How to Fix Mixed Content Warnings
Mixed content appears when an HTTPS page loads scripts, images, or iframes over plain HTTP — silently breaking your padlock and your security. Here is how to find every instance and fix it for good.
Your certificate is installed, the site loads over HTTPS — but the browser console shows mixed content warnings. Mixed content means your encrypted page is loading some of its resources — images, scripts, stylesheets, iframes — over plain HTTP. It matters because an attacker on the network can tamper with those unencrypted resources, turning your secure page into an attack delivery system.
Two kinds of mixed content
- Passive mixed content — images, audio, video loaded over HTTP. Attackers can eavesdrop on or replace the content, but not execute code.
- Active mixed content — scripts, stylesheets, iframes, and XHR over HTTP. Modern browsers block these outright, which means your page is probably visibly broken: missing styles, dead features, error messages in the console.
How to find every instance
- Browser console (F12) — open your site in Chrome or Firefox and read the Console tab; every blocked or downgraded resource is listed with its full HTTP URL.
- Check your database and theme files — the string
http://yourdomain.comoften lives in posts, widgets, and hardcoded theme assets. - Automated scan — the 2MNY Security scanner lists every insecure resource reference it finds, so nothing hides in a rarely-visited page. Run a free scan to get the full inventory.
How to fix it
- Update URLs to
https://— the durable fix. Update the resource references in your HTML, CSS, database, and CMS settings. - Fix protocol-relative URLs —
//example.com/script.jslooked clever once, but it silently inherits HTTP on HTTP pages and can double-load. Spell outhttps://explicitly. - Add the upgrade header — a one-line emergency measure that asks the browser to rewrite every HTTP subresource request to HTTPS:
Content-Security-Policy: upgrade-insecure-requests
Use this as a safety net while you fix the underlying URLs — and remove the third-party resources that genuinely have no HTTPS endpoint, because they have no place on a modern site.
Keep it fixed
Mixed content tends to creep back: a blog post pasted with an old link, a new widget, a copied snippet. Keep upgrade-insecure-requests in place and let your monitoring re-check the site — 2MNY flags mixed content on every scheduled scan, so a regression shows up as an alert instead of a support ticket from a user.
1 What is mixed content?
Mixed content happens when an HTTPS page loads some resources (images, scripts, stylesheets, iframes) over plain HTTP. The page itself is encrypted, but those insecure requests can be tampered with in transit — an attacker on the same network can swap a script or steal data. Browsers increasingly block active mixed content outright, which breaks pages.
2 Why does my site show "Not Secure" even though I have a valid SSL certificate?
Because the padlock only appears when every resource on the page loads over HTTPS. A single http:// image, font, or analytics script is enough to downgrade the indicator. Audit your pages with a scanner — 2MNY flags every mixed-content reference it finds, including in inline CSS and JavaScript, with the exact file and line.
3 How do I find mixed content on my website?
Your browser console shows mixed-content warnings for the page you are on, but for whole-site coverage run a scan at 2mny.com/free-security-scan — the crawler follows internal links and reports every http:// reference it encounters. Also grep your templates for "http://" and watch for protocol-relative URLs that can break either way.
4 Will mixed content hurt my SEO?
Indirectly, yes: browsers that block the insecure resources produce broken layouts and failed scripts, which shows up as worse Core Web Vitals and higher bounce rates — both ranking inputs. Google has also confirmed it treats HTTPS as a positive ranking signal, and mixed content undermines the claim to being fully HTTPS.