New format
Mixed content: HTTP on an HTTPS site and SEO
Mixed content is when a page opens over HTTPS but some resources (images, scripts, styles, iframes) load over HTTP. The browser warns and blocks active content — layout and trust break.
Below: types of mixed content, SEO impact via UX, and how to fix it. Moving to HTTPS and certificate types are in related articles; the focus here is holes after the move.
What counts as mixed content
An https://… page pulls an http://… resource. Passive: img, picture, video/audio, object subresources, fonts in CSS. Active: script, stylesheet link, iframe, some object uses.
Active is more dangerous: browsers block it more often, and it’s easier to alter page behavior via MitM on the HTTP piece.
How it hurts SEO and conversion
Warnings and blocks hurt UX: “Not secure,” empty blocks, broken forms. People leave — behavior signals and leads suffer.
Don’t confuse this with the myth that fixing mixed content alone puts you on page one. Fix the tech; rankings grow from relevance and demand, not from one padlock in the address bar.
How to find it
Open the problem page → DevTools (F12) → Console / Security: Mixed Content warnings and the URL list.
Check key templates: home, product card, cart, contacts, blog. External widgets and old absolute links in content are common culprits.
How to remove it
Replace http:// with https:// where the resource is available over HTTPS, or move the file to yourself/a CDN with TLS.
Update internal absolute links in the DB and templates. In CSS/JS hunt hard-coded http URLs. If HTTPS isn’t available — remove or replace.
Checklist after fixes:
- Console clean of mixed content on key URLs
- forms and analytics/payment scripts work
- canonical and sitemap are https-only
- no http↔https chains on internal links
Takeaways
HTTPS page + HTTP resources = mixed content.
Sources and templates first, CDN crutches second.
This is trust and UX hygiene — not a page-one button.
FAQ
Is mixed content a separate ranking factor?
There’s no direct “mixed content score.” It hurts via blocks, warnings, bounce, and messy mirror indexing. Clean HTTPS is hygiene.
How does active differ from passive?
Passive — images, video, fonts (often a warning). Active — scripts, CSS, iframes (more often blocked and higher risk).
Are relative URLs (/img/a.jpg) a problem?
Usually no: they inherit the page protocol. Absolute http:// and hard-coded URLs in CSS/JS break things.
Is an auto-replace plugin enough?
Sometimes as a crutch. More reliable: fix sources — CDN/hosting with HTTPS, update templates and content. Backup before mass edits.
Will Cloudflare Automatic HTTPS Rewrites fix everything?
It helps if the resource is actually available over HTTPS. Simple rewriting won’t save something that isn’t reachable on https.
How does it relate to SSL and the HTTPS move?
A certificate ≠ a clean page. After 301 to https, check templates for mixed content — see the HTTPS/SEO and SSL pieces.
HTTPS live — but Console still screams Mixed Content?
We’ll clean HTTP assets in templates and widgets so trust and UX match the certificate.
Discuss the task
