It’s due to:
This page includes a form with a non-secure “action” attribute.
Mixed Content: The page at ‘https://www.leiva.co/’ was loaded over a secure connection, but contains a form that targets an insecure endpoint ‘http://www.leiva.co/search’. This endpoint should be made available over a secure connection.