GlossarySEO
What is mixed content?
Also called: mixed content warning, insecure content, blocked mixed content
Definition
Mixed content is when a page loaded over HTTPS includes resources, like images, scripts or iframes, loaded over plain HTTP. Browsers upgrade or block those requests, which can break the page.
Mixed content, explained
MDN explains the risk: resources loaded over HTTP on an HTTPS page can be intercepted, read or modified in transit, undermining the page's security. Browsers now treat mixed content in two groups. Upgradable content, like <img>, <audio> and <video> sources and CSS images, is automatically requested over HTTPS instead. Blockable content, including <script>, stylesheets, <iframe>, fetch() requests, web fonts and images using srcset or <picture>, is blocked outright.
The visible symptoms are broken layouts, missing fonts, embeds that don't load, forms that fail, and console warnings. If an upgraded image doesn't exist on HTTPS, it simply disappears. None of this shows in your code review if the HTTP URL is buried in a CMS field or a third-party snippet.
The fix is to load every resource over HTTPS. Search your codebase and CMS content for http:// URLs, update them to https:// or use relative paths for your own resources, and replace any third-party service that doesn't support HTTPS. As a safety net, the Content-Security-Policy: upgrade-insecure-requests header tells browsers to upgrade all insecure requests, including ones they would otherwise block, but it can't help if the resource doesn't exist on HTTPS.
For SEO, mixed content matters because Google renders pages like a browser. A blocked script or stylesheet can mean Google sees a broken or incomplete page. It's also part of doing HTTPS properly, which Google lists under page experience.
Why it matters for founders
After an HTTPS move or a CMS import, old http:// links to images and scripts quietly break pages. It's quick to find and fix once you look.
Example
Your blog's older posts embed images from http://cdn.oldhost.com. Some load after auto-upgrade; others vanish. You migrate the images to your current CDN over HTTPS and update the posts.
Common mistakes
- Hardcoded
http://URLs in CMS content. - Third-party widgets loaded over HTTP.
- Relying on
upgrade-insecure-requestsfor resources that don't exist on HTTPS. - Not checking the browser console after an HTTPS move.
Sources
Checked
Related terms
- HTTPSHTTPS is HTTP over an encrypted TLS connection, shown by
https://and a padlock in browsers. Google has used it as a lightweight ranking signal since 2014, and browsers warn users about sites without it. - HSTSHSTS (HTTP Strict Transport Security) is a response header telling browsers to only ever connect to your domain over HTTPS, for a set period. Browsers then upgrade any
http://link before sending it. - RenderingRendering is when a search engine runs a page's JavaScript and CSS in a headless browser to see the final content, as a user would. Google renders pages before indexing what it finds.
- Page experiencePage experience is Google's term for how using a page feels beyond its content: loading speed, responsiveness, visual stability, HTTPS, mobile usability, ads and interstitials. Google says there is no single page experience signal.