If you have changed your websites over to (Free)SSL and no lock symbol appears in the address bar of your browser when you visit your sites, your website includes a link or image containing an “absolute path” instead of a “relative path”.
This means that these images or links can be accessed via http:// instead of https:// (mixed content). The browser will therefore indicate that your website is unprotected. Only when all of the data of a website can be accessed via a secure connection will the browser indicate that the page is secure by showing the lock symbol in the address bar.
To determine which link or image is the culprit, you can use what is known as the console, which is part of the developer tools included with nearly every browser.
If you have your own CMS or websites you have programmed yourself, these links usually have to be changed manually.
If you are using WordPress, the Easy HTTPs Redirection plug-in automatically performs all of these changes for you, so that you do not have to edit each link manually. Simply select the option Force resources to use HTTPS URL.
Please note that plug-ins always pose a security risk and should always be kept up to date.
For more information, refer to What do I have to do for my website to work with https.