Mixed Content Error
SSL, Security & Connection
Your secure page is quietly loading insecure parts, and the browser noticed.
The padlock is missing or crossed out on an HTTPS page. Images fail to appear, styles look broken, or a script silently stops working. The console reads “Mixed Content: The page was loaded over HTTPS, but requested an insecure resource”.
What it actually means
Your page arrived encrypted. Some of the things it asked for did not. The browser objects because the weakest link decides the security of the whole page — an attacker who can modify one unencrypted script can rewrite everything around it.
Browsers now split their response in two. Passive content like images gets a downgraded padlock and a warning. Active content like scripts and stylesheets is blocked outright, which is why mixed content often shows up as a visual or functional break rather than a security message.
What usually causes it
Most likely first.
- 1
Hardcoded http:// URLs in content
Images and links pasted in years ago, before the site moved to HTTPS, sitting in post content where no theme change will reach them.
- 2
Theme or plugin assets on HTTP
Code that builds URLs with a hardcoded protocol instead of inheriting the site's own.
- 3
An incomplete HTTPS migration
The certificate was installed and the redirect added, but the database was never updated, so the old protocol lives on inside the content.
- 4
Third-party embeds and fonts
An old map, video, widget, or font provider still served over HTTP. You do not control the source, so it must be swapped or proxied.
- 5
A CDN or asset domain without HTTPS
Your pages are secure but your images come from a subdomain with no certificate of its own.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Let the console do the work
Open developer tools and reload. Every mixed-content resource is listed by exact URL. This is a complete list, not a sample — work through it rather than guessing.
Step 2 — Fix your own assets first
Change http:// to https:// in theme and plugin code, or better, use protocol-relative or site-relative URLs so this cannot recur after the next migration.
Step 3 — Search and replace the database
Replace http://yourdomain with https://yourdomain using a tool that understands serialized data. Take a backup before you start.
Step 4 — Handle third parties
Update embeds to their HTTPS versions. If a provider offers none, host the asset yourself or replace the provider — there is no safe way to keep it.
Step 5 — Re-test every template
Check a page of each type — home, service, blog post, checkout — because mixed content usually hides in one template rather than site-wide.
When to stop and call someone
Call someone before running a search-and-replace on a live store's database, or if fixing the listed resources does not clear the warning — that usually means a script is injecting insecure URLs at runtime, which is harder to trace and occasionally a sign of injected code.
Frequently asked
It happens when a page loaded over HTTPS requests resources over insecure HTTP. The browser flags the page as not fully secure, and blocks the riskiest resources such as scripts and stylesheets entirely, which is why the page often looks or behaves broken.
Because their URLs are still hardcoded with http:// somewhere in your content or database. The move added a certificate but did not rewrite the links already saved, so the browser blocks or downgrades them. A careful database search-and-replace usually clears it.
Open the browser developer console and reload the page. Every insecure request is listed with its full URL. Check one page of each template type, since mixed content usually lives in a specific template rather than across the whole site.
Passive content — images, video, audio — cannot alter the page, so browsers load it and downgrade the padlock. Active content — scripts, stylesheets, iframes — can rewrite the page, so browsers block it outright. That is why mixed content often breaks functionality rather than just showing a warning.
Yes. An unencrypted script can be intercepted and modified in transit, letting an attacker change anything on the page, including a checkout form. That is precisely why browsers block active mixed content instead of merely warning about it.
If you’d rather not
We do this work every week. These are the services that cover it.
- Fixing Broken WebsitesSite down, hacked, or falling apart? We diagnose it fast, fix what's broken, and tell you straight how to keep it from happening again.
- Malware Removal & SecurityA hacked site costs you customers and Google's trust at the same time. We remove the malware, close the hole that let it in, and harden what is left.
- Fixing WordPress PluginsOne bad plugin can take your whole site down. We fix plugin conflicts, fatal errors, and security holes fast — and build custom plugins when the off-the-shelf ones fall short.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.