Skip to content

How to fix mixed content

Security1 min readFixes check mixed-content

An HTTPS page that loads images or scripts over http:// shows broken images and blocked scripts. Update the URLs.

Step by step, with screenshots: Content-Security-Policy: from report-only to enforced →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • No resources load over http://fail · −8 ptseffort M

Mixed content

Why it matters. Browsers block http:// scripts and stylesheets on an HTTPS page, which breaks layout or features, and upgrade http:// images and media to https, showing them broken when that fails. It usually appears after a move to HTTPS while old absolute URLs stay in the content.

How to fix it.
  1. Search and replace http:// with https:// in content, theme and configuration (WordPress: a search-replace plugin covers the database).
  2. Add Content-Security-Policy: upgrade-insecure-requests as a safety net.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.