Locating exactly what is insecure.
THE BROWSER CONSOLE
Open the page, press F12, and read the Console tab. Each mixed content warning names the exact URL of the offending resource. This is the fastest and most reliable method.
Check several pages, not just the homepage. Older posts with embedded images are the usual culprits.
ONLINE SCANNERS
Several tools crawl a site and report mixed content across many pages at once. Useful for a large site where checking manually is impractical.
SEARCHING THE DATABASE
In WordPress, a search and replace plugin can report how many occurrences of http://yourdomain.com exist before you change anything. That tells you the scale.
WHERE TO LOOK BEYOND CONTENT
Theme customiser settings, particularly logos Widget content Custom fields Plugin settings storing URLs Hardcoded references in theme files
THE ORDER TO WORK
Fix database content first with a search and replace, which resolves most of it. Then use the console to find the remainder, which is usually theme files or external resources.
