How Do I Fix a Mixed Content Warning?

A mixed content warning appears when an HTTPS page loads a resource (image, script, stylesheet) over plain HTTP. Browsers block the insecure resource or warn about it, since it undermines the page’s overall security.

How to find it

  • Open browser DevTools → Console on the affected page; mixed content warnings are logged there with the exact offending URL
  • Site-wide scanners can crawl every page for this rather than checking one at a time

How to fix it

  1. Change hardcoded http:// resource URLs to https:// (most third-party assets support HTTPS today)
  2. Use protocol-relative or root-relative URLs where the codebase supports it, so this class of bug can’t recur
  3. For old database content (e.g. CMS posts with hardcoded HTTP image URLs), run a one-time find-and-replace migration

FAQ

Does mixed content actually get blocked, or just warned about?

Scripts and stylesheets are typically blocked outright by modern browsers; images and some other passive content are usually just flagged with a warning, but both should be fixed.

Updated at: .