Fix HTTPS warnings, mixed content, and redirect loops

A certificate problem and a mixed-content problem need different fixes. A certificate warning concerns the secure connection or server identity. Mixed content occurs when an HTTPS page requests resources such as scripts or images over HTTP; browsers may block or upgrade those requests. MDN mixed-content documentation

1. Record the exact browser message and affected URL. Test the hostname visitors actually use, including www if applicable.
2. If the browser warns before opening the page, inspect the certificate's covered names and expiry. Confirm the domain resolves to the expected service. Control Center's issued status records its request result; verify the live certificate too. The standard free request covers only the selected domain, so check www and other names separately.
3. If the page opens but assets or features fail, open the browser's developer tools and review Console and Network. Record the specific HTTP resource URLs associated with mixed-content warnings.
4. Back up the website before broad changes. Update the affected application setting, theme, stylesheet, embedded media, or content entry to use a working HTTPS URL. Confirm the destination really supports HTTPS before replacing a link. For database-backed sites, use application-aware tools rather than indiscriminate text replacement.
5. Check forms, scripts, fonts, background images, downloads, and third-party embeds. Replace or remove a dependency that cannot be served securely.
6. Clear the relevant application, page, and CDN caches, then reload. Test while signed out as well as signed in; cached public pages can differ from administrator views.
7. If there is a redirect loop, document the redirects configured in the app, hosting panel, and any proxy. Have the site administrator reconcile them. A proxy using one scheme to reach the origin while the app expects another can cause repeated redirects.

Check the result: Visit key pages and complete normal actions such as login, a contact form, and checkout where applicable. Verify there are no certificate errors, failed secure resources, or loops. Use test data for transactional checks.

Common problems: Reissuing a certificate will not rewrite HTTP URLs in content. Disabling browser security only hides the symptom for one visitor. Do not enable long-lived HSTS settings until all required hostnames and HTTPS routes work reliably; ask your administrator if you are unsure of the effect.

Related: Hostname coverage, Let's Encrypt renewal, Paid SSL installation.