It might not be just password reset: I see insecure content warning on everywhere in wp-admin.php, but not on the actual blog.

wp-admin.php	reader area

Hey @revi would you mind checking again? I think @CKoerner_WMF resolved these this morning.

There was a configuration that was set for the first few days of Diff where images weren't being loaded over http. That's fixed now, so going forward it shouldn't be an issue. I fixed as many issues as I could.

@CKoerner_WMF If you run the site through missingpadlock.com it reports 11 passive mixed content issues (all look like images loaded via http). That should be pretty quick to fix I would think.

Also looks like 119 broken links but that's more of a content issue than a security issue.

I think I have them all now? :)

I still see a few left, on some really old posts... Looks like there is some thumbnail/lightbox function that was maybe removed? I would just delete those links altogether. That content is pretty long in the tooth.

I don't think I let the scan run to completion before claiming they were all taken care of. I updated the pages @JFishback_WMF mentioned and re-ran a scan.