What is Mixed Content? Causes & Fixes
Definition
Mixed content occurs when a page loaded over HTTPS includes resources — images, scripts, stylesheets, fonts, iframes — that are loaded over HTTP. The connection is partially encrypted, which defeats the purpose of HTTPS and triggers browser warnings or outright blocking.
Two types of mixed content
- Active mixed content (scripts, iframes, stylesheets) — blocked by modern browsers because it can modify the page.
- Passive mixed content (images, audio, video) — usually loaded but flagged with warnings; the lock icon disappears from the address bar.
How to find and fix it
- Open browser DevTools — the Console flags every blocked or warned resource.
- Use the
Content-Security-Policyheader withupgrade-insecure-requeststo automatically rewrite HTTP to HTTPS. - Replace hardcoded HTTP URLs in templates, content, and database fields with HTTPS equivalents.
- Scan your site to surface HTTP resources that should be HTTPS, including external embeds.
Mixed content erodes user trust and can break critical functionality. Migrating to HTTPS is only half the job — auditing for mixed content is the other half.
Related terms
HTTP Status Codes
Three-digit server response codes that indicate the result of an HTTP request.
SSL Certificate
The cryptographic credential that enables HTTPS — and that search engines expect.
404 Error
What happens when a page can't be found — and how it affects SEO.
301 Redirect
The permanent redirect that preserves link equity and guides users.
Crawl Budget
How search engines allocate resources to crawl your site — and why broken links waste it.
Broken Link
A hyperlink that no longer leads to its intended destination.