Mixed Content (HTTP on HTTPS)

What This Means

The page is served over HTTPS, but one or more resources it loads (images, scripts, stylesheets, fonts, iframes) use HTTP URLs. This creates "mixed content" — a combination of secure and insecure resources on the same page.

Why It Matters for SEO

Browsers treat mixed content as a security concern. "Active" mixed content (scripts, stylesheets, iframes) is blocked entirely by modern browsers — the resource simply does not load. "Passive" mixed content (images, audio, video) generates a security warning in the browser console and may be blocked in future browser versions.

A blocked script or stylesheet can break page functionality or appearance. A blocked image leaves gaps in the page. And any form of mixed content can trigger browser security indicators that reduce user trust.

What the Platform Checks

After crawling the HTTPS page and rendering it, the platform checks all resource requests for HTTP scheme URLs. Fires when any HTTP-scheme resource is detected on an HTTPS page.

How to Fix It

• Update all HTTP resource URLs to HTTPS counterparts: images, scripts, stylesheets, fonts, embeds.
• For third-party resources: check whether the provider supports HTTPS (almost all do) and update the URLs.
• In CMS content: search for hardcoded http:// URLs in content and replace with https:// (or use CMS site URL functions that automatically use the current scheme).
• Add a Content Security Policy with upgrade-insecure-requests directive as a fallback to automatically upgrade any remaining HTTP requests.