Mixed content warnings in the browser (some resources load over HTTP)
The SSL/TLS certificate is expired or about to expire
Certificate renewal is not automated
How urgent is this? HTTPS is high priority. Without it, all traffic between the visitor and the server is unencrypted and can be intercepted. This is especially critical for sites handling donations or personal data. Fix this before any other web security issue.
Who does this?
The person responsible for the organisation's hosting account. This requires access to the hosting control panel and/or the website's content management system (CMS).
Background: what does HTTPS protect?
Concept
What it does
SSL/TLS certificate
Encrypts traffic between the visitor's browser and the server
HTTPS redirect
Ensures visitors are always sent to the secure version of the site
Mixed content
Occurs when an HTTPS page loads resources (images, scripts) over HTTP — browsers block or warn about these
Certificate renewal
Certificates expire (typically after 90 days for Let's Encrypt) — automation prevents accidental expiry
Step 1: Check whether HTTPS is active
Visit the site in a browser and check:
Does the URL show https:// ?
Is there a padlock icon in the address bar?
Does http://[yourdomain] redirect to https://[yourdomain] ?
If the site already loads over HTTPS with no warnings, proceed to Step 2. If not, enable SSL/TLS in your hosting control panel — most providers (including SiteGround) offer free Let's Encrypt certificates that can be activated with one click.
Step 2: Force HTTPS in WordPress
Even if HTTPS is active, WordPress may still serve some pages over HTTP. Fix this in two places:
In WordPress Settings: go to Settings → General and make sure both the WordPress Address and Site Address start with https://.
In SiteGround: go to Site Tools → Security → HTTPS Enforce and enable it. This adds a server-level redirect from HTTP to HTTPS.
Step 3: Fix mixed content
Mixed content occurs when an HTTPS page loads resources over HTTP. Check for it using the free tool Why No Padlock — enter the domain and it will list any HTTP resources.
Common fixes:
Update hardcoded http:// URLs in the WordPress database using a plugin like Better Search Replace
Install Really Simple SSL — it automatically fixes most mixed content issues
Step 4: Automate certificate renewal
Let's Encrypt certificates expire after 90 days. Most hosting providers (including SiteGround) renew them automatically. Verify this is enabled in your hosting control panel.
If renewal is not automated, set a calendar reminder to renew manually at least 30 days before expiry. Check the expiry date at SSL Labs.
Step 5: Verification
Visit the site and confirm the padlock is shown and the URL is https://
Run a full check at SSL Labs — aim for grade A or higher
Re-run Why No Padlock to confirm no mixed content remains