Why is my padlock icon missing from my website?

Web Hosting & Website Management KB-1278

Summary

This guide helps you troubleshoot and resolve: Why is my padlock icon missing from my website?. Follow the steps below to fix the issue.

Quick Tip: Need immediate assistance? 💻 Open a Ticket

Common Causes

When your website loads over HTTPS but certain elements—such as images, scripts, or stylesheets—are still requested over HTTP, your browser may flag the connection as insecure and suppress the padlock icon. This condition is known as mixed content, and it commonly occurs after an SSL certificate is installed while internal links or asset references remain hardcoded to http://. Without the padlock, visitors may lose confidence in your site, and search engines may treat your pages as less trustworthy.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Why the padlock icon matters

The padlock icon tells visitors that their connection to your website is encrypted and authenticated. When mixed content loads over HTTP, browsers may mark the page as "Not Secure" or remove the padlock entirely. This can erode visitor trust, increase bounce rates, and negatively affect your search engine optimisation (SEO), since Google and other search engines prioritise secure sites in rankings.

Quick Fix Steps

Open your website in Google Chrome or Microsoft Edge.
Look for the security indicator in the address bar. If the padlock is missing or shows a warning, mixed content is likely present.
Right-click anywhere on the page and select Inspect or press F12 to open Developer Tools.
Click the Console tab and look for warnings containing "Mixed Content" or "blocked:mixed-content".
Note the insecure URLs listed, then update them to use https:// in your website files or content management system.
Clear your browser cache and reload the page to confirm the padlock returns.

Detailed Instructions

Identifying insecure resources

Modern browsers block or flag active mixed content, such as JavaScript files, CSS stylesheets, and iframes, loaded over HTTP on an HTTPS page. Passive content like images may still load but can trigger a security warning. The fastest way to find these resources is through your browser's Developer Tools.

Visit your website using https://.
Press F12 or right-click the page and choose Inspect.
Open the Console tab.
Refresh the page if no warnings appear immediately.
Review any entries marked as Mixed Content. Each entry typically shows the full insecure URL that needs updating.

Updating website references to HTTPS

Once you know which resources are loading insecurely, update their references in your website code or content management system.

Open your website files using your FTP client, file manager, or code editor.
Search for instances of http:// within your HTML, CSS, JavaScript, and template files.
Replace hardcoded http:// URLs with https://, or use protocol-relative URLs such as //example.com/image.jpg where appropriate.
If you use a content management system like WordPress, update the Site Address (URL) and WordPress Address (URL) under Settings > General.
Search your database or use a search-and-replace plugin to update hardcoded HTTP links in posts, pages, and media attachments.
Save your changes and upload the modified files if necessary.

Avoid simply forcing all traffic to HTTPS without fixing internal links first. A redirect can send visitors to the secure version of your page, but insecure assets loaded within that page will still trigger mixed content warnings and hide the padlock.

Troubleshooting

Padlock still missing after updating links

Clear your browser cache and cookies, then restart the browser.
Check third-party scripts, embedded videos, or advertising code for hardcoded HTTP references.
Verify that your SSL certificate is installed correctly and has not expired.
Ensure your web server is configured to redirect HTTP traffic to HTTPS.
Use an online SSL checker to confirm your certificate chain is complete and valid.

Content management system-specific steps

WordPress: Go to Settings > General and confirm both address fields use https://. Use a search-and-replace tool to update database entries.
Joomla: Enable HTTPS under System > Global Configuration > Server settings, then update any hardcoded links in articles and modules.
Drupal: Update the base URL in your settings.php file and clear the site cache under Configuration > Performance.

If you are unsure how to edit your site files or database, or if the padlock still does not appear after following these steps, Open a Ticket and our Brisbane support team will investigate and resolve the issue for you.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our team will get it sorted.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?

Need more help? If the issue persists after trying these steps, please open a support ticket and our team will assist you.

💻 Open a Ticket