Mixed content on HTTPS pages: Crawl Audit check 144

Short answer: mixed content is an HTTPS page that loads something, such as an image or script, over plain http://. Browsers upgrade some of it and block the rest, so images can break and scripts simply don't run. Check 144 fails if your page's HTML refers to any http:// address.

What Crawl Audit checks

• Pass: no src or href starting with http://.
• Fail: one or more. The report lists the first three.
• Fail: the page itself isn't served over HTTPS.

Addresses that are only labels, like w3.org and schema.org, are ignored. The check also counts ordinary links (<a href="http://...">). A link to an http:// site isn't mixed content, since nothing loads until someone clicks, but switching it to https:// where the other site supports it is still worth doing.

What MDN says

• "Browsers mitigate the risks of mixed content by auto-upgrading image, video, and audio mixed content requests from HTTP to HTTPS, and block insecure requests for all other resource types."
• "Scripts are particularly dangerous because they can modify any aspect of the page, but all types of resources have some risk."
• Images in srcset or <picture> are not upgraded, so an http:// address there gets blocked.

Finding and fixing it

• Open the page with the browser's developer tools. The console lists each mixed content request.
• Look in templates, theme settings, CSS files and old posts in your database, where full http:// addresses often hide.
• Change them to https:// after checking the file loads that way, or to a relative path for your own files.

On devmarde.com

Our homepage had no http:// references on 6 October, so it passes.

Sources

• MDN, Mixed content (updated 15 August 2026), checked 6 October 2026.