What mixed content is
When a page loads over https but requests an image, script, stylesheet, font or frame using an http address, browsers call that mixed content. Active content such as scripts and stylesheets is blocked outright in modern browsers because it can be tampered with. Passive content such as images may load but trigger a warning or remove the padlock.
How to find the problem files
Open the page in Chrome, press F12 and look at the Console tab. Messages say that the page was loaded over https but requested an insecure resource, and name the exact address. The Security panel in older tool versions also lists them.
Free scanners can crawl your whole site and report every page with insecure requests, which saves time on larger sites. Check key pages such as the home page, contact page and any with embedded content.
Common sources
After moving to https, old images inserted with hard-coded http addresses remain in page content or the database. Theme settings, logo uploads, custom CSS with background images, and old embed codes from maps or videos are other common sources. Third-party widgets that were installed years ago may still call insecure addresses.
In page builders, image links in widgets, sliders and buttons can each hold their own full address.
Fixing it in WordPress
Make sure the WordPress Address and Site Address in Settings both begin with https. Then run a search and replace on the database to change http versions of your own domain to https, using a reputable plugin or a command-line tool. Take a backup first, because this changes stored content.
Check your theme customizer and widget areas, then clear all caches, including any plugin cache and a CDN cache. A stale cached page can keep serving the old addresses.
Fixing it on other platforms
On builders, re-upload or reselect the affected image and update embed code. For hand-coded sites, change src and href values to https or use relative paths. If a third party offers no https version of its file, replace that service. A header that tells browsers to upgrade insecure requests can serve as a safety net, but fixing the source is cleaner.
Re-test after each fix. A single remaining http file is enough to keep the warning.
A realistic example
A salon owner moves to https and the padlock vanishes only on the gallery page. The console lists twelve images loading from http addresses. They were inserted years ago by a gallery plugin that stored full addresses in the database. A search and replace on the database fixes eleven. The twelfth is a logo hard-coded in a custom footer widget, which has to be edited by hand.
The lesson is that fixes usually come in two kinds: bulk stored content, and a few stragglers in templates or settings.
Common questions
Will mixed content hurt my search rankings?
It can hurt visitors' trust and break features, which indirectly affects performance. Fixing it is simple housekeeping.
Why does the padlock work on some pages but not others?
Each page loads its own files. Only some pages may include the insecure ones.
Is a search and replace plugin safe?
Yes if you back up first and use a trusted tool. Test the site before and after.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.