Skip to main content
Submit a request

Why does my site show 'Not Secure' or mixed content?

Maxim Tsitsejev
Updated

Applies to: All plans

If your browser shows "Not Secure" or a broken padlock, your site is being served over plain http:// instead of secure https://. There are two common reasons: your SSL certificate is missing or expired, or your pages still contain hard-coded http:// links to images, scripts or stylesheets (this is called mixed content). Both are fixable from your own tools.

Symptoms

  • The address bar shows "Not Secure" or a struck-through padlock.
  • You see a warning like "Your connection is not private" when visiting https://.
  • The padlock shows but the page looks broken (missing images, no styling). Your browser console reports "Mixed Content" errors.

Common causes (most likely first)

  1. Hard-coded http:// asset links (mixed content). Your certificate is fine, but pages load images, CSS or JavaScript over insecure http://, so the browser refuses to show the padlock as fully secure. This is the most common cause for WordPress sites moved from an old host.
  2. No certificate yet. AutoSSL (free Let's Encrypt) issues automatically for every plan, but it cannot complete until your domain points to us. If your nameservers or DNS are not set correctly, no certificate is issued.
  3. An expired or stale certificate. AutoSSL auto-renews, but a renewal can fail if DNS changed or the domain stopped resolving to our server (IPv4 185.185.49.198).
  4. HTTPS is not being forced. A certificate exists, but visitors still land on the http:// version because no redirect is in place.

Quick fixes

1. Confirm you have a valid certificate

In cPanel -> Security -> SSL/TLS Status, check that your domain shows an active AutoSSL certificate. If it is missing or expired, reissue it.

Result: Loading https://yourdomain.com shows a valid certificate and no privacy warning.

If reissuing fails, the usual cause is DNS — your domain must point to our nameservers (ns1.maxinodes.com and ns2.maxinodes.com) and resolve to our server before AutoSSL can validate it. Remember that DNS records here are managed in your client area, not the cPanel zone editor. See the SSL reissue article below.

2. Force HTTPS for every visitor

Once the certificate is valid, redirect all traffic to https://. The simplest way is in cPanel: open cPanel -> Domains -> Domains and enable Force HTTPS Redirect for your domain. For WordPress, set both the WordPress Address and Site Address under Settings -> General to your https:// URL.

Result: Typing the http:// version of your address sends visitors to the secure https:// version automatically.

3. Fix the hard-coded http:// asset links (mixed content)

Mixed content happens when individual links inside your pages still start with http://. To find and fix them:

  1. Open your site in Chrome, press F12 to open developer tools, and read the Console tab. Each "Mixed Content" line names the exact http:// file causing the problem.
  2. WordPress: install a search-and-replace plugin and replace http://yourdomain.com with https://yourdomain.com across the database. Always take a backup first.
  3. Hand-coded sites: edit the affected pages in cPanel -> Files -> File Manager and change each http:// asset URL to https:// (or to a protocol-relative //).

Result: The padlock shows as fully secure, with no console warnings and no missing images or styling.

If that did not work

  • Clear your browser cache, or test in a private/incognito window — old pages can be cached over http://.
  • DNS or certificate changes can take minutes to a few hours (up to 24-48 hours worst case) to propagate.
  • On Managed plans, contact support and we will check the certificate and force HTTPS for you.

Related articles

Comments

0 comments

Please sign in to leave a comment.