I can't reproduce this. If you click on the lock icon and into whatever details it'll give you, does it tell you what resource exactly is insecure?

The message in the padlock icon is vague, only mentioning images, not which ones. I've just had a look in the Network tab of the developer window and it looks like the only requests with a broken padlock symbol are returning a 301.

For example, there's a 301 response for "48.png" but then afterwards there's also a 200 response for "48.png". Both look like the same image from the same place, but with slightly different settings:

The 301 response shows Version: HTTP/1.1 while the 200 response shows Version: HTTP/2

The 301 response shows Content-Type: text/html even though it's a PNG image, while the 200 response shows Content-Type: image/png

The 301 response also shows a Location: https://collab.codidact.org/users/56889/avatar/48.png . Note that 56889 is not my user id, and this number is used regardless of whether I am logged in. Is this some kind of default user? The image is of an upper case T in white on a purple background.

The only other 301 responses only show when I'm logged in, and are images of size 60x60 and 400x400. The 60x60 is my avatar, and the 400x400 is plain white - not sure if it's a cropping of my avatar, which does have a plain white background?

There are 200 response instances of my avatar too, so it displays fine on the site. This isn't disrupting my use of the site in any way, I just thought I should let you know that Firefox is labelling some pages as "Connection Partially Encrypted" in case that is something you want to avoid.

trichoplax‭ thanks, that's helpful. I think this is all because I forgot to turn the CF proxy back on after the server work, which I've now done so this should resolve itself. (As for those URLs, it goes site.codidact.org/users/USER_ID/avatar/SIZE.png.)

trichoplax‭ if Art's changed fixed this, please let us know (a flag is good) and we'll mark it status-completed.

After some sleep I've had another look and the upper case T is just the avatar of the answerer, and the plain white image is the avatar of the question asker (just happens that their avatar is plain white - not a cropping of mine). The extra image when I'm logged in is my avatar for the top right.

Yesterday avatars were in 2 versions each - a broken padlock 301 response in the format you describe (collab.codidact.org/users/USER_ID/avatar/SIZE.png) and a 200 response in the format https://s3.amazonaws.com/storage.qpixel.artofcode.co.uk/HASH.

Today they are in 2 versions each but with no broken padlocks - a 301 response in the format https://collab.codidact.org/uploads/HASH and the same 200 response as yesterday. I'm guessing this is a result of historically keeping images on collab.codidact.org and now having them with identical hash as a filename but on AWS instead.

I can confirm that the broken padlock no longer shows on either desktop or mobile. Thanks for the fix!