What is mixed content?
Mixed content is what you get when a secure page pulls in insecure parts: the HTML arrives over HTTPS, but an image, script, stylesheet, font or iframe on it is requested over plain HTTP. Browsers block the resource or upgrade the request, and the visitor may see a broken layout.
It is most common right after a site moves to HTTPS, when old http:// addresses are still stored in content.
What browsers do with it
Browsers sort insecure requests into two groups.
- Scripts, stylesheets, iframes and fetch requests are blocked outright, because a tampered script could take over the page. The page loads without them.
- Images, audio and video are upgraded automatically in current browsers: the request is retried over HTTPS. If the file is not available there, it fails and the image is simply missing.
A blocked item is reported in the developer tools console with a message like:
Mixed Content: The page at 'https://example.com/' was loaded over HTTPS,
but requested an insecure script 'http://example.com/js/slider.js'.
This request has been blocked; the content must be served over HTTPS.
Why it matters for search
HTTPS is a lightweight ranking signal in Google, and mixed content does not remove it, since the page URL is still secure. The damage is indirect. A blocked stylesheet or script changes what the page looks like and what it contains, for visitors and for Google's renderer alike. Lazy-loaded images, sliders, forms and consent banners are frequent casualties. Visitors who see a broken page or a browser warning on a checkout leave.
Finding it
Open the page, press F12 and read the Console and the Issues panel. For a whole site, crawl it and search the HTML for src="http:// and href="http:// on resources, or search the database for your own domain with the http:// prefix. Remember files referenced from inside CSS, such as background images and fonts, which never appear in the page source. Embedded third-party widgets, old tracking snippets and images hotlinked from other sites are the other usual suspects, and they are easy to miss because they often sit on only a handful of older posts.
Fixing it on WordPress
- Confirm both WordPress Address and Site Address in Settings → General start with
https://. - Replace stored
http://yourdomainreferences in the database with a search-and-replace tool that handles serialised data. WP-CLI does it in one line:wp search-replace 'http://example.com' 'https://example.com'. - Fix hard-coded URLs in theme files, widgets and page-builder settings.
- For third-party resources, switch to their HTTPS address or host the file yourself. If the provider has no HTTPS version, drop it.
As a safety net you can send the header Content-Security-Policy: upgrade-insecure-requests, which tells browsers to request every resource over HTTPS. It hides the symptom and is not a substitute for fixing the stored URLs. Once the site is clean, HSTS keeps browsers on HTTPS for the pages themselves.
Common questions
Does mixed content hurt SEO?
Not directly. It hurts through its effects: blocked scripts and styles can remove content or break layout for users and for Google's renderer, and browser warnings cost trust and conversions.
Is a link to an HTTP site mixed content?
No. An ordinary hyperlink to an HTTP page is fine. Mixed content only concerns resources the page loads, such as images, scripts and frames.
Why do I still see a warning after installing SSL?
A certificate secures the connection, but it does not rewrite URLs stored in your content. Any image or script still referenced with http:// triggers the warning until the reference is updated.