Devenia / Learn / Technical SEO
Still Seeing “Not Secure” After Switching to HTTPS? Here’s Why
You switched your site from HTTP to HTTPS, but the browser still shows a security warning. The usual cause is mixed content or another insecure resource that still needs cleanup.
By
Still seeing Not Secure after switching to HTTPS?
You switched your site from HTTP to HTTPS, but the browser still shows a security warning. Something on the page is still not fully secure.
The usual cause is mixed content: the page loads over a secure connection, but one or more resources still use the old insecure path.
The decision to make
- Will you treat the warning as a temporary nuisance, or verify why it appears?
- Have all images, scripts, plugin calls, embeds, and internal references moved to secure versions?
- Can you confirm the migration is complete before visitors and Google keep seeing a trust problem?
Do not ignore the warning
Some site owners think the warning will disappear eventually because they have already switched. It will not disappear unless the cause is fixed.
Visitors leave
Most people do not investigate the technical details. They see a warning and lose confidence in the page.
Rankings can suffer
Google prefers properly secured sites. A half-done migration can weaken technical quality signals.
Trust erodes
Even when visitors do not understand the exact issue, the browser warning makes the site feel unreliable.
Quick refresher: why HTTPS matters
HTTPS protects data between visitors and your website. Google made it a ranking factor years ago, and modern browsers warn users when sites are not secure.
The certificate is only part of the job. The whole page has to load cleanly over the secure connection.
HTTPS provides three layers of protection
- Encryption, so nobody can eavesdrop on what visitors do on your site.
- Data integrity, so data cannot be modified during transfer without detection.
- Authentication, so visitors communicate with your actual site instead of an imposter.
- Trust, because visitors see that the browser connection is handled properly.
- Search confidence, because a clean migration removes a technical quality signal that can hold the site back.
What to expect after a proper migration
After a correct HTTPS switch, expect some temporary ranking fluctuations while Google re-crawls the site. Medium sites often settle in a few weeks, while larger sites may take longer.
- Images still use old paths: An image embedded with an old insecure URL can be enough to break the security indication for the page.
- Scripts and embeds still call old resources: JavaScript files, external feeds, embeds, or plugin resources can keep loading from insecure addresses after the main page has moved.
- Content still contains hardcoded references: Old internal links and pasted references inside content can survive a migration if the database was not cleaned properly.
- Fix many references at once: On WordPress, a search and replace tool can update old site references to the secure version and catch many issues automatically.
- Find the remaining resources: Browser developer tools can show which resources are still loading insecurely so they can be fixed one by one.
Submit an updated sitemap to Google Search Console to speed up discovery. From our testing, properly migrated sites recovered quickly and often saw traffic and ranking improvements. The key word is properly.
Why the warning still appears
Many website owners switch to HTTPS and then wonder why some pages still show as not secure. The problem is usually mixed content.
Common causes
- Old image paths
- Insecure scripts or plugins
- Hardcoded content links
Fix paths
- Search and replace
- Manual inspection
- Technical help
How to fix it
Start with the broad cleanup, then inspect anything that remains. Mixed content often comes from a small number of old references.
- Use a search and replace tool to update old site references across the WordPress database.
- Check browser developer tools for insecure resources on affected pages.
- Review plugins, embeds, feeds, and theme-controlled assets that may call external resources.
- Fix hardcoded content links and media references that still point to old paths.
- Get technical help if you are not comfortable inspecting resource loading and migration settings.
- A botched HTTPS migration can hurt rankings, so it is better to verify than to guess.
Even one insecure resource can make a page look unsafe. The fix is systematic cleanup and verification.
Frequently asked questions
Why does my site still show Not Secure after HTTPS?
The most common reason is mixed content. The page itself loads securely, but one or more images, scripts, embeds, plugin calls, or hardcoded references still load insecurely.
How do I find mixed content on a WordPress site?
Start with a database search and replace for old site references, then use browser developer tools to identify remaining insecure resources on affected pages.
Will the warning disappear on its own?
No. If the warning is caused by mixed content or incomplete migration work, it remains until the old references are fixed and the page loads securely.
A half-done HTTPS migration is not enough
The certificate is not the finish line. The page, resources, links, plugins, and sitemap all need to support the secure version.
- Update old site references across the database.
- Inspect pages for insecure resources.
- Fix plugins, embeds, and hardcoded content paths.
- Submit the updated sitemap and monitor recovery.
If the warning is still visible, treat it as a diagnostic signal. Find the insecure resource before visitors find another site.