Knowledgebase

The easiest way to investigate issues with an SSL certificate is to run a test through an external tool:

https://www.whynopadlock.com/

This will give you an overview of the site - whether it has an SSL certificate installed, when it expires, and if there is any mixed content.

Force HTTPS and Mixed Content

Often you will have a customer that has a valid SSL certificate installed, but when visiting their site, it still displays as non-secure.

The most common reasons for this are:

1. The site is not forcing HTTPS - this means visitors are still able to visit the non-secure site (http) and are not being automatically redirected to the secure site (https). Running a test on whynopadlock will reveal this and also provide the code to enable the force HTTPS redirect. This code is to be added to the .htaccess file for their site. Alternatively you can use the Force HTTPS option in SSL/TLS within StackCP.

2. The site has mixed content - this is content on the site itself that is trying to load over http (non-secure) whilst the site as a whole is loaded/accessed over https (secure). Since the content is not secure it is sometimes unable to load or will display the site as not fully secure. A test on whynopadlock or inspecting the site in a browser's console will reveal this. It is on the customer or their developer to resolve mixed content issues.