Fixing "Not secure" and mixed content

If your certificate is valid but the browser still shows a warning, the page is usually loading some images, scripts or styles over http://. This is called mixed content.

Fixing it

1. Make sure the whole site redirects to https (see Redirecting a page or domain).
2. WordPress: set both addresses in Settings → General to https://, then update old links in the content with a plugin such as Better Search Replace (replace http://yourdomain with https://yourdomain).
3. Find what's still loading over http: open the page, press F12, and look in the Console for "Mixed Content" warnings.