over HTTPS automatically.
Sometimes a site’s database can make reference to HTTP links. If you’re not familiar with the MySQL language, you can use a search-and-replace plugin like Better Search Replace to automate the process of updating HTTP links and URLs to HTTPS in your database. Just be aware that you should use the full protocol and domain together in both the “search” and “replace” fields, like so: searching for “http://example.com” and replacing with “https://example.com”.
Note the full protocol at the beginning and lack of a slash or other text at the end of those domains. Aside from the extra “s,” the two should be identical.
The above techniques should fix the issue, but it will depend somewhat on the site and theme. If your theme stores its settings and other data in unusual ways in the database, or if the theme files themselves contain references to the HTTP version of your domain, you’ll likely need to make a manual replacement. This will also be the case if you have background images stored as HTTP links in your site’s CSS.
Some themes and site builders have their own layer of cache or offer a feature which generates static CSS files. While these things can improve site performance, they can also prevent protocol (HTTP/HTTPS) changes from showing immediately. Linked below are some resources from some of the more popular site builders which explain how to update static CSS files and/or clear theme cache.
If you’ve looked through your theme files and plugins but are still not getting the padlock icon, there are plugins available to try to help rewrite HTTP URLs to HTTPS on the fly. We typically recommend the SSL Insecure Content Fixer plugin. Just activate it, and the plugin will attempt to switch any HTTP URLs to HTTPS so they can be served properly. Note, however, that this plugin is not able to change hard-coded URLs in content or in theme or plugin files.
If that plugin doesn’t seem to be working right away, be sure to head to Settings > SSL Insecure Content from the WordPress admin menu and adjust as recommended. Depending on how your site is configured, “Simple” mode may work for you, or you may need to change it to a higher setting.
We also use Why No Padlock to help identify any remaining insecure assets. It’s a very simple website that you can enter your site’s web address into (don’t forget the HTTPS!). Enter your URL and click ‘Run’ to see the results. Any URLs that are being called insecurely will be listed for you to investigate.
If you’re still stuck after that, or if you have any other questions, contact us, and we’ll be happy to do what we can to help identify any other insecure asset issues and recommend fixes.
New to Flywheel? Start here, we've got all the information you'll need to get started and launch your first site!
Migrating your site from another host to Flywheel
How do I go live on Flywheel?
What is a Demo Site?
Learn all about managing your Flywheel user account, Teams and integrations.
Your role as a collaborator
How do I transfer sites to/from an Organization?
What is a collaborator in Flywheel?
Everything about billing, invoices and payments can be found here.View all
Flywheel hosting plans include a ton of great features. Learn about how to get a free SSL certificate, set up a staging site, and more!View all
All the server and setting info you'll need to help you get the most out of your Flywheel hosting plan!
Can I get access to my database?
What plugins are not recommended?
How do I access my site via SFTP?
Tips and tricks for managing your sites on Flywheel, including going live, troubleshooting issues and migrating or cloning sites.View all