0

Previously Chrome, Firefox, Edge, and other browsers showed our site as fully SSL/HTTPS secure. For some reason, they now warn about mixed content.

But the content in question seems to be secure.

This only affects a subset of the images on each page. Here's one example—a footer image. The image is entered like this on the WP back-end:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4" />

Firebug > Inspect Element shows:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4">

Firefox > View Source shows:

<img src="https://widgets.guidestar.org/gximage2?o=7583405&l=v4" />

But Firebug > Network tab > Protocol column reports the image as:

HTTP/1.1

Chrome developer tools show the same results. What could cause this problem?

Improve this question
1
  • you could try going doing a db search and replace all http://widget.guidestar.org with https://widget.guidestar.org
    – rudtek
    Commented Dec 28, 2018 at 22:31

2 Answers 2

Reset to default
3

You have "www.wisconsinwetlands.org" URLs redirecting to insecure "http://wisconsinwetlands.org".

The cases you have used these is in the images on the page. Every image that is set as "https://www." redirects to the insecure version.

So while you do need to fix that and correctly configure your setup so that both "www" and non-www URLs are secure, you could quickly solve the problem by removing the www from your image URLs.

Improve this answer
1
  • Brilliant! Thanks for the fix and the short-term work-around. I've successfully used the work-around for our home page and donation page, to reassure year-end donors. DreamHost must have misconfigured redirection either when we added SSL or when we switched to their managed hosting.
    – Andy Giesler
    Commented Dec 28, 2018 at 16:06
2

301 redirects are the reason.

In your site you have this image:

https://www.wisconsinwetlands.org/wp-content/uploads/2015/04/mainheader7-1.jpg

So it looks like HTTPS, but... If you go and visit that link, you'll get redirected with 301 to:

http://wisconsinwetlands.org/wp-content/uploads/2015/04/mainheader7-1.jpg

So it's not over HTTPS.

Improve this answer
1
  • 1
    +1 Thanks -- this was a great clue that helped lead to the solution.
    – Andy Giesler
    Commented Dec 28, 2018 at 16:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.