All content is HTTPS, but browsers warn of HTTP mixed content [closed]

Question

Previously Chrome, Firefox, Edge, and other browsers showed our site as fully SSL/HTTPS secure. For some reason, they now warn about mixed content.

But the content in question seems to be secure.

This only affects a subset of the images on each page. Here's one example—a footer image. The image is entered like this on the WP back-end:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4" />

Firebug > Inspect Element shows:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4">

Firefox > View Source shows:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4" />

But Firebug > Network tab > Protocol column reports the image as:

HTTP/1.1

Chrome developer tools show the same results. What could cause this problem?

Answer 1

You have "www.wisconsinwetlands.org" URLs redirecting to insecure "http://wisconsinwetlands.org".

The cases you have used these is in the images on the page. Every image that is set as "https://www." redirects to the insecure version.

So while you do need to fix that and correctly configure your setup so that both "www" and non-www URLs are secure, you could quickly solve the problem by removing the www from your image URLs.

Answer 2

301 redirects are the reason.

In your site you have this image:

https://www.wisconsinwetlands.org/wp-content/uploads/2015/04/mainheader7-1.jpg

So it looks like HTTPS, but... If you go and visit that link, you'll get redirected with 301 to:

http://wisconsinwetlands.org/wp-content/uploads/2015/04/mainheader7-1.jpg

So it's not over HTTPS.