Reference
What is Mixed content?
Mixed content is an HTTPS page loading a resource over plain HTTP. Browsers block active mixed content such as scripts outright and warn about passive content such as images, so a single stray URL can break a page silently.
Also called: insecure content warning
Where it comes from
- Hard-coded http:// URLs in content, templates or a database
- A third-party embed that has not been updated
- Old content migrated from before an HTTPS switch
- CSS referencing an image or font over HTTP
Finding it
The browser console reports every instance. A site-wide search of the database and templates for "http://" catches the rest, and it is worth doing once thoroughly rather than fixing reports one at a time.
The header that helps
upgrade-insecure-requests in the Content Security Policy tells the browser to rewrite HTTP subresource requests to HTTPS automatically. It is a safety net rather than a fix — the underlying URLs should still be corrected.
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.