How to fix mixed-content warnings

Published September 23, 2026 · about a 6-minute read

You moved the site to HTTPS, the certificate is valid, and yet the padlock looks off — or worse, a map, a chat widget, or a chart just quietly stopped loading. Nine times out of ten the culprit is the same: mixed content. The page is secure, but it's reaching out for pieces of itself over plain HTTP, and the browser isn't having it.

Here's what's actually happening and how to clear it properly, not just paper over it.

What mixed content is

Your page loads over https://, but somewhere in the HTML, CSS, JavaScript, or database there's a resource still pointed at http:// — an image, a script, a stylesheet, an embedded frame. That single insecure request undermines the encrypted page around it, so the browser steps in. An HTTPS page is only as trustworthy as the least secure thing it loads.

Why some things vanish and others just warn

Browsers split mixed content into two buckets, and they treat them very differently now:

That table explains the two symptoms. A downgraded padlock with everything still visible? Usually passive content. A feature that flat-out disappeared after the HTTPS move? That's active content getting blocked — the browser refused to run an http:// script or load an http:// iframe, because a man-in-the-middle could swap it for anything. The block is the browser protecting your visitors from you.

Find every instance (not just the homepage)

The mistake is checking the front page, seeing a clean padlock, and calling it done. Mixed content hides on the pages you visit least. Three ways to hunt it:

• DevTools console. Open a page, check the Console — mixed content logs a specific warning naming the exact URL. Fast for spot checks.
• Search the source. Grep your templates, theme files, and CSS/JS for http://. Most instances are hardcoded strings someone pasted years ago.
• Crawl the whole site. A recursive checker walks every page so you catch the blog post from 2022 with an http:// image. Don't trust a single-page look.

Mixed content is almost never one thing. It's a scattering of old hardcoded URLs across pages nobody's opened in a year — which is exactly why a crawl beats eyeballing the homepage.

Fix it in the right order

1. Quick safety net: upgrade-insecure-requests. Add this Content-Security-Policy directive and the browser rewrites http:// sub-requests to https:// before they're even sent, so they never trip the mixed-content check:

Content-Security-Policy: upgrade-insecure-requests

This clears most warnings instantly and transparently, without touching your HTML. But it's a belt, not the trousers — if a resource genuinely has no HTTPS version, the upgraded request just fails and the thing still breaks. It buys you cover while you do the real fix. (It's one line inside your broader Content-Security-Policy.)

2. The real fix: change the URLs. Replace hardcoded http:// references in your HTML, CSS, JS, and — the one people forget — your database. On WordPress, don't hand-edit the DB; use a safe search-and-replace (WP-CLI's search-replace) to update stored URLs across posts and options.

3. Deal with stubborn third parties. If an embedded widget or CDN only serves http://, you can't upgrade what doesn't exist. Switch to a vendor that supports HTTPS, or self-host the asset. There's no clever header for a resource that simply isn't available securely.

4. Lock it in with HSTS. Once a crawl shows zero mixed content, add HSTS so browsers refuse plain HTTP for your domain entirely. That stops the whole class of problem from creeping back at the connection level.

Why it comes back

You fix it, the padlock's clean, everyone moves on. Then six weeks later marketing pastes an http:// embed into a landing page, or a plugin update reintroduces an insecure asset, and one page quietly slips back to mixed content — usually a page you never look at. Same story as a connection warning: it's invisible from where you sit. Something should be crawling the live site on a schedule and telling you when a page goes insecure again.

Our free site checker flags mixed content and the rest of your TLS posture in seconds, no signup — a good first pass, and worth repeating after any big content change.