Mixed content means the page itself loads over an encrypted connection while some part of it, an image, a stylesheet or a script, is fetched unencrypted. The browser cannot promise the page is safe, so the padlock disappears. Some of the content is blocked outright as well, which shows up as a broken layout.
Open the browser developer tools and look at the console. It states directly which address was loaded unencrypted. This is the fastest way to find the culprit, because it gives you a file name rather than a vague warning.
The most common cause is an image or a video added long ago with an unencrypted address. The fix is to change the beginning of the address to the encrypted form. If there are many cases, correct them in the database in one go rather than page by page.
Sometimes the unencrypted address comes from a theme or a plugin rather than from the content, and then browsing the content will never find it. The path in the console tells you which, because it contains either wp-content/themes or wp-content/plugins.
Embedded maps, fonts, analytics scripts and ad blocks are common sources of mixed content, especially when the snippet was copied from an old tutorial. Here the fix is to load the same service over an encrypted address or to remove it.
Once every address is corrected, make sure the unencrypted address redirects to the encrypted one. On Nordweb hosting the certificate and the redirect are handled on the server, and the setup is covered in our guide to taking an SSL certificate into use. If two redirects overlap, you get a loop, see too many redirects.
If the browser blocks access to the site entirely and talks about the certificate, that is a different matter. It is covered in our guide on the browser warning that a site is not secure.
Do not install a plugin that rewrites the addresses on the fly and leave it at that. It hides the symptom but leaves the unencrypted addresses in the database, and they come straight back when the plugin is removed or updated. Fix the source.
We find every unencrypted address, correct them in the content and the database and make sure the padlock stays in place after the next update as well.
