Security and Trust

SSL is valid but the browser still shows a warning

Find why a valid certificate still produces browser warnings by checking mixed content, redirects, HSTS, hostname mismatch, and CDN-origin differences.

Run Mixed Content Scanner Browse workflows

Workflow shape

1Confirm the symptom

2Collect live evidence

3Fix in the right order

4Retest the same URL

What this means

A certificate can be valid while the page still loads insecure assets, redirects through HTTP, uses the wrong hostname, or has inconsistent edge and origin HTTPS settings.

Use this when

The certificate checker says SSL is valid but users still see a warning.
Chrome or Edge shows Not secure on an HTTPS page.
Warnings started after a CDN, theme, plugin, or asset migration.

Evidence

What to collect before changing anything

Certificate issuer, expiry date, SAN hostnames, and TLS chain status.
All HTTP assets loaded by the HTTPS page.
Redirect chain from http to https and from apex to www or the reverse.
Security headers and browser console warning text.

Diagnosis

Run the checks in this order

1Run SSL Certificate Checker on the exact hostname users visit.
2Run Mixed Content Scanner on the affected page, not only the homepage.
3Run Redirect Checker to verify the page never passes through an insecure final state.
4Run Security Headers Grade and check HSTS only after HTTPS works everywhere.
5Compare CDN certificate status with origin server certificate status if a proxy is used.

Fix plan

What to fix first

1Replace HTTP script, stylesheet, image, iframe, and font URLs with HTTPS.
2Fix hostname coverage for apex, www, and important subdomains.
3Normalize redirects so every HTTP request moves directly to the preferred HTTPS URL.
4Enable HSTS after mixed content and certificate coverage are clean.
5Retest from a clean browser profile after cache and CDN purge.

Retest

How to confirm the fix worked

Re-run SSL, mixed content, redirect, and security header checks.
Open DevTools console and confirm there are no mixed content or certificate warnings.
Test the apex and www versions separately.

FAQ

Common questions

Can mixed content hurt SEO?+

It can hurt user trust and page functionality. If crawlers or users cannot reliably access the secure page, organic performance can suffer.

Should I enable HSTS immediately?+

Only after HTTPS works across all important hosts. HSTS can make mistakes more painful because browsers will force HTTPS.

Loading CheckWebs…