Security
How to Fix Mixed Content Warnings
Mixed content is HTTP resources (images, scripts, stylesheets, iframes) loaded inside an HTTPS page. Browsers either block them silently (active content like scripts) or show a 'not secure' warning. Both hurt UX and SEO.
Try our SSL checker1. Find every HTTP resource
Open DevTools → Console — mixed content errors are logged. Or use the Lighthouse 'Best practices' audit. CheckFast SSL checker also flags HTTP→HTTPS redirect issues.
2. Update each URL to HTTPS
Most CDNs and image hosts have HTTPS endpoints. Update src and href attributes from http:// to https://. For external scripts that don't support HTTPS find a replacement — there's almost always one.
3. Use upgrade-insecure-requests for legacy
If you have hundreds of HTTP URLs in legacy content set Content-Security-Policy: upgrade-insecure-requests. Browsers will silently rewrite http:// → https:// for any same-host resource.
4. Test
Reload your page in an incognito browser. Check DevTools Console — should be clean. Re-run our SSL checker — the 'HTTP→HTTPS redirect' check should pass.
Want to verify your setup?
Run the check now