How to Fix Mixed Content Warnings on Your Website

Mixed content happens when a page served over HTTPS loads sub-resources — images, scripts, stylesheets, or iframes — over plain HTTP. The browser shows a "not fully secure" warning, removes the padlock, and may block the resource entirely. Worse, those HTTP assets can be intercepted and modified in transit.

Find the offenders

Open your browser's developer console; it lists every mixed-content URL. VitalSite scans every page of your domain and reports each http:// asset it finds.

Fix it

1. Change http:// to https:// for every asset that supports it (most CDNs and modern hosts do).

2. For your own assets, use protocol-relative or absolute HTTPS URLs.

3. Add an automatic upgrade header so the browser fixes stragglers:

Content-Security-Policy: upgrade-insecure-requests

Prevent it from returning

Audit hard-coded HTTP links in your CMS database (WordPress: run a search-replace from http:// to https://). After fixing, re-scan to confirm zero mixed-content findings remain.