Fix mixed content on HTTPS pages

Mixed content is any http:// resource loaded by an https:// page. Browsers block active mixed content such as scripts and styles, and warn or auto-upgrade passive images. Find it in the console and in crawl output, then serve every subresource over HTTPS, including third-party embeds.

mediumIn codeimpact effort

Why this matters

One http:// subresource breaks the padlock and some functionality.

Get the full breakdown

The extended brief explains when this works, when it does not, and the trade-offs. Join the waitlist and it unlocks for every tip when sign-in opens; MCP access is the paid part.

Join the waitlist

Before you start

  • HTTPS enabled on the site

How to apply it

  1. Collect blocked URLs from the console

    Load each key template with DevTools open and copy every Mixed Content message. Also grep the rendered HTML for src="http:// and href="http://.

    Check: The list of insecure subresource URLs is recorded with the page where each appears.

  2. Switch resources to HTTPS

    Update templates, CMS settings and third-party snippets to https:// URLs. Replace providers that cannot serve TLS, or proxy them through your own HTTPS origin.

    Check: The rendered HTML contains no http:// subresource URLs on sampled templates.

  3. Add a regression guard General best practice

    Deploy a Content-Security-Policy in report-only mode with upgrade-insecure-requests, and review reports for new insecure resources after each release.

    Check: CSP reports show no blocked mixed-content requests after the next deploy.

Get the prompt for your agent

A ready-to-paste prompt for your agent that implements this tip and verifies the result in your repo.

Join the waitlist

Source: seo-mcp playbook · curated entry · report an error

Framework notes

wordpress

Run `wp search-replace 'http://' 'https://' --all-tables --dry-run`, review the output, then run it without `--dry-run`; update the Site URL and Home settings before searching for remaining third-party http resources.

static-html

Use root-relative paths for same-origin assets and https:// for third parties; add a CSP `upgrade-insecure-requests` directive as a safety net.

Official references

Let your agent apply this + 161 more tips.

Pre-order — $19