// Security
How to Find and Fix Mixed Content Errors on Your HTTPS Website
Mixed content errors occur when your HTTPS page loads HTTP resources. They cause browser warnings, block scripts, and hurt SEO. Learn how to find and fix every mixed content issue.
What Is Mixed Content?
Mixed content occurs when an HTTPS page loads any resource over HTTP — images, scripts, stylesheets, iframes, or API calls. Browsers treat this as a security issue because the HTTP resource can be intercepted and modified by a man-in-the-middle attacker.
Modern browsers handle two types differently: passive mixed content (images, audio, video) shows a warning but still loads. Active mixed content (scripts, stylesheets, iframes) is blocked entirely — this can break your site's functionality.
How to Find Mixed Content Issues
- Chrome DevTools Console: Open any page, check for 'Mixed Content' warnings
- Chrome DevTools Network tab: Filter by 'http://' in the URL filter
- Why No Padlock (whynopadlock.com): Scans a URL and reports all HTTP resources
- Screaming Frog Spider: Crawl your site and filter for HTTP resources
- Google Search Console: Security Issues report flags mixed content at scale
Common Sources of Mixed Content
- Hard-coded HTTP URLs in images, iframes, or src attributes
- CMS embedded media uploaded before HTTPS migration
- Third-party widgets with HTTP embed codes
- CSS background-image: url('http://...')
- Old database content with HTTP URLs stored in rich text
- External CDN or API calls using HTTP endpoints
Fixing Mixed Content
The fix is usually simple: change http:// to https:// in the resource URL, or use protocol-relative URLs (//example.com/resource) which inherit the page's protocol. For CMS sites like WordPress, the Really Simple SSL plugin can update database content automatically.
For third-party resources that only support HTTP (rare in 2026), route them through your own HTTPS proxy or find an HTTPS alternative. Never load external scripts over HTTP.