The padlock in the address bar says the server can serve HTTPS. It says nothing about the image tag from 2019 still pointing at http://, or the third-party widget that never bothered to support it. TechySEO finds every leftover HTTP reference still loading on your HTTPS pages, plus the insecure form actions and missing redirects that don't show up just from glancing at the browser bar.
HTTPS has been a confirmed, if minor, Google ranking signal for years, and getting the certificate installed is genuinely the easy step. The harder part is everywhere the old HTTP version of your site left fingerprints: an image tag with an absolute http:// URL baked into a CMS field, a script reference in a template nobody's touched since the migration, a third-party embed pointing at a provider's old endpoint. Browsers block or flag that mixed content, which means broken styling, JavaScript that silently fails, or images that just don't load, on a site that otherwise looks fully secured.
This is especially common on sites that migrated to HTTPS a while ago and assumed the job was done once the certificate went live. Months or years later, hundreds of these references can still be sitting there, generating "Not Secure" warnings on pages nobody's checked since the migration wrapped up.
Finding these requires actually reading every page's resources, not just confirming the server responds over HTTPS. A scan that stops at the certificate misses everything that actually causes the warning.
From links that are just untidy to resources browsers actively block.
Get the actual list: every leftover HTTP resource, insecure form action, and missing redirect, not just a flag that something's wrong.
