Fix this week

Part of your secure page loads over an insecure connection

What it means

When someone visits your site over https, everything on the page is supposed to arrive through the same encrypted connection. "Mixed content" means one or more pieces, often an old logo, a background image or a script tag pasted in years ago, still points to an http:// address.

It usually happens after a site moves to https. The pages themselves switch over, but addresses typed into posts, theme settings or widgets keep the old http:// in front.

Why it matters

Browsers handle it in one of two ways. For images and video they load the file but drop the padlock, so visitors see "Not secure" or a warning icon next to your address. For scripts, styles and frames they block the file outright, which can quietly break a menu, a form or a checkout button.

Either way, a visitor who notices the missing padlock on a page that asks for their details has a good reason to leave. Anything sent over plain http can also be read or changed by someone on the same network, such as public Wi-Fi.

How to check your own site

1. Open the page in Chrome, Edge or Firefox and look at the icon to the left of your address. A warning icon or "Not secure" on an https page is the giveaway.
2. Right-click the page, choose Inspect, and open the Console tab. Reload the page. Mixed content shows up as a yellow or red message that starts with "Mixed Content" and names the exact address.
3. Check the pages that matter most: the home page, contact form, checkout and any page with a login.

How to fix it

Any website

1. Note each address the browser console lists.
2. Open that address yourself with https:// in front. If it loads, you only need to change the address where it appears on your site.
3. If it does not load over https, the file lives somewhere that does not support it. Download it, upload it to your own site, and use the new address.

WordPress

1. Under Settings, General, make sure both "WordPress Address" and "Site Address" start with https://.
2. Search your posts and pages for http:// plus your domain. A search-and-replace plugin can change every copy at once. Take a backup first, and preview the changes before running them.
3. Check places a search can miss: theme settings, the Customizer, widgets, and page-builder blocks. Old image and background addresses often hide there.
4. If a plugin or theme hard-codes an http:// address, update it. If an update does not fix it, tell the plugin author, or replace the plugin.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms serve their own files over https, so mixed content almost always comes from something you pasted in: an embed, a custom code block, or an image linked from another site.
2. Find the code block or embed on the page named in the console and change http:// to https://. If the other site does not support https, remove the embed or ask its provider for a secure version.

Cloudflare

1. Under SSL/TLS, Edge Certificates, turn on "Automatic HTTPS Rewrites". Cloudflare then rewrites http:// addresses it knows are also available over https.
2. Treat it as a safety net rather than the fix. Addresses it cannot rewrite still need changing at the source.

What to send your developer

Find insecure sub-resources on the page and serve them over https. Search the templates and database for hard-coded http:// URLs. Once everything is fixed, a Content-Security-Policy with upgrade-insecure-requests makes browsers upgrade any stragglers automatically.

Content-Security-Policy: upgrade-insecure-requests

Common questions