EngineeringScore
Security Medium

Fix mixed content

Mixed content happens when an HTTPS page loads a resource (a script, stylesheet, image, or iframe) over plain HTTP. Modern browsers block "active" mixed content like scripts outright and often show a broken-padlock warning even for "passive" mixed content like images, undermining the trust HTTPS is supposed to provide.

Why it matters

Mixed content (HTTP resources loaded on an HTTPS page) is blocked or flagged by modern browsers and gives attackers a way to tamper with an otherwise-secure page by intercepting the insecure resource.

How to fix

  1. 1 Search the codebase and CMS content for hardcoded http:// URLs.
  2. 2 Replace them with https:// or protocol-relative URLs.
  3. 3 Add a CSP upgrade-insecure-requests directive as a safety net.

Common mistakes

  • Hardcoding http:// URLs in markup, CSS, or CMS content that was written before the site migrated to HTTPS.
  • Pulling resources from a third-party or legacy service that has not itself migrated to HTTPS, which cannot be fixed by changing the URL alone.
  • Fixing the obvious cases (images) but missing less visible ones like fonts, iframes, or XHR/fetch requests made from JavaScript.

How to verify

  1. 1 Open devtools console while browsing the site and check for mixed-content warnings.
  2. 2 Search the codebase and CMS content for hardcoded http:// references.
  3. 3 Confirm a CSP upgrade-insecure-requests directive (if added) does not mask resources that are actually still broken over HTTPS.

Related checks

Security HTTPSSecurity HSTSSecurity CSP

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site