What is "mixed content" and why does my padlock show "Not secure"?

Mixed content means your page loads over HTTPS but still pulls some assets (images, scripts, fonts, iframes) over insecure HTTP. The browser then refuses to show the full padlock and may block those assets. The usual culprits are hardcoded http:// URLs in your theme, page content, or database. We sweep your pages and run a safe database find-and-replace to rewrite every offending URL to HTTPS, so the padlock is clean site-wide.