Your page loads partially or not at all. Scripts fail, styles are missing, and the browser shows security warnings. The cause may be mixed content: resources loaded over HTTP on an HTTPS page. This guide explains why mixed content blocks page load and how to fix it.
What mixed content is
Mixed content happens when an HTTPS page loads resources over HTTP. Browsers treat this as a security risk and may block the resource entirely.
Types of mixed content:
— active: scripts, stylesheets, iframes, fonts;
— passive: images, video, audio.
Active mixed content is blocked by default in modern browsers. Passive mixed content may trigger warnings but is usually loaded.
Why mixed content blocks page load
Browsers block active mixed content to prevent attacks. If a script is loaded over HTTP, an attacker could modify it and compromise the page.
What happens:
— browser detects HTTP resource on HTTPS page;
— resource is blocked;
— script or style does not load;
— page functionality breaks;
— user sees a warning or broken page.
In severe cases, the entire page may fail to load if critical scripts or styles are blocked.
Reason 1: hardcoded HTTP in templates
The most common cause. Templates, widgets or custom code contain hardcoded HTTP URLs.
What to check:
— template files for http://;
— widget settings;
— custom code;
— database content.
The fix: replace http:// with https:// or protocol-relative URLs.
Use mixed content checker to find insecure resources.
Reason 2: third-party scripts over HTTP
Third-party scripts, widgets or embeds may be loaded over HTTP.
What to check:
— third-party script URLs;
— widget settings;
— embed code.
The fix: use HTTPS versions of third-party resources. If the provider does not support HTTPS, replace or remove the resource.
Reason 3: CDN or proxy rewrites URLs
A CDN or proxy may rewrite URLs to HTTP, causing mixed content.
What to check:
— CDN settings;
— proxy configuration;
— X-Forwarded-Proto header.
The fix: configure CDN or proxy to use HTTPS. Pass X-Forwarded-Proto to the application.
Reason 4: dynamically loaded content
JavaScript may load resources over HTTP after page load. These resources can be blocked.
What to check:
— JavaScript code;
— AJAX requests;
— dynamically added resources.
The fix: update JavaScript to use HTTPS. Check all dynamic resources.
Reason 5: forms submitting over HTTP
Forms that submit over HTTP are blocked or trigger warnings.
What to check:
— form action URLs;
— protocol;
— redirects.
The fix: use HTTPS for all form submissions.
How to diagnose mixed content
A practical sequence:
— check browser console for mixed content warnings;
— check Network tab for HTTP resources;
— check templates and database;
— check third-party scripts;
— check CDN settings;
— check forms.
If resources are blocked, the console shows errors. For a broader audit, SEO audit can help verify SSL, mixed content and security headers in one place.
How to fix mixed content
Fix steps:
— replace http:// with https://;
— update third-party scripts;
— configure CDN for HTTPS;
— update JavaScript;
— fix forms;
— test after changes.
FAQ
Why does mixed content block page load?
Browsers block active mixed content (scripts, styles) to prevent attacks. If critical resources are blocked, the page may not load correctly.
What is active vs passive mixed content?
Active includes scripts, styles, iframes and fonts. Passive includes images and video. Active is blocked; passive may warn.
Does mixed content affect SEO?
Yes. It affects user trust, may trigger warnings and can impact rankings indirectly.
How do I find mixed content?
Check the browser console and Network tab. Use a mixed content checker to scan the page.
Can a CDN cause mixed content?
Yes. If the CDN rewrites URLs to HTTP or does not pass X-Forwarded-Proto, mixed content can occur.
What if a third-party script does not support HTTPS?
Replace it or remove it. Embedding HTTP resources on HTTPS pages is not sustainable.
Can mixed content block the entire page?
In severe cases, yes. If critical scripts or styles are blocked, the page may fail to load.
How do I fix hardcoded HTTP URLs?
Search templates and database for http:// and replace with https://. Be careful with serialized data.
Does mixed content affect Core Web Vitals?
Indirectly. If resources are blocked, rendering may fail, affecting LCP and CLS.
How often should I check for mixed content?
After updates, redesigns, or changes to third-party services. Periodic checks are also useful.
