Glossary · Security

Mixed Content

Mixed content is an HTTPS page that loads some resources, such as scripts or images, over plain HTTP, weakening or breaking its security.

Updated November 4, 2026

Mixed content occurs when a page delivered over HTTPS requests subresources over insecure HTTP. Browsers split it into two classes: active content such as scripts, stylesheets and iframes, which is blocked, and passive content such as images, audio and video, which browsers now generally upgrade to HTTPS or block.

Why it matters

An attacker on the network can alter an insecure script and take over the whole page, which cancels the benefit of HTTPS. Blocked resources also cause visible breakage: missing layouts, broken sliders, absent fonts, and a console message such as "Mixed Content: The page was loaded over HTTPS, but requested an insecure script".

It tends to appear after a migration to HTTPS, when old posts, theme settings or database content still contain hard-coded http:// URLs.

Example

Find offenders and fix the source rather than relying on a patch:

grep -rn "http://" wp-content/themes/mytheme/

Use protocol-safe or relative URLs, and as a safety net add:

Content-Security-Policy: upgrade-insecure-requests

This asks browsers to rewrite insecure subresource URLs to HTTPS, which only works if the HTTPS version exists.

Common mistakes

  • Relying on upgrade-insecure-requests while the third-party host has no HTTPS.
  • Fixing templates but leaving old database content untouched.
  • Forgetting CSS url() references and inline scripts.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min readGuide · SSL & SecurityHTTP Security Headers Guide: HSTS, CSP, Referrer-Policy and MoreA practical guide to HSTS, CSP, X-Content-Type-Options, frame-ancestors, Referrer-Policy and Permissions-Policy, with nginx, Apache and Express examples.8 min readGlossary · SecurityCSP (Content Security Policy)Content Security Policy is an HTTP header that lists which sources a page may load scripts, styles and other resources from, limiting the damage of XSS attacks.Glossary · SecurityHSTS (HTTP Strict Transport Security)HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.Glossary · SecurityMan-in-the-Middle Attack (MITM)A man-in-the-middle attack places an attacker between two parties so they can read or alter traffic that both sides believe is private.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.