Mixed content: HTTP resources on an HTTPS page

In brief

A mixed content alert flags that resources (images, scripts, styles) load over HTTP on an HTTPS page: the security padlock breaks and browsers may block those elements. Switch the affected URLs to HTTPS or to relative URLs.

WarningP1 — Direct ranking

What is it?

Resources (images, scripts, styles) are loaded over HTTP on an HTTPS page.

Why it hurts SEO and AI

Browsers block or flag these resources: broken padlock, missing elements, eroded user trust. Google prefers fully secure pages. Often an absolute URL forgotten in content or a template.

When it is NOT a problem

  • It is an href hyperlink over HTTP (not a loaded resource): a link is not mixed content.
  • The resource comes from a third-party domain you do not control that already auto-redirects to HTTPS.
  • The HTTP call is in a comment or dead code the page never runs.
Before
<img src="http://cdn.example.com/logo.png">
<script src="http://cdn.example.com/app.js"></script>
After
<img src="https://cdn.example.com/logo.png">
<script src="https://cdn.example.com/app.js"></script>

A plain https is enough; for internal assets, a relative URL (/assets/...) avoids hard-coding the protocol.

How to fix it

  1. Open the browser console: it lists every mixed resource that is blocked or flagged.
  2. Find where the HTTP URLs come from: CMS content, template, or a third-party script.
  3. Switch those URLs to HTTPS, or to relative URLs for internal assets.
  4. Reload the page and confirm the padlock is intact and no resource is blocked.

This scan checks technical compliance: viewport, charset, HTTPS, hreflang

Is this issue on your site?

Is a secure page still loading resources over HTTP? Enter a URL: Seogard inspects your pages and spots mixed content that breaks the padlock. Free, no credit card.

By clicking Scan, I certify that I own this site or have permission to crawl it.

  • No credit card
  • Result in ~30 s

What you get back

The padlock comes back, and no resources are blocked by the browser.

Seogard catches this regression automatically — through its continuous SEO monitoring.

Frequently asked questions

Does mixed content really hurt my rankings?

The direct ranking impact is small, but a broken padlock erodes visitor trust and mixed scripts are outright blocked, which can break page features.

What is the difference between active and passive mixed content?

Active resources (scripts, iframes) are blocked by default by browsers; passive ones (images) load but mark the page as not fully secure.

Related rules

Page redirectedA page still declared in your sitemap has started redirecting to another URL: the sitemap presents an address that bounces as canonical. Intentional removal — take it out of the sitemap; otherwise, often a broken route. A page that is redirected AND removed from the sitemap is a clean removal: no alert. JavaScript redirectThe page responds 200 but its JavaScript redirects the browser elsewhere. Google only follows it after rendering (delayed, or never if rendering fails) and AI systems read the original HTML, not the destination: machines and humans see two different pages. Broken redirectA cleanly removed page (redirect + removed from the sitemap) now returns a 4xx error: its redirect broke. Link equity from backlinks pointing to the old URL is no longer passed — typically a refactor that deleted the redirect rule or its target.

Updated July 10, 2026