Mixed content on an HTTPS page
Effort to fix: Moderate (a few hours)
Why it matters
Assets loaded over plain HTTP can be tampered with in transit, and browsers block or warn about them, breaking parts of the page.
How to fix it
Change every http:// asset reference to https:// (or a protocol-relative/relative URL) and add upgrade-insecure-requests to your CSP as a safety net.
On WordPress
Run a database search-replace from http://yourdomain to https://yourdomain, and check theme options and page-builder settings for hard-coded URLs.