Mixed content warnings
Parts of your own site, including your logo, load insecurely and can be blocked by the visitor's browser.
How to see it yourself, in a minute
- Open your site over https and look at the address bar: a padlock that is missing, grey or marked with a warning triangle is this fault.
- Right-click the page, Inspect, then the Console tab: lines saying “Mixed Content” name the exact files.
- Often it is the logo, a slider image or an old Google Maps embed.
Or paste your address into the free audit, which checks this and seventeen other faults in ten seconds.
Why it matters
A secure page that pulls in insecure images, scripts or styles gets downgraded by the browser: the padlock disappears, some elements are silently blocked, and the layout breaks in ways you never see on your own machine.
The site is nominally secure but the browser downgrades it: the padlock disappears, some images and scripts are silently blocked, and layouts break in ways you never see on your own machine because your browser has cached the old files. Google treats a page with blocked content as a lower-quality page.
How we fix it
We find every insecure reference in the templates, content and stylesheets, correct them, and add a policy header so a new one can never sneak back in.
- List every insecure reference in templates, content, stylesheets and scripts.
- Correct them to https, or to relative links so it can never happen again.
- Add a Content-Security-Policy header that upgrades any stragglers automatically.
- Retest in a private window on a phone, where the effect is most visible.
How long: Usually a half day.
Questions people ask about this
- The site looks fine to me.
- Your browser has the old files cached and often shows a page other people do not get. Test in a private window or on a phone that has never visited the site.
- It is only the logo.
- The logo is the element every visitor sees first, and one blocked file is enough to remove the padlock from the whole page.
- We use an old embedded map.
- Old map embeds are the most common single cause. The embed code is replaced with the current version in a few minutes.
People usually find this page by searching
- “mixed content website fix”
- “padlock missing on my website”
- “images not loading https”
Has your site got it?
Paste your address. This and seventeen other faults, checked in seconds.
Free, on screen in about ten seconds, no call. We fetch your homepage once, the way a visitor's browser does, and nothing else.
Or fix the lot at once
If the audit finds five or more, a rebuild is usually cheaper than five fixes. Prices are on the page.