Old content keeps pointing at insecure URLs.
WHERE THEY HIDE
Image src attributes in posts and pages Links between your own pages Theme customiser settings such as logos Widget content Custom fields Serialised data in plugin settings
WHY IT MATTERS
Insecure resources break the padlock. Insecure internal links send visitors through an unnecessary redirect.
FIXING IT IN WORDPRESS
Use Better Search Replace. Search for http://yourdomain.com and replace with https://yourdomain.com across all tables.
Run a dry run first. Take a database backup before the real run.
The plugin handles serialised data correctly, which a raw SQL replace does not. Do not run a manual SQL replace on a WordPress database.
IN OTHER APPLICATIONS
Use an equivalent search-and-replace tool that understands the data format, or update content by hand if there is little of it.
WHAT NOT TO REPLACE
Only replace your own domain. Replacing http:// globally breaks external links to sites that do not support https.
AFTERWARDS
Clear caches and check the console for remaining warnings.
