Mixed Content

Mixed content occurs when a document loaded through a secure context, such as HTTPS, requests a resource or download through an unauthenticated connection such as HTTP. That insecure part can be observed or altered in transit, weakening the protection visitors expect from the secure page. Current browser handling distinguishes content that may be upgraded automatically to HTTPS from content that must be blocked.

Why it matters: Do not rely on a browser's automatic upgrade: the HTTPS version may not exist, and blocked scripts, styles, fonts, frames, API calls, responsive images, forms, or downloads can break or expose a task. Inventory references in HTML, CSS, JavaScript, structured content, databases, templates, third-party tags, and redirects. Use browser console, Network, Issues, and Security panels plus a site crawl, then exercise important pages and states because one initial load may not trigger every request. Replace each URL with a verified HTTPS endpoint, use relative URLs for same-origin resources where appropriate, update stored content and third-party integrations, and remove providers that cannot serve securely. A Content Security Policy such as `upgrade-insecure-requests` can assist a controlled migration, but it does not prove that every destination works or replace source cleanup and testing.