Security · Checked on every page
No mixed content (HTTP on HTTPS)What it checks and how to fix it
What it checks
On HTTPS pages, parses the HTML for resources referenced with an http:// URL. Scripts, stylesheets, iframes, object/embed and form actions over HTTP are active mixed content and fail. Images, audio and video over HTTP are passive mixed content and get a warning. No HTTP references passes; pages served over HTTP are skipped.
Why it matters
Browsers block active mixed content outright, so the script, stylesheet or iframe silently does not load and the page breaks. Passive content is upgraded or shown with a degraded padlock. Anything loaded over HTTP can be read or modified in transit, which undoes the protection HTTPS gives the rest of the page, and a form posting to HTTP sends its data in the clear.
How to fix it
Change every http:// reference to https:// (or a relative URL), in templates, CMS content and the database. Confirm each third-party host actually serves the resource over HTTPS.
<!-- Before -->
<script src="http://cdn.example.com/lib.js"></script>
<!-- After -->
<script src="https://cdn.example.com/lib.js"></script>
As a safety net while you clean up, ask browsers to upgrade remaining requests:
nginx
add_header Content-Security-Policy "upgrade-insecure-requests" always;
Apache
Header always set Content-Security-Policy "upgrade-insecure-requests"
Cloudflare: SSL/TLS → Edge Certificates → turn on Automatic HTTPS Rewrites.
Rails (config/initializers/content_security_policy.rb)
config.content_security_policy { |policy| policy.upgrade_insecure_requests true }
For WordPress and similar CMSs, search-and-replace http://yourdomain with https://yourdomain in the database.