What Mixed Content Is and Why Browsers Block It

HTTPS protects a page against eavesdropping and tampering, but that protection only covers what is actually fetched over HTTPS. If an otherwise secure page loads even a single script, stylesheet or image over plain HTTP, that one request travels in the clear and can be intercepted or altered, which is exactly the kind of weak link an attacker looks for rather than trying to break the encryption directly.

Browsers treat two kinds of mixed content differently. Active mixed content, scripts and stylesheets that can actually change what the page does, is blocked outright and simply fails to load. Passive mixed content, mainly images and video, is allowed to load but is flagged, since a tampered image is a lesser risk than a tampered script, though modern browsers have been steadily tightening even this over time.

Mixed content most often survives a migration to HTTPS as a leftover hardcoded http:// URL somewhere in a template, an old piece of content, or a third party embed that was never updated. It is easy to miss because the page usually still looks fine, the broken part is invisible unless you check the browser's developer console or scan the page's actual source directly.

Most mixed content is fixed by simply changing http:// to https:// in the offending reference, since the overwhelming majority of resources, fonts, CDN-hosted libraries, image hosts, are available over HTTPS today regardless of which protocol the original link used. A resource that genuinely has no HTTPS version at all is rare enough that it usually means finding an alternative source rather than working around it.

Mixed Content Checker fetches a page served over HTTPS and scans it for resources still being loaded over plain HTTP, listing each one so it can be fixed directly rather than hunting for it in a browser's developer tools one page at a time.