Try it yourself
This page is served over https, but the browser shows a warning instead of a clean padlock. Four things the page pulls in or points at.
Which one breaks the padlock?
-
A relative path inherits the page's own protocol, so this loads over https automatically. Relative paths are the easiest way to never have this problem.
-
Loaded from somewhere else, but over https. Perfectly fine — mixed content is about the protocol, not the domain.
-
This is the one. An insecure script loaded into a secure page. Browsers block it outright, so the slider silently stops working — and a script is the most dangerous kind, because anyone between the visitor and that server could swap it for their own code.
-
A link is not mixed content. Nothing is being loaded into this page — the visitor only travels to an insecure site if they click. Worth fixing for their sake, but it is not what the browser is complaining about.
Pick a line. Every one of them has an answer.
Show me the answer
<script src="http://scripts.example/slider.js">
This is the one. An insecure script loaded into a secure page. Browsers block it outright, so the slider silently stops working — and a script is the most dangerous kind, because anyone between the visitor and that server could swap it for their own code.
The written version
Secure pages loading insecure files →
How to check your own site for this, what to change, and how to confirm it worked.
Now the real thing
Run this check on your own site.
The same check, plus twenty-nine others, against your actual pages. Free, no account, about a minute.