SEO

Mixed Content

Q: What is mixed content?

Mixed content arises when an HTTPS page loads resources (images, scripts, iframes) over HTTP. Browsers display warnings or block the resources. HTTPS pages with mixed content appear insecure to users and search engines alike.

Q: Why is mixed content relevant to SEO?

Indirectly, through trust and user experience. Browsers mark pages with mixed content as ”not secure”, which increases the bounce rate. Google does not apply direct penalties, but trust signals are compromised.

Q: How do you fix mixed content?

By rewriting URLs from http to https. A content search and replace in the database; protocol-relative URLs (//example.de/bild.jpg) avoid problems. The Content Security Policy directive upgrade-insecure-requests offers additional protection.

Q: Where do you check for mixed content?

Chrome DevTools under the ”Security” tab shows mixed-content warnings. In addition: reports in the GSC or tools such as whynopadlock.com. The Rankmio SEO audit flags mixed-content URLs in the site audit.

Also known as: Mixed Content, Mixed HTTPS connection, Insecure Resources

Mixed content occurs when a page delivered over HTTPS loads individual resources (images, JavaScript, CSS, iframes) over unencrypted HTTP. This compromises the security of the HTTPS wrapper: an attacker could swap out the HTTP resources on the fly. Browsers have therefore applied ever stricter mixed-content policies for years: since 2020 Chrome has automatically blocked insecure scripts, and later images, iframes and audio as well. For SEO, mixed content is both a ranking risk (page experience) and a visibility risk (broken page functions).

The two classes of mixed content

Active mixed content — JavaScript, CSS, iframes, web fonts. Maximally security-critical and automatically blocked in modern browsers.
Passive mixed content — images, audio and video as an <img> tag. Lower risk (not scriptable), often still permitted, but with a warning in the DevTools console.

Mixed-content audit

Workflow for the diagnosis: (1) Chrome DevTools → ”Security” tab → shows all mixed-content findings per URL. (2) Lighthouse → includes a mixed-content audit. (3) Crawler-based site audits (Rankmio, Screaming Frog, Sitebulb) search the entire domain for mixed content. (4) Search Console → ”Security issues” report. On large sites: fix the problem at source per CMS template rather than URL by URL.

Common sources of mixed content

Hardcoded HTTP URLs in CMS content — historically overlooked during the migration step to HTTPS.
External image embeds on old CDNs or image sources without HTTPS support.
Iframes from third-party widgets without an HTTPS variant.
Advertising iframes from small networks without HTTPS.
WordPress plugins that hardcode resource URLs.
Theme templates with HTTP URLs in CSS background images.

Example from practice

Example: A magazine migrated to HTTPS in 2022 but had mixed content on 320 older articles because of hardcoded HTTP image URLs from the CMS editor. Browsers showed warnings in DevTools, and from Chrome 86 onwards some images increasingly failed to load — articles had broken images. Clean-up: an SQL update across all article content (http://example.de/wp-content/ → /wp-content/ as relative URLs). After the clean-up there were no further mixed-content findings, the images were fully visible, and page speed values improved measurably because fewer requests were blocked. A classic loose end left over from a migration.

Frequently asked questions

What is mixed content?

Mixed content arises when an HTTPS page loads resources (images, scripts, iframes) over HTTP. Browsers display warnings or block the resources. HTTPS pages with mixed content appear insecure to users and search engines alike.

Why is mixed content relevant to SEO?

Indirectly, through trust and user experience. Browsers mark pages with mixed content as ”not secure”, which increases the bounce rate. Google does not apply direct penalties, but trust signals are compromised.

How do you fix mixed content?

By rewriting URLs from http to https. A content search and replace in the database; protocol-relative URLs (//example.de/bild.jpg) avoid problems. The Content Security Policy directive upgrade-insecure-requests offers additional protection.

Where do you check for mixed content?

Chrome DevTools under the ”Security” tab shows mixed-content warnings. In addition: reports in the GSC or tools such as whynopadlock.com. The Rankmio SEO audit flags mixed-content URLs in the site audit.

Used in Rankmio for

Mixed-content check in the SEO audit

Go to the feature →

Last updated: 2026-06-17 · Browse all glossary entries