Mixed Content

Mixed content occurs when a page delivered over HTTPS requests subresources over insecure HTTP. Browsers split it into two classes: active content such as scripts, stylesheets and iframes, which is blocked, and passive content such as images, audio and video, which browsers now generally upgrade to HTTPS or block.

Why it matters

An attacker on the network can alter an insecure script and take over the whole page, which cancels the benefit of HTTPS. Blocked resources also cause visible breakage: missing layouts, broken sliders, absent fonts, and a console message such as "Mixed Content: The page was loaded over HTTPS, but requested an insecure script".

It tends to appear after a migration to HTTPS, when old posts, theme settings or database content still contain hard-coded http:// URLs.

Example

Find offenders and fix the source rather than relying on a patch:

grep -rn "http://" wp-content/themes/mytheme/

Use protocol-safe or relative URLs, and as a safety net add:

Content-Security-Policy: upgrade-insecure-requests

This asks browsers to rewrite insecure subresource URLs to HTTPS, which only works if the HTTPS version exists.

Common mistakes

• Relying on upgrade-insecure-requests while the third-party host has no HTTPS.
• Fixing templates but leaving old database content untouched.
• Forgetting CSS url() references and inline scripts.

Related

• HTTPS
• CSP
• HSTS
• गाइड: Fix mixed content

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.