Mixed content: how to find and fix insecure assets

What it means

A mixed-content warning means your HTTPS page is loading resources over plain HTTP. This usually shows up in images, scripts, stylesheets, or API calls that still point to unencrypted endpoints.

Why it matters

Mixed content degrades the HTTPS signal that Google uses as a lightweight ranking factor. More importantly, it can block rendering of critical resources—Googlebot sees the same broken references as a user does, and some resources may fail to load entirely on mobile. For AI crawlers, unloaded resources mean missing text, images, or structured data that could otherwise be parsed.

How to fix it

1. Replace all http:// URLs in your HTML with https:// (or protocol-relative // for external resources).
2. Update your canonical URL and any hreflang or Open Graph tags to use HTTPS.
3. Add an HSTS header to force browsers and crawlers to use HTTPS for subsequent requests.
4. Verify that your robots.txt does not block HTTPS URLs and that your sitemap lists HTTPS endpoints.

Example

<!-- on an https:// page -->
<img src="http://example.com/logo.png">
<script src="http://cdn.example.com/app.js"></script>

<img src="https://example.com/logo.png">
<script src="https://cdn.example.com/app.js"></script>

HTTPS pages must load subresources over HTTPS. Browsers block mixed active content (scripts) and warn on mixed passive content (images).

When it's not a problem

Mixed content is acceptable when the HTTP resources are truly external and non-critical—like a third-party analytics pixel or a CDN-hosted font that loads over HTTP. In those cases the ranking impact is negligible and the resources still render correctly.

How Crawlinx detects it

On HTTPS pages we scan subresource URLs (img, script, link, iframe) for http:// origins. Any insecure asset is reported with an example — browsers block or warn on these.

How common is it?

1515 audited sites in our corpus currently show this issue. The breakdowns below show which platforms, gatekeepers, verticals and countries are most exposed.

FAQ

What is mixed content?

An HTTPS page loading resources over insecure HTTP. Browsers block mixed scripts/iframes outright and flag the page as not fully secure, breaking functionality and trust.

Related guides

• Core Web Vitals: LCP, INP and CLS Explained (2026)
• HTTPS Migration SEO: A Before & After Checklist