Mixed content (insecure resources on an HTTPS page)

High priorityTechnical

The HTTPS page loads scripts, styles, images or frames over insecure HTTP.

What triggers this issue

• One or more src or href values on the page start with http://.

Why it matters

Browsers block insecure scripts, styles and frames on HTTPS pages, which can break layout and features. Insecure images are upgraded or shown with a warning, and the padlock disappears.

How to fix it

1. Change the listed URLs to https://, or to relative paths for your own files.
2. Search your database and theme for hard-coded http:// links to your own domain.
3. As a safety net, add Content-Security-Policy: upgrade-insecure-requests.