Mixed content occurs when an HTTPS page requests resources over insecure HTTP. Fix the resource references in the application so images, scripts, styles, forms and embedded services use supported secure destinations.
01 Find the source of the request
- Open the affected page over HTTPS and reproduce the missing image, broken feature or warning.
- Use the browser's developer tools. In Chrome, inspect the security information and the Issues, Console or Network panels for affected resource URLs.
- Record which component generated each URL: page content, theme, stylesheet, plugin, external widget or application setting.
- Verify that the destination supports HTTPS with a valid certificate. Update the source reference or replace an insecure third-party component.
- For stored application content, use the application's supported migration or search-and-replace tool after a backup. Raw database replacement can damage structured or serialised values.
- Clear relevant application and CDN caches, then test the original page and related templates. Include mobile pages, forms and checkout.
Common questions
Why is only one page affected?
A particular image, embed or content block may contain a hardcoded HTTP address. Compare the failing request with a working page to locate the shared template or unique content.
Does a new certificate fix mixed content?
A certificate protects the connection for a hostname. It does not rewrite the insecure addresses stored in your website.
Can I rely on the browser to upgrade everything?
Browsers may upgrade some resource types and block others. Correct the application references and verify the resulting HTTPS resources instead of depending on fallback behaviour.
Should I disable browser security to test?
Use the reported errors to find the offending requests. The completed site should work with ordinary browser protection enabled.