Force HTTPS and fix the missing padlock

Two separate things have to be true for the padlock: the page must be served over HTTPS, and everything on it must be too.

1. Redirect HTTP to HTTPS

Turn on Force HTTPS Redirect in cPanel under Domains. If you prefer to do it by hand, add this at the very top of .htaccess, above the WordPress block:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Test the www and non-www forms separately. It is common for one to redirect and the other not to.

2. Find the mixed content

Open the page, press F12, and look at the Console. It names the exact resource being loaded over HTTP - an image, a stylesheet, a font, a script. That is your culprit, by file name.

3. Fix it at the source

• In WordPress, set both addresses under Settings > General to the https:// form, then run a search-and-replace across the database for http://yourdomain.com to https://yourdomain.com. Use a tool that handles serialised data - a plain SQL replace corrupts theme options, because PHP stores string lengths alongside the strings.
• In hand-written HTML, edit the URLs. Prefer a protocol-relative or fully HTTPS URL.
• For a third-party resource that has no HTTPS version, host the file yourself. There is no way to make an insecure resource secure from your side.

4. Clear every cache

Your caching plugin, any CDN, and your browser. A cached copy of the page from before the fix will keep showing the old warning and send you looking for a problem you have already solved.

Still not showing?

Check the certificate covers the exact hostname you are visiting. A certificate for yourdomain.com does not cover shop.yourdomain.com - that needs its own certificate or a wildcard.