Mixed Content Check

Mixed content happens when a secure HTTPS page loads sub-resources — images, scripts, stylesheets, or iframes — over insecure http://. The browser flags the page as "not fully secure," removes the padlock, and may block the resource entirely. Worse, an HTTP script on an HTTPS page can be swapped out in transit, turning a cosmetic warning into a real code-injection risk. VitalSite scans the HTML of every crawled page and reports each unique insecure asset once.

What VitalSite checks

We parse every page for src and href attributes that begin with http:// across:

• images (<img>)
• scripts (<script>)
• stylesheets (<link>)
• iframes and media sources

Because the check runs across the whole domain and deduplicates by unique asset, you get a clean list of exactly which resources to fix — not the same warning repeated on every page.

Why it matters

"Active" mixed content (scripts and stylesheets) is the dangerous kind: because it can execute, a network attacker who tampers with that HTTP request can run code in the context of your secure site. "Passive" mixed content (images) is less dangerous but still breaks the padlock and erodes trust. Either way, modern browsers increasingly block mixed content outright, which can visibly break your layout.

How to fix it

1. Change the URLs. Update each http:// asset URL to https://. Most third-party CDNs already serve HTTPS — just change the scheme.

2. Use protocol-relative or absolute HTTPS URLs going forward.

3. Add a safety net. The header Content-Security-Policy: upgrade-insecure-requests tells the browser to automatically upgrade any remaining HTTP sub-resource requests to HTTPS:

add_header Content-Security-Policy "upgrade-insecure-requests" always;

On WordPress, a search-and-replace plugin can rewrite hard-coded http:// asset URLs in the database. Our guide on fixing mixed content warnings walks through each platform.

Verify the fix

Re-scan the domain. The Mixed Content check should report CLEAR, and the browser padlock should return on every page. Combine this with HTTPS enforcement and a valid certificate for a fully secure transport layer.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.