A broken padlock on an HTTPS site means some resources are still being requested over plain HTTP.
FINDING THEM
Open the page, press F12, and read the Console tab. Each warning names the exact file being loaded insecurely.
THE USUAL CAUSE
Content saved before you enabled HTTPS. Image and link URLs are stored in the database as absolute http:// addresses, so they must be rewritten.
FIXING IT
For WordPress, install Better Search Replace, then replace http://yourdomain.com with https://yourdomain.com across all tables. Run it as a dry run first, and back up the database beforehand.
For other applications, run an equivalent search and replace, or update the content by hand if there is little of it.
HARDCODED THEME OR TEMPLATE LINKS
If the console points to a file inside your theme or template, edit that file and change the URL.
EXTERNAL RESOURCES
If a third-party font, script or image is only available over HTTP, find an HTTPS version or host the file yourself.
AFTERWARDS
Purge your caching plugin, purge Cloudflare if you use it, clear your browser cache, and re-test in a private window.
