A certificate covers the whole site, so a padlock that disappears on a single page is never the certificate. That page is loading at least one thing over plain http, and the browser downgrades the indicator because of it.

Find it in one place

Open the console on that page. The mixed content warning names the exact URL. That is the whole diagnosis - the rest is deciding where the URL came from.

Or find it from the server

curl -sS https://yourdomain.com/that-page | grep -oE 'http://[^"[:space:]]+' | sort -u | head -20

Where it usually comes from

  • An image or embed pasted into the content years ago with a full http address.
  • A theme or plugin building an absolute URL from a stored option.
  • A site URL setting still recorded as http.
  • A third-party widget - a map, a chat box, a font - offered over http.
SELECT ID, post_title FROM wp_posts
 WHERE post_content LIKE '%http://yourdomain.com%' LIMIT 20;

SELECT option_name FROM wp_options WHERE option_value LIKE '%http://yourdomain.com%';

Fix the content, not the symptom

Rewrite stored http links to https - or better, to a path with no host at all, so the same content works on staging and in production.

UPDATE wp_posts
   SET post_content = REPLACE(post_content, 'http://yourdomain.com', 'https://yourdomain.com')
 WHERE post_content LIKE '%http://yourdomain.com%';
Back the database up before that UPDATE, and run the SELECT first so you know how many rows should change. A REPLACE that touches ten times more rows than expected is a pattern that was too broad.

The full picture, including redirects and headers, is in mixed content after switching to HTTPS.