HTTPS & cookies

How to fix: Mixed content (HTTP resources on an HTTPS page)

Mixed content happens when an HTTPS page loads a script, stylesheet, image or frame over plain HTTP.

Not sure whether your site has this problem? Check it in seconds.

SSL Checker Run a free audit

Why it matters

The insecure resource can be read or tampered with in transit. If it's a script or stylesheet, an attacker could change what your page does, which defeats the point of HTTPS. Browsers block the risky kinds and may show the page as not fully secure.

How to check

Open DevTools → Console on the affected page; blocked or warned items are listed with their URLs. Search your templates for http:// as well.

How to fix it

Fix the URL

<!-- before -->
<img src="http://cdn.example.com/logo.png">
<!-- after -->
<img src="https://cdn.example.com/logo.png">

Safety net (header)

Content-Security-Policy: upgrade-insecure-requests

Common mistakes

Relying only on upgrade-insecure-requests: it only works if the resource also exists over HTTPS. Fix the URLs properly.
Forgetting hard-coded http:// links in stored content such as old blog posts or database fields.

Frequently asked questions

Are plain http:// links to other websites mixed content?

No. Mixed content is about resources the page loads (images, scripts, styles, frames), not links a visitor clicks.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.