HTTPS and Mixed Content: SEO and Security Fix Guide

Mixed content is an HTTPS page that loads some resources, such as images, scripts or stylesheets, over insecure HTTP. Browsers may upgrade or block those requests, so pages can break or show warnings. Fix it by finding every HTTP reference, changing it to HTTPS at the source, and permanently redirecting the old HTTP URLs.

The 2024 HTTP Archive Web Almanac security chapter reports 95.6% of mobile home pages using HTTPS, up from 89% in 2022, so a site still serving HTTP, or half-serving it, now stands out.

I see mixed content most often after a site has “moved to HTTPS” in a hurry. The certificate is installed, the padlock appears on the homepage, and everyone assumes the job is finished. Then an old blog post still pulls an image from an http:// address, a theme loads a script from a hard-coded URL, and visitors see warnings or broken layouts. This guide covers how to find those leftovers, fix them properly, and handle certificates, HSTS and the migration itself.

Does HTTPS matter for SEO?

HTTPS belongs in the basics, but I would not sell it to you as a ranking lever. Google’s page experience documentation lists serving pages securely among the aspects of a good page experience, and it is explicit that Core Web Vitals and the wider page experience picture matter more than any single item on that list. The practical SEO reasons to run HTTPS are different.

Canonical choice. When both HTTP and HTTPS versions of a page exist, Google’s guidance on consolidating duplicate URLs says it prefers HTTPS as a natural canonicalisation signal. Leaving both live still creates duplicates you have to manage.
Trust and conversion. Browsers label insecure pages, and a warning on a checkout or enquiry form costs you leads long before any ranking effect.
Data integrity. Without encryption, a network between you and the visitor can alter what they receive, including injecting adverts or scripts.

So treat HTTPS as a requirement for a credible site, and mixed content as the quality check that proves you did the job properly.

What mixed content is, and what browsers do with it

A page has mixed content when its HTML arrives over HTTPS but some of the resources it uses arrive over HTTP. Google’s web.dev guide on what mixed content is splits it into two kinds, and the difference decides how urgent the fix is.

Type	Examples	What browsers do today	My priority
Passive (display) mixed content	Images, video, audio	Chrome automatically upgrades these to HTTPS where a secure version exists; otherwise the resource may fail to load or trigger a warning	Fix soon: broken images and trust warnings
Active mixed content	Scripts, stylesheets, iframes	Blocked by default	Fix first: layout, menus, forms or tracking can silently stop working

The SEO angle is indirect but real. A blocked stylesheet or script can change what Googlebot renders. A missing image removes a signal from an image-led page. A scary warning on a landing page wastes the visit you worked to earn. If you want to understand how rendering problems affect indexing, my guide to what rendering means in SEO explains the mechanism.

Rather have an expert do this for you?

Hand it over and get back to running your business.

Hand it over to me

How to find mixed content: a five-step process

Do not rely on one tool. Each method catches things the others miss.

Open the browser’s developer tools. In Chrome the Issues tab lists mixed content on the current page and records when the browser upgraded or blocked a request. This is the quickest check for your key templates: home page, a post, a product or service page, the contact page, and the checkout if you have one.
Crawl the site. Run a crawler over the HTTPS version and filter for any resource URLs that begin with http://. This is how you find the one forgotten image in a post from three years ago.
Search the source. On WordPress, search the database and theme files for http://yourdomain and for hard-coded third-party URLs. Page builders and widgets often store absolute URLs in their own settings tables.
Check Search Console. Search Console includes an HTTPS report that shows which URLs Google found on HTTPS and which it did not. It will not list every mixed resource, but it shows whether the HTTP versions are still being picked up.
Test after every change. Plugins, theme updates and new embeds reintroduce HTTP URLs. Re-test your template pages after any update that touches the front end.

How to fix mixed content at the source

The correct fix is to change the URL that is being requested. Hiding the warning is not a fix. Work through the likely sources in this order.

Your own content and database

Old posts store absolute image URLs. Update them to HTTPS or, better, to relative paths. On WordPress, use a search and replace tool that handles serialised data safely, and take a full backup first, because a careless find and replace on serialised values can corrupt settings.

Theme, plugins and page builders

Check for hard-coded http:// links in header and footer templates, custom CSS (background images are a classic miss), font files and widget settings. If a plugin outputs HTTP URLs after you have fixed the site address in settings, it is worth reporting or replacing.

Third-party resources

Where an external provider offers an HTTPS address, switch to it. If the provider only supports HTTP, host the file yourself if the licence allows, or drop it. A resource that cannot be served securely does not belong on a secure page.

A stopgap, not a cure

A Content Security Policy can instruct browsers to upgrade insecure requests automatically. It can buy you time on a large legacy site, but it depends on the HTTPS version of each resource actually existing, and it leaves the wrong URLs sitting in your content. Use it while you clean up, then remove the dependency.

Certificates, redirects and HSTS

Mixed content is the content problem. The next layer is configuration, and I check three things when I audit a site.

Certificate health. The certificate must cover every hostname you use (with and without www, and any subdomains serving assets), be unexpired, and be delivered with a complete chain. An expired or mismatched certificate triggers full-page browser warnings that stop visitors and crawlers, which is far worse than a stray image. Set automated renewal and a calendar reminder as a backup.
HTTP to HTTPS redirects. Every HTTP URL should return a permanent redirect to its HTTPS equivalent in a single hop. If HTTP goes to HTTPS and then to www and then to a trailing-slash version, you have created a chain, which my guide on redirect chains and loops shows how to flatten. For what a 301 signals and when to use it, see HTTP status codes for SEO.
HSTS. The Strict-Transport-Security header tells browsers to use HTTPS for your domain without first trying HTTP. It is a sensible hardening step once everything works on HTTPS. Start with a short duration, confirm nothing breaks, and extend gradually. Be careful with subdomain and preload options, because they are hard to undo if one subdomain cannot serve HTTPS.

Moving a site from HTTP to HTTPS safely

If your site is still on HTTP, this is a migration, and it deserves the same discipline as any other. The full planning list is in my website migration SEO checklist. The HTTPS-specific sequence is below.

Step	What to do	Why it matters
1. Install and test	Install the certificate and test pages on a staging copy first	Finds mixed content before visitors do
2. Update references	Change internal links, canonical tags, hreflang and structured data URLs to HTTPS	Keeps every signal pointing at the same version
3. Redirect	301 every HTTP URL to its exact HTTPS match, not just to the home page	Passes the old URL’s signals to the new one
4. Update the sitemap	List only HTTPS URLs, and no parameter or redirected addresses	Helps Google discover the preferred versions
5. Verify in Search Console	Use a property that covers the HTTPS version and watch coverage and the HTTPS report	Shows whether Google has switched over
6. Monitor	Re-crawl weekly for a month, checking for stray HTTP resources and redirect chains	Catches regressions from plugins and edits

Do not block the HTTP URLs in robots.txt while the redirects are in place. Google needs to crawl the old addresses to see the redirects, and blocking them also stops it reading any canonical or noindex tag on them, a conflict explained in noindex vs canonical vs robots.txt. Also keep an eye on tracking and filter addresses, since URL parameters can quietly keep HTTP versions in circulation through old campaign links. I make no promise about how quickly rankings settle, because that depends on the size of the site and its history, but a clean one-hop redirect map removes the avoidable delays.

If you run WordPress, the secure-site checks sit inside my WordPress technical SEO checklist, and a wider technical review is part of technical SEO services.

Common mistakes I see

Fixing only the homepage and assuming the templates are identical elsewhere.
Leaving HTTP canonical tags or sitemap entries after the redirect is live.
Using a “force HTTPS” plugin that redirects in the browser rather than at the server, adding delay and extra hops.
Embedding an old HTTP-only widget on a checkout page.
Forgetting subdomains or a CDN hostname that serves images.

Questions about HTTPS and mixed content

Is mixed content a ranking factor?

I am not aware of Google describing mixed content as a ranking factor in itself. The damage is indirect: blocked resources can change how a page renders, warnings reduce trust and conversions, and a half-finished migration leaves duplicate HTTP and HTTPS URLs to manage.

Why is the padlock missing when I have a certificate?

Usually because the page loads at least one resource over HTTP, or the certificate does not cover the hostname being used. Check the browser developer tools for the exact URL, then fix that reference at its source.

Do I need HSTS?

You do not need it for a page to work, but it removes the insecure first request and is a sensible extra once your HTTPS setup is stable. Introduce it gradually with a short duration first, and avoid preload settings until every subdomain supports HTTPS.

Should HTTP URLs redirect with a 301 or a 302?

Use a permanent 301 redirect, because the move to HTTPS is not temporary. Redirect each URL to its exact HTTPS equivalent in one step.

If you would rather have someone check every template, certificate and redirect for you, request a free audit and I will tell you what is worth fixing first.

More in this series (Technical SEO in depth): start with WordPress Technical SEO Checklist: What to Fix First, then explore: