Fix library · Security
Secure pages loading insecure files
The page is served securely, but something on it — an image, a stylesheet, a script — is still being fetched over plain http. Browsers respond by blocking the file or downgrading the padlock, so the symptom is often a missing logo or a feature that stopped working rather than an obvious security warning.
Insecure files on secure pages
What SEOPert detected
A secure page loads at least one file over insecure http.
What this means
Your secure (https) pages load some files over insecure http. Browsers may block them or show a “not secure” warning.
How to fix it
- Change the listed http:// image, script or style addresses to https://.
- If you use WordPress, a search-and-replace of http://yourdomain to https://yourdomain in the database usually fixes it.
On WordPress
- Make sure both addresses under Settings → General use https://.
- Use a search-and-replace plugin to replace http://yourdomain.com with https://yourdomain.com across the database (take a backup first).
If you are handing this to a developer
Serve every subresource over HTTPS; replace http:// src/href references on the listed URLs.
Check it worked. Open each listed page, press F12 and look at the Console: there should be no “Mixed Content” warnings.
Related
Check your own site
See which of these apply to you.
The free audit checks up to 10 pages and tells you exactly what it found, in the same plain language as these guides. No account, no card.