Mixed content

What this check looks for

For pages served over HTTPS, this check scans for http:// references in active content (<script src>, <iframe src>, <object data>, <embed src>, <form action>, and stylesheet <link> tags) and separately in passive content (<img>, <video>, <audio>, <source>). Any active mixed content fails, since browsers typically block it outright, breaking the page. Passive-only mixed content warns, since browsers usually load it but flag it as insecure. No mixed-content references passes; a non-HTTPS page reports "na" since mixed content doesn't apply.

Why it matters

When an HTTPS page loads a script or stylesheet over plain HTTP, that resource travels unencrypted even though the page around it doesn't — an attacker on the network can tamper with that script before it reaches the browser, which defeats the purpose of HTTPS entirely for anything that resource controls. Modern browsers actively block "active" mixed content like scripts and frames by default, so the affected functionality on your page silently fails for visitors. Passive mixed content (an image over HTTP) usually still loads but triggers a browser security warning, which undermines visitor trust in the page the same way an expired certificate would.

How to fix it

Update every hardcoded HTTP reference to HTTPS, or use a protocol-relative/relative URL:

<!-- Active mixed content: script blocked on an HTTPS page -->
<script src="http://cdn.example.com/analytics.js"></script>

<!-- Fixed -->
<script src="https://cdn.example.com/analytics.js"></script>

Audit any third-party embeds and widgets too — mixed content often comes from an old snippet pasted in before the site migrated to HTTPS.