I’m not a professional web developer so if it involves complicated code interventions I’ll probably need to pay someone.

However, I’ve just built a new WP site with Elementor, hosted by GOdaddy. Bought an SSL cert and all installed ok. Had familiar problem with site still showing as not secure and so tried all the fixes - clear cache, plugins, redirection, changing the file path on Elementor etc.

I can see though that all the media files are still http, and this may be the problem. If I delete them and upload again they still show as http. I don’t know how to change the media files to https.

Must have spent over 6 hours so far, and can’t figure out a fix. Weirdly, some browsers show the site as secure and others do not. The padlock appears sometimes and not others, on the same page! Www.careerchangenetwork.co.uk. Help!

  • note that you can get SSL certificates for free via letsencrypt, you don't have to pay unless you want extended validation certificates. It looks like your site is available over both http and https, you should be able to redirect all the http to https to solve your problem, but you'll need to ask godaddy how to do that
    – Tom J Nowell
    May 26, 2019 at 21:18

2 Answers 2


The media file item (really, a post type), has the URL of the media item as part of it's data. So if you upload a media item when your site is at http:, then the URL of the item is stored as one of the meta values of the item. (It will be stored as http://www.example.com/wp-content/uploads/whatever.jpg , for example.)

Since the URL is part of the stored data for the media item, then you need to use a Search and Replace plugin (my favorite is "Better Search and Replace") to replace all instances of http://www.example.com with https://www.example.com . (Backing up the database first, of course.)

That is not absolutely required. If you are using a standard redirect in your htaccess file to redirect all http requests to https, then the https URL will be served up by your server. A sample htaccess that would do this is this one; you should add that to your existing htaccess file at the top (before the 'Begin WordPress' lines).

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

It may be that URLs in your generated page will still have the http, instead of https, when you use the htaccess rule to rewrite the request. But using a Search/Replace plugin will fix the problem.

  • Thanks Rick. I tried Better Search and Replace but still didn’t fix the problem. I didn’t go for the last option though as it said it had the biggest chance of breaking things. Maybe I should try it and risk it. Thanks for the other suggestion but I wouldnt know how to add that code. I’ll try the full strength ‘Better Search’ fix. Thanks May 26, 2019 at 21:09

You might also look into these two methods to change your links:

It's the same principle as Better Search and Replace but maybe easier to handle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.