Security fix
How to Fix Mixed Content Warnings
Make every resource load over HTTPS so the browser shows a secure padlock.
- Difficulty
- Easy
- Impact
- High
- Time
- 20 min
Before
<img src="http://example.com/logo.png"> <!-- blocked on https page -->After
<img src="https://example.com/logo.png">
<!-- header: Content-Security-Policy: upgrade-insecure-requests -->Mixed content means an HTTPS page loads images, scripts or styles over plain HTTP. Browsers block or flag those files, which breaks the padlock and sometimes the layout. Find the insecure URLs in the browser console, change them to HTTPS, and add an upgrade-insecure-requests directive to catch any you missed.
Why it matters
Mixed content happens when an HTTPS page loads images, scripts or styles over insecure HTTP. Browsers block or warn about it, breaking the padlock and sometimes the page. It defeats the purpose of having HTTPS.
How to fix it
Find the HTTP resources
Open DevTools → Console; mixed-content warnings list everyhttp://resource on the page.Switch them to HTTPS
Update the URLs tohttps://(or protocol-relative). Re-upload any assets only available over HTTP.Add an upgrade directive
As a safety net, sendupgrade-insecure-requestsso browsers auto-upgrade subresource requests.
The code
<img src="http://example.com/logo.png"> <!-- blocked on https page --><img src="https://example.com/logo.png">
<!-- header: Content-Security-Policy: upgrade-insecure-requests -->On your platform
WordPress
"Really Simple SSL" rewrites insecure URLs automatically; for hardcoded ones, run a search-replace on the database.
Next.js
Use https:// (or relative) asset URLs; next/image requires configured https domains.
Sources
Check your site with our free tool
SSL Certificate Checker
More fixes
Security
How to Add X-Content-Type-Options: nosniff
Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.
Security
How to Add a Permissions-Policy Header
Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.
Security
How to Secure Cookies (Secure, HttpOnly, SameSite)
Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.
Fixed that one.
Now find the rest.
A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.
Run a free audit