What Is Mixed Content?
What mixed content means
Mixed content occurs when a web page loads over HTTPS but also requests some resources, such as scripts, images or stylesheets, over plain HTTP. The page itself is protected, but the insecure resources are not, so someone on the network can read or change part of the page.
A typical case is a secure page that embeds an image from an HTTP address, or a script loaded from an old unencrypted URL. The site owner may not notice, because the page still appears to work in the browser.
Active and passive mixed content
Browsers split mixed content into two groups. Passive mixed content covers resources such as images, audio and video. An attacker on the network could swap these for different media, which is a real risk, but the impact on the page as a whole is smaller.
Active mixed content covers scripts, stylesheets, iframes and requests made by code. These can change how the page behaves, read data or submit forms, so the risk is much higher. Browsers block active mixed content by default.
Browsers have handled passive mixed content differently over time. They may warn about it, or upgrade the request to HTTPS automatically when the same resource is available there. A page that loads an insecure image may still display, but with a warning or without the padlock.
Why mixed content removes the padlock
The padlock tells visitors that the connection is encrypted. When insecure resources are present, browsers may show a warning sign instead, and some remove the padlock entirely. Visitors can then distrust a site even when its main pages are properly secured.
Mixed content also leaves a gap in what HTTPS promises. Protection for the connection to the main page does not extend to resources loaded over HTTP, so the page is only as secure as its weakest resource. Policies such as HSTS help keep a whole site on HTTPS, which reduces the chance of new insecure references.
Blocking active mixed content can also break features. A script that fails to load may stop a form or menu from working, so visitors see a broken page rather than a warning. Site owners usually discover these problems in the browser console or in testing tools. The certificate error messages that browsers show are a separate matter, although both affect trust.
Frequently asked questions
Does mixed content mean my site has been hacked?
No. Mixed content is a configuration problem, not a sign of an attack. It usually happens when a site references an HTTP address, often after moving to HTTPS or after adding a third-party script or image. It still matters, because an attacker on the network could alter those resources.
Will the padlock always disappear with mixed content?
It depends on the browser and the type of resource. Active mixed content is usually blocked, which can break the page. Passive mixed content often triggers a warning, and some browsers upgrade the request automatically. Results vary, so the safe assumption is that visitors may see a warning. The basics of HTTPS explain what the padlock is meant to show.