Website folders do not have full SSL lock

Question

So I am making a new website, Link , but for some reason no folders have the full SSL icon. The top-level index.php file has the lock, but anything inside a folder, try /blog, has partial-ssl. It has the lock, but hides it because of the "Someone can change the look of this page" type error. Please help, as I do not know why this is hapenning. I do use cloudflare, and have set a http://qualexcraft.tk/ * page rule to force https.

UPDATE: Now no folders or files have the full lock

For anyone interested, here is my htaccess file:

# Do not remove this line, otherwise mod_rewrite rules will stop working
RewriteBase /
ErrorDocument 404 http://qualexcraft.tk/404
# Redirect www urls to non-www
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.qualexcraft\.tk [NC]
RewriteRule (.*) https://qualexcraft.tk/$1 [R=301,L]

Directory Structure:

index.php

404

index.php

old.php

assets

images

blog

allPosts

index.php

includes

headers

  head.html

  index.html

layout

  footer.html

  navbar.html

maps

mdl

[mdl files]

Answer 1

One of the reasons for the bahaviour is the following line in your htaccess file:

ErrorDocument 404 http://qualexcraft.tk/404

When the client requests for the image https://qualexcraft.tk/blog/images/android-desktop.png , a 302 redirection to http://qualexcraft.tk/404 is triggered. This page, in turn, has a permanent redirection set to https://qualexcraft.tk/404 .

Now, as I asked in the comment , there is another rule which adds a trailing / in the URLs and redirects it to http://qualexcraft.tk/404/ . This, lastly; redirects with the status code 301 to the secure page: https://qualexcraft.tk/404/ .

The intermediate redirects to http pages is the root cause of your problem. The same occurs when someone visits the blog link on your website.

The request to https://qualexcraft.tk/blog gets redirected to http://qualexcraft.tk/blog/ and then to https://qualexcraft.tk/blog/ .

---

After your changes to the website, the behaviour is still the same, except that the request is now for https://qualexcraft.tk/favicon.ico .

---

Try updating your htaccess to the following:

Options -MultiViews
DirectorySlash Off
ErrorDocument 404 https://qualexcraft.tk/404

RewriteEngine on
RewriteBase /

RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(.+)/?$ $1/index.php [L]

RewriteCond %{HTTP_HOST} ^www\.qualexcraft\.tk [NC]
RewriteRule (.*) https://qualexcraft.tk/$1 [R=301,L]

Answer 2

Add your favicon image to favicon.ico, to images/touch/ms-touch-icon-144x144-precomposed.png and to images/android-desktop.png. That is the only insecure content error that can be seen so once that is fixed you should be okay after clearing your browser cache.

In order to spot mixed content errors in the future, you can go to the console in Chrome (right click > Inspect Element > console) and your insecure content errors will be displayed there.