Mixed content (HTTP resources on HTTPS page): what it is, why it matters, and how to fix it
This HTTPS page loads resources (images, scripts, stylesheets, iframes) over insecure HTTP connections. Modern browsers block mixed active content (scripts, iframes) and may warn about or degrade mixed passive content (images).
Where this fits: security in SEO
Why mixed content (http resources on https page) hurts your rankings
Mixed content undermines the security guarantees of HTTPS, as HTTP resources can be intercepted and modified by attackers. Browsers display security warnings or block mixed content entirely, breaking page functionality. Google considers HTTPS a ranking signal, and mixed content warnings can erode user trust and increase bounce rates.
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it.
How to fix it
Update all resource URLs to use HTTPS. If the resource's server doesn't support HTTPS, host the resource yourself or find an alternative. Use Content-Security-Policy: upgrade-insecure-requests as a temporary measure to automatically upgrade HTTP requests to HTTPS.
<!-- Before (mixed content) -->
<img src="http://cdn.example.com/image.jpg" />
<script src="http://analytics.example.com/tracker.js"></script>
<!-- After (secure) -->
<img src="https://cdn.example.com/image.jpg" />
<script src="https://analytics.example.com/tracker.js"></script>Frequently asked questions
What does "Mixed content (HTTP resources on HTTPS page)" mean?
This HTTPS page loads resources (images, scripts, stylesheets, iframes) over insecure HTTP connections. Modern browsers block mixed active content (scripts, iframes) and may warn about or degrade mixed passive content (images).
Why does mixed content (http resources on https page) matter for SEO?
Mixed content undermines the security guarantees of HTTPS, as HTTP resources can be intercepted and modified by attackers. Browsers display security warnings or block mixed content entirely, breaking page functionality. Google considers HTTPS a ranking signal, and mixed content warnings can erode user trust and increase bounce rates.
How do I fix mixed content (http resources on https page)?
Update all resource URLs to use HTTPS. If the resource's server doesn't support HTTPS, host the resource yourself or find an alternative. Use Content-Security-Policy: upgrade-insecure-requests as a temporary measure to automatically upgrade HTTP requests to HTTPS.
How serious is this issue?
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects mixed content (http resources on https page) on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by mixed content (http resources on https page), and hands you a ready-made fix task.
Check my site free