Your certificate can be perfectly valid and the padlock still not appear. Nine times out of ten the cause is mixed content: the page itself loaded over https, but something on it – an image, a stylesheet, a script – was requested over plain http. The browser will not show a secure padlock for a page that is only partly secure.
Finding what is causing it
Open the page, press F12 to open the browser developer tools, and look at the Console tab. Mixed content is reported there by name, so it will tell you the exact file being loaded insecurely.
Fixing it
- Your own content. Edit the page or template and change http:// to https://. Better still, drop the scheme entirely and start the link at // so it follows whatever the page used.
- Content in a database. Shops and content systems often store full URLs in the database from an earlier http-only life. Those need updating in the database, not in the template.
- A third-party resource. If an external script or image is only available over http, it needs replacing. Most providers have supported https for years.
Do not simply force https and hope
Redirecting everything to https does not fix mixed content. The page will arrive over https and the insecure resources inside it will still be insecure, so the padlock stays away and some browsers will block them outright.
