so annoyed rn finally moved a static portfolio to HTTPS. Certificate installed, the host says it's valid, the checker says it's valid. But visitors see a broken padlock.
i think it has to do with the main script still loading over plain http, but i have no idea where those links come from. i didn't hardcode anything, at least not on purpose. How do i find every insecure reference without reading every file by hand?