Mixed Content Blocked

Last updated: April 2026

Your HTTPS page is loading a resource over HTTP. Browsers block scripts and other active resources loaded over HTTP on HTTPS pages. The fix is to update the resource URL to use HTTPS, or add the upgrade-insecure-requests CSP directive.

Fix 1 — update the resource URL to HTTPS

<!-- Before -->
<script src="http://cdn.example.com/script.js"></script>
<img src="http://example.com/image.png">

<!-- After -->
<script src="https://cdn.example.com/script.js"></script>
<img src="https://example.com/image.png">

Fix 2 — upgrade-insecure-requests CSP directive

Automatically upgrades all HTTP resource requests to HTTPS. Only works if the resource actually exists on HTTPS.

# Nginx
add_header Content-Security-Policy "upgrade-insecure-requests" always;

# vercel.json
{ "key": "Content-Security-Policy", "value": "upgrade-insecure-requests" }

# HTML meta tag
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Fix 3 — protocol-relative URLs

<!-- Inherits protocol from the page -->
<script src="//cdn.example.com/script.js"></script>

Find all mixed content on your page

# Check browser console for all mixed content warnings
# Or use curl to find HTTP resources in your HTML:
curl -s https://yoursite.com | grep -o 'http://[^"]*'

WordPress mixed content

# Update all HTTP URLs in the database:
UPDATE wp_options SET option_value = replace(option_value, 'http://yoursite.com', 'https://yoursite.com');
UPDATE wp_posts SET post_content = replace(post_content, 'http://yoursite.com', 'https://yoursite.com');
UPDATE wp_postmeta SET meta_value = replace(meta_value, 'http://yoursite.com', 'https://yoursite.com');