What is mixed content on a website?
Mixed content occurs when a page loaded securely over HTTPS tries to request a resource using insecure HTTP. The resource might be an image, script or embedded feature. Browsers handle different resource types differently, including upgrading or blocking requests, so the page may partly work while something important is missing.
Useful context
- Record the affected page and the image or feature that fails.
- Note whether the issue began after moving to HTTPS or changing a third-party tool.
How it works
Separate the page from its ingredients
A webpage can load files from several places. Its own address may be secure while an old image or widget still points elsewhere over HTTP. Looking only at the main address therefore does not show every connection the page tries to make.
Find a reproducible example
Record the exact public page and what is missing. Compare an ordinary browser view with the expected approved content. Do not enter personal details into a broken form or dismiss the browser’s warning while gathering the evidence.
Ask for a targeted resource check
A maintainer can inspect the browser’s reported blocked requests and identify their source. The right fix may be a supported HTTPS address, an updated embed or replacing an unavailable resource. Simply adding an s to every old address is not reliable if the remote server does not support it.
Retest the complete feature
After the references are corrected, check the page on the devices affected and confirm the intended content is present. A restored form’s appearance is not proof of delivery, so arrange a labelled submission and inbox confirmation separately where necessary.
What to check
- The maintainer has identified the actual insecure resource.
- The replacement resource supports a secure connection.
- The customer-facing feature works without security exceptions.
Sources and further reading
Platform features can change. Check the provider’s current guidance before changing a live service.