0

Previously Chrome, Firefox, Edge, and other browsers showed our site as fully SSL/HTTPS secure. For some reason, they now warn about mixed content.

But the content in question seems to be secure.

This only affects a subset of the images on each page. Here's one example—a footer image. The image is entered like this on the WP back-end:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4" />

Firebug > Inspect Element shows:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4">

Firefox > View Source shows:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4" />

But Firebug > Network tab > Protocol column reports the image as:

HTTP/1.1

Chrome developer tools show the same results. What could cause this problem?

closed as off-topic by Krzysiek Dróżdż, Jacob Peattie, rudtek, fuxia Jan 4 at 22:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – Krzysiek Dróżdż, Jacob Peattie, rudtek, fuxia
If this question can be reworded to fit the rules in the help center, please edit the question.

  • you could try going doing a db search and replace all http://widget.guidestar.org with https://widget.guidestar.org – rudtek Dec 28 '18 at 22:31
3

You have "www.wisconsinwetlands.org" URLs redirecting to insecure "http://wisconsinwetlands.org".

The cases you have used these is in the images on the page. Every image that is set as "https://www." redirects to the insecure version.

So while you do need to fix that and correctly configure your setup so that both "www" and non-www URLs are secure, you could quickly solve the problem by removing the www from your image URLs.

  • Brilliant! Thanks for the fix and the short-term work-around. I've successfully used the work-around for our home page and donation page, to reassure year-end donors. DreamHost must have misconfigured redirection either when we added SSL or when we switched to their managed hosting. – Andy Giesler Dec 28 '18 at 16:06
2

301 redirects are the reason.

In your site you have this image:

https://www.wisconsinwetlands.org/wp-content/uploads/2015/04/mainheader7-1.jpg

So it looks like HTTPS, but... If you go and visit that link, you'll get redirected with 301 to:

http://wisconsinwetlands.org/wp-content/uploads/2015/04/mainheader7-1.jpg

So it's not over HTTPS.

  • 1
    +1 Thanks -- this was a great clue that helped lead to the solution. – Andy Giesler Dec 28 '18 at 16:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.