Plesk SSL Installed But Still Showing 'Not Secure'? Here's How to Fix It

Visit your site over HTTPS, press F12 (Chrome/Edge/Firefox), and open the Console tab. Look for warnings such as:

Mixed Content: The page at 'https://example.com' was loaded over HTTPS,
but requested an insecure resource 'http://example.com/wp-content/uploads/image.jpg'.

The Console will list every offending URL. Note which resource types are affected — images, scripts, and stylesheets are the usual suspects.

Tools like WhyNoPadlock or JitBit SSL Check crawl your page and list every mixed-content URL in seconds — useful for a quick audit before diving into code.

A grey padlock with a warning triangle means mixed content (partial HTTPS). A red "Not Secure" label with no padlock at all usually means the page is loading entirely over HTTP — indicating the redirect is missing (see Step 2).

Log in to the Plesk panel. Go to Domains > yourdomain.com > Hosting Settings. Confirm that:

• SSL/TLS support is checked.
• The correct certificate is selected from the Certificate dropdown.
• Permanent SEO-safe 301 redirect from HTTP to HTTPS is enabled.

Click OK to save. Plesk will regenerate the web server configuration automatically.

curl -I http://yourdomain.com

You should see HTTP/1.1 301 Moved Permanently with a Location: https://yourdomain.com/ header. If you see 200 OK, the redirect is not firing.

A custom .htaccess redirect loop can prevent Plesk's redirect from working. Open the public web root:

cat /var/www/vhosts/yourdomain.com/httpdocs/.htaccess

Look for any RewriteRule lines that redirect to http:// — these must be removed or updated to point to https://.

grep -n "listen 443" /var/www/vhosts/system/yourdomain.com/conf/nginx_ssl.conf

If this returns nothing, the SSL vhost has not been written — this usually means the cert was never properly bound to the domain. Re-check Hosting Settings in Plesk and save again to trigger a rebuild.

grep -E "ssl_certificate|SSLCertificateFile"   /var/www/vhosts/system/yourdomain.com/conf/nginx_ssl.conf   /var/www/vhosts/system/yourdomain.com/conf/httpd_ssl.conf

The paths should point to existing files. Verify they exist:

ls -la /etc/nginx/plesk.conf.d/
ls -la /opt/psa/var/certificates/

# Nginx
nginx -t

# Apache
apachectl configtest

Fix any syntax errors reported before proceeding.

In the WordPress admin go to Settings > General and change both WordPress Address (URL) and Site Address (URL) from http:// to https://. Alternatively, run via WP-CLI:

wp option update siteurl 'https://yourdomain.com'
wp option update home 'https://yourdomain.com'

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables

Always take a database backup before running search-replace.

The Really Simple SSL plugin automates the URL migration and adds the appropriate HTTP headers. It is especially useful when editors have embedded http:// media URLs across hundreds of posts.

Static Sites and Non-WordPress Apps

For static HTML sites, perform a grep to find every hardcoded http:// reference:

grep -rn "http://yourdomain.com" /var/www/vhosts/yourdomain.com/httpdocs/

Replace occurrences using sed:

find /var/www/vhosts/yourdomain.com/httpdocs/ -type f -name "*.html"   -exec sed -i 's|http://yourdomain.com|https://yourdomain.com|g' {} \;

For apps loading external CDN resources over HTTP, update the URLs in your asset manifests or configuration files directly.

Adding a Content-Security-Policy Upgrade Header (Quick Stopgap)

While you work through a full URL audit, you can instruct browsers to upgrade all insecure requests automatically. Add the following to the custom Nginx vhost file at /var/www/vhosts/system/yourdomain.com/conf/vhost_nginx.conf:

add_header Content-Security-Policy "upgrade-insecure-requests;";

For Apache, add to vhost_ssl.conf:

Header always set Content-Security-Policy "upgrade-insecure-requests;"

Then rebuild the web server config (see Step 5).

After making any changes to certificate bindings or custom vhost files, force Plesk to regenerate the Apache/Nginx config:

/usr/local/psa/admin/sbin/httpdmng --reconfigure-domain yourdomain.com

# Restart Nginx
systemctl restart nginx

# Restart Apache (service name varies by distro)
systemctl restart httpd     # CentOS/RHEL
systemctl restart apache2   # Debian/Ubuntu

plesk repair web yourdomain.com -y

This command re-checks the domain's hosting configuration, repairs mismatches, and reconfigures the web server.

If your server uses Redis or Varnish, flush them to ensure stale HTTP responses are not being served:

redis-cli FLUSHALL

Run a full SSL audit at SSL Labs Server Test. A healthy configuration will score A or A+ and show no mixed-content issues. Also recheck the browser console — the warning should be gone.

If you've worked through all five steps and the site is still showing "Not Secure," the issue may be deeper — a misconfigured reverse proxy, a CDN stripping SSL headers, or a wildcard certificate not matching the subdomain. Our team provides managed server support and can diagnose and resolve persistent SSL issues remotely, usually within the hour.