Force HTTPS and fix the missing padlock
Two separate things have to be true for the padlock: the page must be served over HTTPS, and everything on it must be too.
1. Redirect HTTP to HTTPS
Turn on Force HTTPS Redirect in cPanel under Domains. If you prefer to do it by hand, add this at the very top of .htaccess, above the WordPress block:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Test the www and non-www forms separately. It is common for one to redirect and the other not to.
2. Find the mixed content
Open the page, press F12, and look at the Console. It names the exact resource being loaded over HTTP - an image, a stylesheet, a font, a script. That is your culprit, by file name.
3. Fix it at the source
- In WordPress, set both addresses under Settings > General to the
https://form, then run a search-and-replace across the database forhttp://yourdomain.comtohttps://yourdomain.com. Use a tool that handles serialised data - a plain SQL replace corrupts theme options, because PHP stores string lengths alongside the strings. - In hand-written HTML, edit the URLs. Prefer a protocol-relative or fully HTTPS URL.
- For a third-party resource that has no HTTPS version, host the file yourself. There is no way to make an insecure resource secure from your side.
4. Clear every cache
Your caching plugin, any CDN, and your browser. A cached copy of the page from before the fix will keep showing the old warning and send you looking for a problem you have already solved.
Still not showing?
Check the certificate covers the exact hostname you are visiting. A certificate for yourdomain.com does not cover shop.yourdomain.com - that needs its own certificate or a wildcard.