# Mixed-content

_Source: https://seomatrix.ai/tools/mixed-content/_

---

## What it does

Mixed content is when a page served over HTTPS loads some of its resources — scripts, stylesheets, images, fonts or iframes — over insecure HTTP, which browsers block or flag and which strips the padlock from the address bar. This checker fetches an HTTPS URL and lists every http:// resource it pulls in, so you can pinpoint what breaks the secure connection. It matters because a broken padlock and "Not secure" warnings erode the trust signals search and AI engines weigh when deciding whether a page is safe to surface and cite.

## What it checks

- **Active mixed content** — Scripts, iframes and XHR/fetch requests loaded over http on an HTTPS page; browsers hard-block these, so whatever they power simply stops working.
- **Passive mixed content** — Images, video and audio referenced over http; modern browsers auto-upgrade them to https — if that succeeds the page stays fully secure, and if no https version exists the resource is blocked and fails to load (a broken image). Passive http content that a browser doesn't upgrade is what leaves the page not fully secure.
- **Padlock / security state** — The browser marks the page "Not secure" or shows a broken padlock the moment a single http resource loads, regardless of how much of the page is HTTPS.
- **Hardcoded http:// URLs** — Absolute links in the HTML, CSS or inline scripts pinned to http instead of https or a relative path — the usual root cause of the warning.
- **Third-party embeds** — Widgets, ad and analytics tags, or CDN assets from external hosts that still serve over http and drag the whole page out of a secure state.
- **Upgradeable resources** — Assets that are also available over https, where switching the scheme (or using a protocol-relative // path) is a one-line fix.

## How to use it

1. Paste your HTTPS page URL into the checker and run the scan.
2. Review the flagged http:// resources, grouped by type — deal with scripts and iframes first, since browsers block those outright.
3. Fix each one by switching its URL to https:// (or a protocol-relative // path), then re-scan to confirm the padlock is restored.

## FAQ

### What is mixed content?

Mixed content is an HTTPS page that loads some of its resources — scripts, images, styles — over insecure HTTP; the browser treats the page as only partly secure and removes the padlock.

### Why is the padlock gone, or why does my HTTPS site say "Not secure"?

Usually a single http resource on an otherwise HTTPS page is the cause; the browser downgrades the security indicator until every subresource loads over https.

### Does mixed content hurt SEO?

Indirectly, yes — active mixed content is blocked so features break, "Not secure" warnings raise bounce, and a page that fails HTTPS trust checks is a weaker candidate for ranking and for being cited by AI search.

### How do I fix mixed content?

Change each flagged http:// URL to https:// — most hosts already serve the same asset over https — or use a protocol-relative // path; for assets with no HTTPS version, self-host them or drop them.