Mixed content happens when a page served over HTTPS requests some of its resources, such as images, scripts, stylesheets or iframes, over insecure HTTP. Browsers treat these requests as a security risk. Modern browsers try to upgrade many of them to HTTPS automatically and block the rest, so mixed content can leave pages with missing images, broken layouts or features that silently fail.
Types of mixed content
Browsers distinguish between resources that can do little harm if tampered with and those that can take over the page. Images, audio and video were traditionally called passive or upgradable content; scripts, stylesheets, iframes and fetch requests are active or blockable. Active mixed content is blocked outright. Chrome and other browsers now auto-upgrade upgradable content to HTTPS and block it if the upgrade fails.
Why it matters for SEO
If a blocked script renders content or a blocked stylesheet sets layout, the page Google renders may differ from what you intended. Missing images lose their place in image search. Browser warnings can also reduce trust. Mixed content most often appears after a move to HTTPS, when old content still contains hard-coded http:// URLs.
Finding and fixing it
Browser dev tools list mixed content in the console. Site crawlers can report it across all pages. Fix the source by changing URLs to HTTPS or to relative paths, and check that each third-party host supports HTTPS. As a safety net, a Content-Security-Policy header can upgrade remaining requests.
Content-Security-Policy: upgrade-insecure-requestsExample
Old blog images after an HTTPS move
Driftcairn, a project budgeting SaaS, moved to HTTPS years ago, but older blog posts embed images from an http:// asset host that has no certificate. Browsers block the upgrade, and the images disappear. A database search and replace to the CDN's HTTPS URLs restores them.
Common mistakes
Relying only on upgrade-insecure-requests
The header helps, but if the target host does not support HTTPS the request still fails. Fix URLs at the source.
Ignoring CMS content
Templates are easy to fix. Hard-coded URLs inside years of post bodies are where mixed content tends to hide.
Questions
Usually not by itself. The risk is that blocked resources change what renders, which can affect content, layout and image indexing.
