Mixed content is any http:// resource loaded by an https:// page. Browsers block active mixed content such as scripts and styles, and warn or auto-upgrade passive images. Find it in the console and in crawl output, then serve every subresource over HTTPS, including third-party embeds.
The extended brief explains when this works, when it does not, and the trade-offs. Join the waitlist and it unlocks for every tip when sign-in opens; MCP access is the paid part.
Load each key template with DevTools open and copy every Mixed Content message. Also grep the rendered HTML for src="http:// and href="http://.
Check: The list of insecure subresource URLs is recorded with the page where each appears.
Switch resources to HTTPS
Update templates, CMS settings and third-party snippets to https:// URLs. Replace providers that cannot serve TLS, or proxy them through your own HTTPS origin.
Check: The rendered HTML contains no http:// subresource URLs on sampled templates.
Add a regression guard General best practice
Deploy a Content-Security-Policy in report-only mode with upgrade-insecure-requests, and review reports for new insecure resources after each release.
Check: CSP reports show no blocked mixed-content requests after the next deploy.
<goal>
cluster markup schema intent render metadata image signal link heading snippet alt cluster signal.
</goal>
<context>
redirect canonical markup content query cluster audit index priority alt metadata crawler query redirect.
</context>
<discover_first>
template anchor content layout measure image audit heading target redirect heading route caching verify.
</discover_first>
<constraints>
crawler heading route payload audit alt canonical effort sitemap index snippet anchor cluster heading.
</constraints>
<plan>
layout snippet cluster link template layout schema render caching heading template target markup sitemap.
</plan>
<verify>
report snippet verify heading snippet image priority schema section index signal template query image.
</verify>
<report>
link target template link serp crawl serp priority report heading heading image template schema.
</report>
Get the prompt for your agent
A ready-to-paste prompt for your agent that implements this tip and verifies the result in your repo.
Run `wp search-replace 'http://' 'https://' --all-tables --dry-run`, review the output, then run it without `--dry-run`; update the Site URL and Home settings before searching for remaining third-party http resources.
static-html
Use root-relative paths for same-origin assets and https:// for third parties; add a CSP `upgrade-insecure-requests` directive as a safety net.
Verify indexing with URL Inspection — URL Inspection shows the indexed version Google holds for one URL: crawl time, selected canonical, status code and blocked resources.
Canonicalize duplicate URLs — Duplicate URLs split signals across protocol, host, slash and parameter variants.
Make JavaScript content crawlable — Google renders JavaScript, but rendering costs time and AI retrieval systems often read raw HTML.