Mixed content occurs when an HTTPS page requests a resource using HTTP. Typical sources include old image addresses, theme stylesheets, scripts, embedded frames and application settings that still reference the previous URL. The page certificate can be valid while these insecure requests prevent the website from behaving correctly.
Recommended workflow
- Open an affected page over HTTPS and inspect the browser console and network panel for blocked or upgraded HTTP requests.
- Update the responsible content, theme configuration or application URL setting and keep a record of the changes.
- Reload without stale cached content, test interactive features, and confirm that HTTP requests no longer appear in the page resource list.
Use the browser developer tools to identify the exact requested URL and the file or template that generated it. Correct the source rather than hiding warnings. For a CMS, take a restorable backup before changing stored URLs or running a search-and-replace operation, and use a tool that understands the application data format.
Check each replacement resource over HTTPS before saving the new address. An unavailable third-party resource needs an alternative or removal rather than a forced URL change. After editing, clear the relevant application, page and CDN caches where applicable.
