What Is Mixed Content and How Do I Fix It?
Find insecure resources inside HTTPS pages and fix their original URLs without disabling browser protections or relying on a blanket replacement.
Part of our guide: What Is an SSL Certificate and Does My Website Need One?
Mixed content occurs when a page delivered over HTTPS requests a resource over an insecure connection. The main address can look correct while an image, script or other dependency still uses an old HTTP URL.
MDN’s mixed-content guidance explains that browsers may upgrade some resource requests and block others. Behaviour depends on the resource and context, so a page that looks mostly normal can still have a broken feature.
Recognise the difference from a certificate error
A certificate problem concerns the secure connection itself. Mixed content concerns resources requested by a page that has already loaded over HTTPS.
If the browser refuses to open the page, start with the Not Secure warning guide. If the page opens but an image or interaction fails, its resource requests may provide the next clue.
Do not assume every missing image is mixed content. A wrong filename or unavailable third-party service can produce similar visible symptoms.
Reproduce one failing page
Record the page URL, browser and failed feature. Ask a developer to inspect the browser’s console and network panel for the exact insecure request.
The important evidence is the requested address and the part of the site that generated it. A screenshot saying “mixed content” without the resource URL leaves the maintainer guessing.
Use harmless test data and avoid repeatedly submitting a form while its scripts or connection behaviour are uncertain.
Find the source of the old address
Common places to inspect include content fields, theme settings, stylesheet image references and embedded third-party tools. A migrated site may retain absolute HTTP links even after the main domain has HTTPS.
For an illustrative business page, a background photograph might still point to an old media address while the page itself uses the current domain. Correcting the original reference is more maintainable than hiding the symptom in one browser.
The SSL guide explains the wider connection setup. A certificate does not automatically rewrite every resource reference stored in a website.
Choose the right repair
| Finding | Appropriate direction |
|---|---|
| Your own asset supports HTTPS | Correct the stored reference and verify it |
| Third-party asset supports HTTPS | Use its supported secure address |
| Provider has no secure equivalent | Replace or remove the dependency safely |
| Address generated by a template | Fix the shared source and test affected pages |
Do not blindly replace every occurrence of a string in a database. Structured or serialised content can require platform-aware tools, backups and a tested recovery route.
Where the change affects many pages, use staging first.
Avoid weakening protection
Do not instruct customers to allow insecure content. That moves the risk to the visitor and leaves the underlying problem unresolved.
Likewise, an automatic browser upgrade is not a reason to leave the source incorrect. Test the actual secure endpoint and update the responsible template or content field.
If an optional integration cannot be made dependable, review its purpose with the owner. The third-party script guide helps weigh business value against technical cost.
Verify the repaired journey
Reload the page with a fresh request and confirm that the insecure-resource message is gone. Check the affected image or interaction, then test another page that shares the same component.
Clear the relevant cache only after the source is corrected, and record which layer was refreshed. The caching guide distinguishes browser, server and delivery caches.
Close the task with the original resource, corrected address and test result. That creates a useful maintenance record rather than a vague note that HTTPS was “fixed”.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
