A page delivered over HTTPS that includes resources fetched over HTTP.
Technical guides for web developers and SEO specialists.
01What it is and how it works
When a page is delivered over HTTPS the browser examines every resource that the page references. If any of those resources are requested via HTTP the browser classifies the page as mixed content. This can cause the request to be blocked, a warning icon to appear in the address bar, or a console message indicating insecure content. The check happens at load time before the page fully renders.
Mixed content means a secure page that also loads insecure files.
02What to do about it
To resolve mixed content you must ensure that every URL used in the page points to an HTTPS endpoint. This includes links in HTML, script tags, style sheets, images, iframes and any external API calls. Practical steps include updating all hard‑coded http:// URLs to https://, using protocol‑relative URLs only when you control the target, and verifying the change with the browser developer console. After updating, re‑run a crawl to confirm the issue is gone.
- Use absolute HTTPS URLs
- Update internal links
- Test with browser console
03How it is measured or noticed
Mixed content is detected by the browser during the loading phase. Visual cues include a shield icon next to the lock indicator or a warning message in the developer console. SEO tools such as Screaming Frog, Sitebulb or Google’s own crawl reports can flag mixed content errors in their audit sections. These reports list the specific resources that are still using HTTP.
04Common mistakes
- Linking to http:// instead of https://
- Embedding http images or scripts
- Using mixed content in iframes or style sheets
- Forgetting to update URLs in CSS files or inline style blocks
- Allowing redirects that switch from HTTPS to HTTP
05Limits and confusion
Mixed content only applies to pages served over a secure HTTPS connection. An HTTP page does not have this restriction. The term is often confused with insecure redirects or with content that is simply not indexed, but those are separate issues. The restriction also does not affect resources that are loaded from the same origin over HTTPS.
06Worked example
Example: <script src='http://example.com/lib.js'></script> triggers mixed content.
Frequently asked questions
Why does my site get flagged as insecure when I load images from another site?
No, the browser treats any HTTP resource on an HTTPS page as mixed content and blocks it, which is why you see a security warning.
Should I change all my image URLs to HTTPS even if the site works fine now?
Yes, you should update every URL to HTTPS to prevent mixed content warnings and maintain security compliance.
How do I find which resources on my page are loaded over HTTP?
Usually you can use the browser’s developer tools to open the Network tab and look for resources with http:// URLs, then replace them with https://.
Does mixed content still affect SEO rankings today?
It depends on how heavily search engines weigh security signals, but mixed content can lead to lower rankings because it signals a less trustworthy site.
What breaks if I leave mixed content on my site?
Often the site appears insecure, users may avoid it, and search engines can lower rankings, which directly impacts traffic and revenue.
Asked out loud
spoken, not typedThe same term in the words somebody uses speaking to an assistant rather than typing into a box — written from the situation, which is why each one carries the situation it came from.
Yes, you need to locate any HTTP URLs and change them to HTTPS immediately to eliminate the security warning.
Usually the page contains resources loaded over HTTP, which browsers block on HTTPS, so you must switch those URLs to HTTPS.
It depends on whether any linked assets are using http:// instead of https://, so inspect the page source or use developer tools to find mixed content.