Run an audit

Fix library · Security

Secure pages loading insecure files

The page is served securely, but something on it — an image, a stylesheet, a script — is still being fetched over plain http. Browsers respond by blocking the file or downgrading the padlock, so the symptom is often a missing logo or a feature that stopped working rather than an obvious security warning.

Security High at worst 1 finding covered

High

Insecure files on secure pages

What SEOPert detected

A secure page loads at least one file over insecure http.

What this means

Your secure (https) pages load some files over insecure http. Browsers may block them or show a “not secure” warning.

How to fix it

  1. Change the listed http:// image, script or style addresses to https://.
  2. If you use WordPress, a search-and-replace of http://yourdomain to https://yourdomain in the database usually fixes it.
On WordPress
  1. Make sure both addresses under Settings → General use https://.
  2. Use a search-and-replace plugin to replace http://yourdomain.com with https://yourdomain.com across the database (take a backup first).

If you are handing this to a developer

Serve every subresource over HTTPS; replace http:// src/href references on the listed URLs.

Check it worked. Open each listed page, press F12 and look at the Console: there should be no “Mixed Content” warnings.

Find what breaks the padlock A 30-second exercise. One line is the problem — see whether you would catch it.

Related

Read next

HTTPS: the padlock, and why browsers insist on it Security Sending every visitor to the secure version Security Four headers worth asking your host about Security

Check your own site

See which of these apply to you.

The free audit checks up to 10 pages and tells you exactly what it found, in the same plain language as these guides. No account, no card.

Free · No account · Results in under a minute · Public websites only