Mixed content: HTTP assets on an HTTPS page

The site is on HTTPS. Somewhere in the HTML an image, script, stylesheet, or iframe still starts with http://. The browser calls that mixed content. Active mixed content (scripts, iframes) is often blocked. Passive mixed content (images) may load with a warning, or fail, depending on the browser.

This is a different bug from a 404. The file can exist. The scheme is wrong. Users see a broken padlock or a hole where the picture was.

How it survives

• Old WYSIWYG pastes
• CDN URLs copied from an email in 2018
• Canonical or og:image still on http://
• Third-party widgets that never got the SSL memo

Find it

DevTools Security panel catches some of it. A link checker that flags insecure HTTP on the same report as 404s is faster on a messy page: you see the href or src, highlight the node, fix the scheme or the host. That is a first-class filter in Advanced Broken Links Search, next to broken images.

Rewrite to https:// when the host supports it. If it does not, drop the asset or replace the vendor. Do not “fix” mixed content with a 302 from HTTP to HTTP.

A mixed-content warning is not a soft 404. It is a transport mismatch. Same scan, different column.