Devenia / Learn / Technical SEO

Still Seeing “Not Secure” After Switching to HTTPS? Here’s Why

You switched your site from HTTP to HTTPS, but the browser still shows a security warning. The usual cause is mixed content or another insecure resource that still needs cleanup.
Generated editorial image showing mixed content warnings being converted into secure website resources.

Still seeing Not Secure after switching to HTTPS?

You switched your site from HTTP to HTTPS, but the browser still shows a security warning. Something on the page is still not fully secure.

The usual cause is mixed content: the page loads over a secure connection, but one or more resources still use the old insecure path.

The decision to make

Will you treat the warning as a temporary nuisance, or verify why it appears?
Have all images, scripts, plugin calls, embeds, and internal references moved to secure versions?
Can you confirm the migration is complete before visitors and Google keep seeing a trust problem?

Do not ignore the warning

Some site owners think the warning will disappear eventually because they have already switched. It will not disappear unless the cause is fixed.

Visitors leave

Most people do not investigate the technical details. They see a warning and lose confidence in the page.

Rankings can suffer

Google prefers properly secured sites. A half-done migration can weaken technical quality signals.

Trust erodes

Even when visitors do not understand the exact issue, the browser warning makes the site feel unreliable.

Quick refresher: why HTTPS matters

HTTPS protects data between visitors and your website. Google made it a ranking factor years ago, and modern browsers warn users when sites are not secure.

The certificate is only part of the job. The whole page has to load cleanly over the secure connection.

HTTPS provides three layers of protection

Encryption, so nobody can eavesdrop on what visitors do on your site.
Data integrity, so data cannot be modified during transfer without detection.
Authentication, so visitors communicate with your actual site instead of an imposter.
Trust, because visitors see that the browser connection is handled properly.
Search confidence, because a clean migration removes a technical quality signal that can hold the site back.

What to expect after a proper migration

After a correct HTTPS switch, expect some temporary ranking fluctuations while Google re-crawls the site. Medium sites often settle in a few weeks, while larger sites may take longer.

Images still use old paths

An image embedded with an old insecure URL can be enough to break the security indication for the page.

Scripts and embeds still call old resources

JavaScript files, external feeds, embeds, or plugin resources can keep loading from insecure addresses after the main page has moved.

Content still contains hardcoded references

Old internal links and pasted references inside content can survive a migration if the database was not cleaned properly.

Fix many references at once

On WordPress, a search and replace tool can update old site references to the secure version and catch many issues automatically.

Find the remaining resources

Browser developer tools can show which resources are still loading insecurely so they can be fixed one by one.

Submit an updated sitemap to Google Search Console to speed up discovery. From our testing, properly migrated sites recovered quickly and often saw traffic and ranking improvements. The key word is properly.

Why the warning still appears

Many website owners switch to HTTPS and then wonder why some pages still show as not secure. The problem is usually mixed content.

Common causes

  • Old image paths
  • Insecure scripts or plugins
  • Hardcoded content links

Fix paths

  • Search and replace
  • Manual inspection
  • Technical help

How to fix it

Start with the broad cleanup, then inspect anything that remains. Mixed content often comes from a small number of old references.

Use a search and replace tool to update old site references across the WordPress database.
Check browser developer tools for insecure resources on affected pages.
Review plugins, embeds, feeds, and theme-controlled assets that may call external resources.
Fix hardcoded content links and media references that still point to old paths.
Get technical help if you are not comfortable inspecting resource loading and migration settings.
A botched HTTPS migration can hurt rankings, so it is better to verify than to guess.

Even one insecure resource can make a page look unsafe. The fix is systematic cleanup and verification.

Frequently asked questions

Why does my site still show Not Secure after HTTPS?

The most common reason is mixed content. The page itself loads securely, but one or more images, scripts, embeds, plugin calls, or hardcoded references still load insecurely.

How do I find mixed content on a WordPress site?

Start with a database search and replace for old site references, then use browser developer tools to identify remaining insecure resources on affected pages.

Will the warning disappear on its own?

No. If the warning is caused by mixed content or incomplete migration work, it remains until the old references are fixed and the page loads securely.

A half-done HTTPS migration is not enough

The certificate is not the finish line. The page, resources, links, plugins, and sitemap all need to support the secure version.

1

Update old site references across the database.

2

Inspect pages for insecure resources.

3

Fix plugins, embeds, and hardcoded content paths.

4

Submit the updated sitemap and monitor recovery.

If the warning is still visible, treat it as a diagnostic signal. Find the insecure resource before visitors find another site.