MARIA3 said:
I change all to https:// and now Chrome show secure lock.
Good. Now go one further and set a CSP header so the next time some plugin or editor inserts a http:// link, your browser blocks it at source instead of showing "not secure" to visitors.
Content-Security-Policy: upgrade-insecure-requests;
Or if you want reports:
Content-Security-Policy-Report-Only: default-src https:;
Takes five minutes in nginx, saves hours later.
two disks down, still serving
