security fix workflow

How to fix mixed content on HTTPS pages

Fix HTTP assets loaded on HTTPS pages to remove browser warnings and trust issues.

What this issue means

Mixed content happens when an HTTPS page loads scripts, images, styles, or iframes over HTTP.

Why it matters

Active mixed content can be blocked by browsers and passive mixed content weakens trust.

Evidence to collect

Retest the final HTTPS URL and check whether browser-facing headers and assets are fixed together.

Start with the same URL in the linked CheckWebs tool, save the failing signal, apply the fix, then retest the final redirected URL. Avoid judging the fix from a cached screenshot or a different URL variant.

How to check it

1Run Mixed Content Scanner.
2Identify whether the asset is script, stylesheet, image, iframe, or font.
3Check templates and CMS fields that output absolute HTTP URLs.

How to fix it

1Replace HTTP asset URLs with HTTPS equivalents.
2Host assets locally if the third-party source has no HTTPS support.
3Add Content-Security-Policy upgrade-insecure-requests only after testing.

Platform-specific fixes

WordPress

Update site URL settings to HTTPS.
Search and replace old HTTP media URLs after backup.

Shopify

Review theme liquid files and custom app embeds.
Replace hard-coded HTTP assets.

Nginx

Redirect HTTP to HTTPS.
Avoid proxying insecure asset origins into secure pages.

Validate the fix

1Re-run Mixed Content Scanner.
2Open the page in a clean browser and inspect console security warnings.

FAQ

Is upgrade-insecure-requests enough?+

It can help, but replacing root HTTP URLs is more reliable and easier to audit.

Loading CheckWebs…

security fix workflow

How to fix mixed content on HTTPS pages

Fix HTTP assets loaded on HTTPS pages to remove browser warnings and trust issues.

What this issue means

Mixed content happens when an HTTPS page loads scripts, images, styles, or iframes over HTTP.

Why it matters

Active mixed content can be blocked by browsers and passive mixed content weakens trust.

Evidence to collect

Retest the final HTTPS URL and check whether browser-facing headers and assets are fixed together.

How to check it

1Run Mixed Content Scanner.
2Identify whether the asset is script, stylesheet, image, iframe, or font.
3Check templates and CMS fields that output absolute HTTP URLs.

How to fix it

1Replace HTTP asset URLs with HTTPS equivalents.
2Host assets locally if the third-party source has no HTTPS support.
3Add Content-Security-Policy upgrade-insecure-requests only after testing.

Platform-specific fixes

WordPress

Update site URL settings to HTTPS.
Search and replace old HTTP media URLs after backup.

Shopify

Review theme liquid files and custom app embeds.
Replace hard-coded HTTP assets.

Nginx

Redirect HTTP to HTTPS.
Avoid proxying insecure asset origins into secure pages.

Validate the fix

1Re-run Mixed Content Scanner.
2Open the page in a clean browser and inspect console security warnings.

FAQ

Is upgrade-insecure-requests enough?+

It can help, but replacing root HTTP URLs is more reliable and easier to audit.