Fix mixed content

Transport · about 15 min

In plain words

Your page is HTTPS but loads some images, scripts or styles over plain http://. Browsers block or warn, and those files can be swapped in transit.

What can go wrong

An http:// script can be replaced by an attacker to take over the page; visitors see "Not secure" warnings.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Any site

<!-- change -->
<img src="http://cdn.example.com/logo.png">
<!-- to -->
<img src="https://cdn.example.com/logo.png">

Safety net (header)

Content-Security-Policy: upgrade-insecure-requests

WordPress

Settings → General: make sure both URLs start with https://
Then run a search-replace (e.g. WP-CLI):
  wp search-replace "http://yourdomain.com" "https://yourdomain.com" --skip-columns=guid

Cloudflare

SSL/TLS → Edge Certificates → Automatic HTTPS Rewrites: On

Before you change anything: Back up the database before any search-replace.

Check that it worked

Re-run the ProbeHunt check; the browser console should show no "Mixed Content" warnings.

Re-run the free check

References

MDN: Mixed content