WordPress with ssl form let's encrypt, but homepage not fully secure. "Attackers might be able to see images.." message

wordpress security ssl encryption lets-encrypt
Tadas Stasiulionis picture Tadas Stasiulionis · Feb 17, 2017 · Viewed 16k times · Source

Could you help me find out what to do with not fully secure message.

I have installed ssl certificate from let's encrypt, but my wordpress homepage has a message "Attackers might be able to see the images you're looking at on this site and trick you by modifying them".

The home page is still in development, with demo content. About what images chrome notification is telling? Something to do with cookies?

Thank you for your answers!

Edit: Does it have to do with the theme itself? Whole wordpress dashboard and login is served over proper secure ssl.

Answer

Martin Hollstein picture Martin Hollstein · Feb 17, 2017

Sending images via http protocol is what triggers this issue. Using any content from a cdn that does not use https will also trigger this issue. This quote explains it pretty simply (the yellow padlock / warning of unencrypted content/images):

If a yellow padlock appears with a mini yield sign, the likely cause is links in your site still refer to an unsecured page. Make sure that all your images, menu items and links use https in the URL. source

I would use a tool to help identify all non-encrypted file transports. One such tool would be something like Why No Padlock.

Related questions

How to set X-Frame-Options Header in wordpress Site

I have hosted a website which is created using Wordpress. I am getting a security alert saying "X-Frame-Options Header Not Set", but I can't figure out what that means. Can anyone explain what this warning is about, and give me …

Read More
Wordpress ==> SSL ==> MySQL is this configuration possible?

I am trying to put SSL encryption between my Wordpress application and its MySQL database, is anyone aware of a solution/tutorial for this? Haven't managed to find anything on Google or the Wordpress codex.

Read More
Access denied for user 'root@localhost' (using password:NO)

I'm new to MySQL, I'm trying to run WordPress in my Windows desktop and it needs MySQL. I install everything with Web Platform Installer which is provided by Microsoft. I never set a root password for MySQL and in the …

Read More