The home page is served over HTTPS but loads some scripts, stylesheets or frames over plain HTTP. Browsers block those files, so parts of the page can break or look wrong.
What it means
This is called active mixed content. A file sent over plain HTTP can be altered on its way to the visitor, and a script or stylesheet controls the whole page, so browsers refuse to load it. Menus, forms, tracking or the page’s design can quietly stop working.
What triggers it
Once a week the Security headers check loads the home page over HTTPS and searches its HTML for scripts, stylesheets, preloaded files, frames, embeds and objects whose address starts with http://. Any found raise this High issue, with the count and an example address, and owners and admins are alerted once by email and chat.
Only the home page’s HTML as served is checked, so other pages and files added later by scripts aren’t seen.
Common causes
- Hard-coded http:// addresses in the theme, templates or content from before the website moved to HTTPS.
- Old embed codes for widgets, maps or forms.
- A CMS whose website address setting still starts with http://.
How to fix it
- Open the home page in Chrome, press F12 and look in the Console for “Mixed Content” messages, which list each affected file.
- Change each address to https://, checking that the file loads that way. If the provider doesn’t offer HTTPS, host the file on your own website or replace it.
- In a CMS such as WordPress, make sure the website address settings use https://, then search and replace old http:// links in the database.
When it clears
The check runs weekly, so the issue disappears at the next weekly check that no longer finds the problem, and its action drops off the action plan 7 days later.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.