What is Mixed Content?
Mixed content occurs when an HTTPS page loads resources (images, scripts, styles) over insecure HTTP. Mixed content triggers browser warnings and can break functionality or expose users.
Why Mixed Content matters
A page served over HTTPS that loads an image, script, stylesheet or iframe over plain HTTP is only as secure as its weakest resource. Browsers block 'active' mixed content (scripts, stylesheets, iframes, fetches) outright, so features silently break, and they either upgrade or block 'passive' content such as images, depending on the browser. Either way the padlock disappears or a warning appears, and the visitor's trust goes with it.
Mixed content is almost always a migration leftover: hard-coded http:// URLs in templates, in the database of a CMS, in a third-party embed code, or in a CDN configuration. Search and replace, the upgrade-insecure-requests CSP directive as a safety net, and a crawl to confirm are the fix.
Example
Finding it, and the safety net:
# Any http:// references left in a page
curl -s https://example.com/ | grep -oE 'http://[^" ]+' | sort -u
# Upgrade what the search missed
Content-Security-Policy: upgrade-insecure-requestsThe directive rewrites http:// subresource requests to https:// before they are sent.
Common mistakes
- •Migrating the site to HTTPS but not the image URLs stored in the CMS database.
- •Embed codes copied from a provider years ago.
- •Relying on browser auto-upgrade, which does not apply to scripts.
How Webmatik checks it
The Mixed content check scans the audited HTTPS pages for subresources requested over HTTP and lists them.
Check your own site
Free Website Security Checker
HTTPS, HSTS, CSP and the other headers most sites are missing — with exactly what to add.
Related Security terms
See how your website scores across SEO, GEO, performance, and more
Run a free audit