Why Does My WooCommerce Checkout Show 'Not Secure'?
Why a WooCommerce Checkout Shows Not Secure
Modern browsers treat a page as fully secure only when every single resource it loads — not just the page's own HTML — comes over HTTPS. A single hardcoded http:// image URL, an old script reference, or a stylesheet linked with the wrong protocol is enough to break that guarantee, and the browser flags the whole page as not secure even though the primary connection itself is properly encrypted.
Common Causes of Mixed Content
- Content created or images uploaded before the site moved to HTTPS, with the original HTTP URL baked directly into the content rather than a protocol-relative or HTTPS link.
- A theme or plugin hardcoding an HTTP URL for an asset (a font, an icon, a tracking script) rather than using a protocol-relative or dynamically generated HTTPS URL.
- A payment gateway or third-party embed loading one of its own resources over HTTP, which is worth reporting to the gateway if found, since this is on their side to fix.
- A caching plugin serving an old, pre-HTTPS-migration cached version of the page, which resolves simply by clearing the cache after confirming the underlying content is actually fixed.
How to Find and Fix It
- Open the browser's developer console on the checkout page — mixed content warnings are typically listed explicitly there, naming the exact insecure resource URL.
- Fix the specific resource reference to use HTTPS, whether that's in page content, theme code, or plugin settings.
- Run a site-wide mixed-content scan if the console doesn't immediately reveal it, or if there are multiple instances across the site.
- Clear all caching layers after fixing the underlying reference.
Need this tracked down and fixed properly? See WooCommerce fixes.