Mixed content

What this check looks for

Checks whether an HTTPS page loads any resources (images, scripts, styles, iframes) over insecure http.

Why it matters

When a secure page pulls in http assets, browsers either block them or flag the page as not fully secure, breaking the padlock and sometimes the layout or functionality. Active mixed content like scripts is blocked outright because it can be tampered with in transit. Serving every resource over https keeps the page secure and avoids console warnings that erode user trust.

How to fix it

<!-- Change http:// asset URLs to https:// (or protocol-relative // ) -->
<img src="https://cdn.seosnapshot.dev/chart.png" alt="Chart">
<script src="https://cdn.seosnapshot.dev/app.js" defer></script>

<!-- Or have the browser auto-upgrade insecure requests via CSP header/meta -->
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Go deeper

• Security headers for SEO →