Mixed content error

Updated 9 October 2026

Short answer

Your page is on HTTPS, but something on it (an image, a script, a stylesheet, a font, or a form) is still loaded from an http:// address. Browsers block insecure scripts and styles outright, and may block or warn about images, which can break the layout or features and removes the padlock. The fix is to change those addresses to https://.

What's the problem

The padlock is missing or shows a warning. Parts of the page are missing or unstyled. The browser console (F12) shows "Mixed Content: The page was loaded over HTTPS, but requested an insecure resource".

Why it happens

  • Hard-coded http:// links in your content, theme or templates, often left over from before the site moved to HTTPS.
  • The site's own address is set to http:// in its settings (for example in WordPress), so it generates insecure links.
  • Third-party embeds (widgets, old ad code, fonts) loaded over HTTP.

How to fix it

  1. Open the browser console (F12) and list every mixed content warning. Each one names the insecure address.
  2. Change the site's own URL setting to https://. On WordPress that's Settings → General.
  3. Update hard-coded links in content and templates to https://, or use a search-and-replace on the database (back it up first).
  4. Replace or remove third-party resources that don't support HTTPS.
  5. If you use Cloudflare, "Automatic HTTPS Rewrites" can fix many links on the fly while you clean up the source.

What Preventionlabs checks

One click runs the full report on your domain. For this problem it shows insecure http:// files on any of up to 50 pages; whether HTTPS works and http visitors are sent to it; every version of your address (http, https, www) and where each ends up, including redirect loops.

Run your free report

Your first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.

Sources

  1. MDN Web Docs: Mixed contentreference"Mixed content" refers to securely loaded web pages that use resources to be fetched via HTTP or another insecure protocol.
  2. WordPress: Settings General screenofficial docsThe Site address (URL) is identical to the WordPress address (URL) (above) unless you are giving WordPress its own directory .

Related

HTTPS not working Usually no valid certificate, port 443 closed, or two redirect settings fighting. Check the certificate, then redirects and Cloudflare SSL mode. "Your connection is not private" The browser couldn't verify your site's certificate: it's expired, for the wrong domain, or not trusted. Fix or renew it on your server. Images not loading Check the image's address in the Network tab: 404 is a wrong path or missing file, 403 is permissions or hotlink protection, blocked is mixed content. Script not loading Check the browser's Network tab for the script: a 404 means a wrong path, a blocked request means a Content Security Policy, mixed content or an ad blocker.
← All of SSL and HTTPS