What mixed content is, and why it hides the padlock
An HTTPS page promises that everything on it travelled encrypted. If even one image, script or font is fetched over plain http://, that promise is broken, so the browser either drops the padlock or refuses to load the insecure file. It's the most common reason a site with a perfectly valid certificate still shows "Not Secure", and it almost always appears right after a site moves to HTTPS.
Blocked vs. warned
- Blocked (active content): scripts, stylesheets, web fonts, iframes and form targets. Browsers refuse to load them at all, which is why a migrated site suddenly loses its styling, slider or contact form.
- Warnings (passive content): images, video and audio. Modern Chrome and Firefox try to upgrade these to HTTPS automatically. If the https version doesn't exist, the file is blocked; either way, the padlock can disappear.
Fixing it, fastest first
1. Fix the source. The scanner tells you whether each file is available over HTTPS. When it is, the fix is simply changing http:// to https:// (or to a relative /path for files on your own domain). On WordPress, set both addresses to https in Settings, General, then run a database search and replace from http://yourdomain.com to https://yourdomain.com and clear your cache.
2. Add a safety net. Tell browsers to upgrade any leftover http requests automatically with a Content Security Policy header. On Hostinger and other Apache hosts, add this to .htaccess:
<IfModule mod_headers.c> Header always set Content-Security-Policy "upgrade-insecure-requests" </IfModule>
This only works for files that actually exist on HTTPS, so it complements the fix rather than replacing it. Our .htaccess generator can add it alongside your HTTPS redirect.
3. Replace dead third parties. Old embeds, counters and widgets from services that never supported HTTPS need to be removed or swapped for a modern alternative.
Check the certificate too
Mixed content is one half of the padlock puzzle; the other is the certificate itself. Run the SSL checker to confirm it's valid, covers the right names and sends its intermediate chain.
Frequently asked questions
What is mixed content?
Mixed content is when a page served over HTTPS loads some of its resources, such as images, scripts or stylesheets, over plain HTTP. Those requests are not encrypted, so browsers either block them or remove the padlock.
What is the difference between active and passive mixed content?
Active content such as scripts, stylesheets, iframes and form targets can change the whole page, so browsers block it outright, which often breaks layouts and features. Passive content such as images, video and audio is usually upgraded to HTTPS automatically or loaded with a warning.
How do I fix mixed content in WordPress?
Set both WordPress Address and Site Address to https in Settings, General, then run a search and replace on the database from http://yourdomain.com to https://yourdomain.com with a plugin such as Better Search Replace. Clear any caching plugin and CDN cache afterwards.
Does this scanner see content added by JavaScript?
It scans the HTML your server sends plus up to six of your stylesheets. Resources that scripts insert after the page loads are not included, so also check your browser developer console, which lists every mixed content warning on the page.