Why Does My WooCommerce Checkout Show 'Not Secure'?

Why a WooCommerce Checkout Shows Not Secure

Modern browsers treat a page as fully secure only when every single resource it loads — not just the page's own HTML — comes over HTTPS. A single hardcoded http:// image URL, an old script reference, or a stylesheet linked with the wrong protocol is enough to break that guarantee, and the browser flags the whole page as not secure even though the primary connection itself is properly encrypted.

Common Causes of Mixed Content

• Content created or images uploaded before the site moved to HTTPS, with the original HTTP URL baked directly into the content rather than a protocol-relative or HTTPS link.
• A theme or plugin hardcoding an HTTP URL for an asset (a font, an icon, a tracking script) rather than using a protocol-relative or dynamically generated HTTPS URL.
• A payment gateway or third-party embed loading one of its own resources over HTTP, which is worth reporting to the gateway if found, since this is on their side to fix.
• A caching plugin serving an old, pre-HTTPS-migration cached version of the page, which resolves simply by clearing the cache after confirming the underlying content is actually fixed.

How to Find and Fix It

1. Open the browser's developer console on the checkout page — mixed content warnings are typically listed explicitly there, naming the exact insecure resource URL.
2. Fix the specific resource reference to use HTTPS, whether that's in page content, theme code, or plugin settings.
3. Run a site-wide mixed-content scan if the console doesn't immediately reveal it, or if there are multiple instances across the site.
4. Clear all caching layers after fixing the underlying reference.

Finding the insecure resource quickly

1. Read the console. Open the checkout page, then the browser's Console. Chrome logs each mixed-content request, naming the exact URL that loaded over plain HTTP. The Network tab, filtered to requests starting with http://, shows the same list.
2. Work out where the URL comes from. If it sits in page content or a widget, a database search-and-replace fixes it. Use a tool that handles serialized data, such as WP-CLI's search-replace, because a plain text replace can corrupt serialized settings.
3. If it comes from a theme or plugin, look for a setting or an update. If the vendor still loads the file over HTTP, report it to them.
4. Check the site addresses. The WordPress Address and Site Address in Settings → General should both start with https://.

If there is no mixed content

A "Not secure" label can also come from the certificate itself: one that has expired, one that doesn't cover the exact hostname in use (for example, www versus the bare domain), or one served without its intermediate certificate. Open the certificate details from the padlock or site-information icon and check the expiry date and the names it covers, then confirm with an online SSL checker.

Need this tracked down and fixed properly? See WooCommerce fixes.

Go deeper

• Full diagnostic guide: Browser Says “Not Secure” Even Though You Have SSL? Here's Why. — the step-by-step version of this problem, with the likely causes in the order worth checking.