You've installed an SSL certificate, your site is on HTTPS — and yet the browser still shows "Not Secure," a broken padlock, or images and scripts that mysteriously won't load. The usual culprit is mixed content: a secure page that's quietly loading some of its pieces over an insecure connection. It's one of the most common snags after switching a site to HTTPS, and it's very fixable once you know how to find it. Here's how to check a website for mixed content errors and clear them for good.

What is mixed content?

Mixed content happens when a page loaded over secure HTTPS also requests some of its resources — images, scripts, stylesheets, fonts, or videos — over insecure HTTP. The page itself is encrypted, but those individual pieces aren't, so the connection is a "mix" of secure and insecure. Because a page is only as secure as its weakest link, browsers treat this as a problem.

This is exactly why a site with a valid certificate can still show "Not Secure" — the padlock reflects the whole page, and one stray http:// resource downgrades it.

Why mixed content is a problem

Those insecure resources undermine the security HTTPS is supposed to provide. An attacker could potentially intercept or tamper with anything loaded over HTTP — including scripts that control how your page behaves. To protect users, browsers respond in two ways depending on the type of mixed content, and knowing the difference matters.

Passive vs active mixed content

  • Passive (display) mixed content — images, audio, and video loaded over HTTP. Browsers usually still load these but downgrade the padlock and show a warning. It's a security and trust problem, but the page mostly works.
  • Active mixed content — scripts, stylesheets, iframes, and fetch/XHR requests over HTTP. Because these can change the whole page, browsers block them by default. This is what breaks a site: missing styling, broken features, and functionality that silently fails.

So mixed content isn't just cosmetic — active mixed content can genuinely break your site while looking like a mysterious bug.

How to check a website for mixed content

Here's how to find exactly what's insecure:

  • Use your browser's DevTools Console. This is the fastest, most precise method. Open Developer Tools (F12 or right-click → Inspect), go to the Console tab, and reload the page. The browser lists every mixed-content issue with a message like "Mixed Content: The page was loaded over HTTPS but requested an insecure resource…" — and it tells you the exact HTTP URL causing each one.
  • Check the padlock/site info. Click the padlock (or "Not Secure") in the address bar. If it says the connection isn't fully secure, mixed content is the likely reason.
  • Use an online mixed-content scanner. Free scanners crawl a page and list its insecure resources, which is handy for checking pages you can't easily open in DevTools.
  • Search your page source. Look through the HTML (and your templates) for hardcoded http:// links to your own or third-party resources.

The DevTools Console is your best friend here — it names each offending file so you know precisely what to fix.

How to fix mixed content

Once you've found the insecure resources, fixing them means making every resource load over HTTPS:

  • Change http:// to https://. Update the URLs of your images, scripts, stylesheets, and other resources to their secure versions. Most modern hosts and third-party services support HTTPS, so the secure URL usually just works.
  • Update hardcoded links in your CMS or database. After an HTTP-to-HTTPS migration, old insecure URLs often linger in your content. A careful search-and-replace across your database (or a plugin, on platforms like WordPress) updates them in bulk.
  • Use the upgrade-insecure-requests policy. Adding this Content-Security-Policy header tells browsers to automatically upgrade insecure resource requests to HTTPS — a strong catch-all, especially alongside manual fixes.
  • Replace third-party resources that don't support HTTPS. If an external script or widget only offers HTTP, find an HTTPS alternative — browsers will block it otherwise.
  • On WordPress specifically, confirm your Site Address and WordPress Address use https://, and an SSL/HTTPS plugin can handle most mixed-content rewrites automatically.

After fixing: verify it's clean

Once you've made changes, confirm the fix:

  1. Hard-reload the page and reopen the DevTools Console — it should be free of mixed-content warnings.
  2. Check the padlock is back and fully secure, with no "Not Secure" label.
  3. Confirm your certificate is healthy with our free SSL Certificate Checker, so you know HTTPS itself is properly in place.

Test a few different pages (home, posts, product pages), since mixed content can hide on some templates but not others.

The bottom line

Mixed content is what happens when a secure HTTPS page loads some of its resources over insecure HTTP — and it's why a site with a valid certificate can still be flagged "Not Secure" or have broken features. Check for it using your browser's DevTools Console, which pinpoints every insecure resource, then fix each by switching it to HTTPS (and add upgrade-insecure-requests as a safety net). It builds on the same foundation as HTTPS and your SSL certificate — get every resource loading securely, and your padlock, your security, and your site's functionality all fall back into place.