# Fixing mixed content warnings

> Why your HTTPS site shows "Not secure" or a broken padlock, and how to fix mixed content in WordPress, Joomla, OpenCart, PrestaShop and other sites.

Source: https://helpcenter.ruachost.com/ssl-security/ssl-certificates/mixing-of-secure-and-insecure-content-on-a-web-page/

**Mixed content** happens when a page loads over `https://` but some of its images, scripts or stylesheets still load over `http://`. Browsers then show a broken padlock, a "Not secure" label, or block parts of the page.

## Find the insecure items

1. Open the page in Chrome, Edge or Firefox.
2. Press **F12** to open developer tools and select the **Console** tab.
3. Look for **Mixed Content** warnings. Each one shows the `http://` address that needs fixing.

You can also use a free online scanner such as [whynopadlock.com](https://www.whynopadlock.com).

## WordPress

1. In **Settings → General**, make sure both addresses start with `https://`.
2. Update old links stored in your content: install a search-and-replace plugin such as **Better Search Replace**, and replace `http://example.com` with `https://example.com` in all tables. Run a dry run first, and back up your database.
3. Clear your cache. With LiteSpeed Cache, click **Purge All**.
4. Check theme settings, page-builder settings and widgets for hard-coded `http://` image or logo links.

Plugins such as **Really Simple SSL** can fix many mixed content issues automatically, but fixing the links themselves is the more reliable long-term solution.

## Joomla

1. In **System → Global Configuration → Server**, set **Force HTTPS** to **Entire Site**.
2. In `configuration.php`, if `$live_site` is set, change it to `https://`.
3. Update `http://` links in articles, modules and template settings.
4. Clear the cache in **System → Clear Cache**.

## OpenCart

1. Edit `config.php` and `admin/config.php` in File Manager. Change every `http://` address (for example `HTTP_SERVER` and `HTTPS_SERVER`) to `https://`.
2. In the admin area, go to **System → Settings → Server** and set **Use SSL** to **Yes**.
3. Update `http://` links in theme and module settings, then refresh the cache from the **Dashboard**.

## PrestaShop

1. In the back office, go to **Shop Parameters → General**.
2. Turn on **Enable SSL**, save, then turn on **Enable SSL on all pages** and save again.
3. Update `http://` links in theme and module settings, and clear the cache in **Advanced Parameters → Performance**.

## Other websites

Search your site's files for `http://` and change links to your own site to `https://` (or to relative links, such as `/images/logo.png`). For external resources, use the `https://` version. If an external service doesn't support HTTPS, replace or remove it.

## Related articles

- [How to force HTTPS on your website](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/how-to-force-redirect-http-to-https-using-htaccess/)
- [Fixing "Your connection is not private" errors](https://helpcenter.ruachost.com/ssl-security/ssl-troubleshooting/connection-not-private-errors/)