A "Not secure" warning or a broken padlock on an HTTPS site usually means some images, scripts or stylesheets are still being requested over plain HTTP. Browsers block or flag those requests.
Find the offending items
Open the page in Chrome, press F12, and look at the Console tab. Mixed content warnings name the exact file being loaded over HTTP.
Fix 1 — update the database (recommended)
Old posts store absolute URLs, so they must be rewritten.
- Install the Better Search Replace plugin.
- Go to Tools → Better Search Replace.
- Search for
http://yourdomain.comand replace withhttps://yourdomain.com. - Select all tables, leave Run as dry run ticked first to see how many rows will change, then untick it and run for real.
Take a backup before running any search and replace across the database.
Fix 2 — hardcoded theme links
If the console points to a file inside your theme, edit the theme file and change the URL to https://, or better, to a protocol-relative or dynamic path.
Fix 3 — external resources
If a third-party font, script or image is only available over HTTP, either find an HTTPS version or host the file yourself in wp-content/uploads.
After fixing, clear any caching plugin and your browser cache, then re-test.
