Mixed content warnings: how to find and fix insecure resources
Mixed content means a secure page loads files over plain HTTP. Browsers block or warn on it. Find every insecure image, script or stylesheet and fix it.
2 min read
Area
Trust & policies
Severity
High
Fix effort
Small
Stores failing
1%
Of 180 stores we scanned where this check applies, 1% fail it and 99% pass. See all benchmarks.
Mixed content is a page served over HTTPS that still loads some files, such as images, scripts or fonts, over plain HTTP. Browsers may block these files or show a security warning, which can break features and cost shoppers' trust at checkout.
Why it matters
A store can have a valid certificate and still look unsafe. One image requested over HTTP is enough for some browsers to drop the padlock. Scripts loaded insecurely are blocked outright, which can switch off a feature without any visible error.
It usually appears after a migration, when old content still references http:// addresses.
What the audit looks at
The audit lists any files a secure page loads over plain HTTP.
What usually causes it
- Blog posts or product descriptions with images added using http:// addresses
- Theme code with hard-coded http:// links to fonts or scripts
- Third-party embeds that have not moved to HTTPS
- Content imported from an older version of the store
How to fix it
Repoint the assets still loading over HTTP. The effort is small, usually a setting or a paste and under 30 minutes.
- Find them in the browser console, which names each blocked or insecure request.
- Change http:// to https:// in theme code and in any content field holding a pasted image URL.
- Mixed content removes the padlock even though the page itself is encrypted.
How to check it yourself
- Open Chrome DevTools and look in the Console for "Mixed Content" messages.
- In the Network tab, filter by "http:" to list requests that are not secure.
- Search your theme and content for "http://" to find the source.
Frequently asked questions
Will browsers block mixed content?
Modern browsers block insecure scripts and frames and often upgrade or warn about insecure images. The result varies, which is why it is worth fixing everywhere.
How do I fix hundreds of old links?
Many platforms and plugins offer a search and replace across content that changes http:// to https:// for your own domain. Take a backup first.
Related checks
Check your own store
See whether your store passes this check
Paste your store URL. The audit loads your pages in a real browser and shows the result for this check with the evidence behind it.