The home page is served over HTTPS but loads some images, video or audio over plain HTTP. Browsers then drop the padlock or the file, which looks broken or untrustworthy to visitors.
What it means
This is called passive mixed content. Images and media can’t take over the page the way scripts can, so browsers are less strict: most try the file over HTTPS instead and show it broken if that fails, while others load it and remove the padlock.
What triggers it
Once a week the Security headers check loads the home page over HTTPS and searches its HTML for images, video, audio and icons whose address starts with http://. Any found raise this Medium issue, with the count and an example address. It shows in the app and isn’t emailed.
Only the home page’s HTML as served is checked, so other pages and files added later by scripts aren’t seen.
Common causes
- Images added to pages or posts before the website moved to HTTPS.
- A logo, icon or background with a hard-coded http:// address in the theme.
- Images linked directly from another website that doesn’t support HTTPS.
How to fix it
- Open the home page in Chrome, press F12 and look in the Console for “Mixed Content” messages, which list each affected file.
- Change each address to https://, or upload the file to your own website and link to that copy.
- In a CMS such as WordPress, make sure the website address settings use https://, then search and replace old http:// links in the database.
When it clears
The check runs weekly, so the issue disappears at the next weekly check that no longer finds the problem, and its action drops off the action plan 7 days later.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.