---
title: "Fix mixed content on HTTPS pages"
description: "Mixed content is any http:// resource loaded by an https:// page. Browsers block active mixed content such as scripts and styles, and warn or auto-upgrade passive images. Find it in the console and in crawl output, then serve every subresource over HTTPS, including third-party embeds."
url: "https://seo-mcp.io/t/fix-mixed-content-on-https-pages"
---

# Fix mixed content on HTTPS pages

Mixed content is any http:// resource loaded by an https:// page. Browsers block active mixed content such as scripts and styles, and warn or auto-upgrade passive images. Find it in the console and in crawl output, then serve every subresource over HTTPS, including third-party embeds.

## Prerequisites

- HTTPS enabled on the site

## Steps

1. **Collect blocked URLs from the console** — Load each key template with DevTools open and copy every Mixed Content message. Also grep the rendered HTML for src="http:// and href="http://.
   Check: The list of insecure subresource URLs is recorded with the page where each appears.
2. **Switch resources to HTTPS** — Update templates, CMS settings and third-party snippets to https:// URLs. Replace providers that cannot serve TLS, or proxy them through your own HTTPS origin.
   Check: The rendered HTML contains no http:// subresource URLs on sampled templates.
3. **Add a regression guard** *(general best practice)* — Deploy a Content-Security-Policy in report-only mode with upgrade-insecure-requests, and review reports for new insecure resources after each release.
   Check: CSP reports show no blocked mixed-content requests after the next deploy.

## Source

@seo-mcp on 2026-10-19: https://web.dev/articles/what-is-mixed-content

Canonical: https://seo-mcp.io/t/fix-mixed-content-on-https-pages