Our client's Wordpress site is shown as Not Secure on Chrome. This is when the SSL certificate is valid according to Chrome itself.

When I go to the SSL settings in Wordpress, I notice the following configuration: enter image description here

The warning message says that the HTTP Strict Transport Security is not activated and one should get Premium to activate.

The second warning message says that the secure cookie settings are not activated and we should go Premium for that, too.

How should one normally troubleshoot this?


It appears that the json file to a Vimeo link on the homepage is causing a Mixed Content error when I inspect the code. Here is the error message:

Mixed Content: The page at 'https://www.MYWEBSITENAME.se/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://vimeo.com/api/v2/video/332613091.json'. This request has been blocked; the content must be served over HTTPS. (anonymous) @ VM14:1

  • These settings are not native WordPress settings. Are you using a plugin for that, or is that a page on your hosting service? – fuxia Mar 4 at 10:22
  • @fuxia yes, i think it's a plugin called Really Simple SSL. – disasterkid Mar 4 at 11:23

You may have mixed content error at the site. Press ctrl+shift+i or right click and Inspect element. Click on console tab and check the warnings. If there is mixed content error, you can fix by changing the mixed content url at your files and database.

| improve this answer | |
  • Yes, I found a mixed content error. Let me try your solution and come back to you. Thank you! – disasterkid Mar 4 at 11:50
  • It appears to be a json file to a Vimeo link that is causing this issue. But I don't know how I remove that since it is not the Vimeo link itself. I will update the question with the error message. – disasterkid Mar 4 at 12:50
  • Should they remove the entire Vimeo video? – disasterkid Mar 4 at 12:57
  • I also noticed that, apart from this red Mixed Content error, there is another one which is marked as yellow. It is about the main logo of the page which comes from an HTTP source. They should probably replace that one as well. – disasterkid Mar 4 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.