Cybersecurity glossary
What is Mixed Content?
Learn what mixed content is, how active and passive mixed content differ, why browsers block insecure scripts on HTTPS pages, and how to eliminate mixed content safely.
Definition
Mixed content occurs when a page loaded over HTTPS embeds or requests subresources over cleartext HTTP, weakening the page’s transport security; browsers increasingly block active mixed content such as scripts and may restrict or warn on passive mixed content such as images.
Why mixed content matters
HTTPS promises confidentiality and integrity for a page. That promise collapses if the page executes a script fetched over HTTP. Mixed content is the name for that mismatch: secure document, insecure subresource.
Attackers on the network can tamper with HTTP assets. For scripts and other active content, that is effectively a path to page takeover even when the address bar shows a lock.
How mixed content appears
User loads an HTTPS document
The top-level page is fetched securely.
HTML references http:// assets
Scripts, styles, images, fonts, or frames still point at cleartext URLs.
Browser classifies the request
Active mixed content is typically blocked; passive mixed content may warn or restrict.
Page breaks or weakens
Missing scripts cause functional bugs; allowed insecure media still risks tampering.
Active vs passive mixed content
| Kind | Examples | Typical browser stance |
|---|---|---|
| Active | Scripts, stylesheets, iframes, fetch/XHR, workers | Blocked by default on modern browsers |
| Passive | Images, video, audio | Often allowed with warnings; increasingly restricted |
Remediation approaches
Serve assets over HTTPS
Fix URLs to https:// or protocol-relative forms that resolve securely.
upgrade-insecure-requests
CSP directive rewrites http subresources to https during migration.
Block remaining mixed content
Use CSP controls and monitoring so regressions cannot silently return.
Fix third-party tags
Replace vendors that still ship insecure embed URLs.
Cleanup checklist
- Crawl key templates for http:// subresource URLs on https:// pages.
- Update hard-coded asset links, CMS fields, and email-driven HTML fragments.
- Ensure CDNs and object storage expose HTTPS endpoints for all public assets.
- Add CSP upgrade-insecure-requests during migration, then remove leftover http URLs.
- Watch browser consoles and CSP reports for mixed content violations.
- Verify third-party scripts, tag managers, and GTM containers.
- Pair cleanup with HSTS once HTTPS is complete.
- Retest after each CMS or marketing pixel change—mixed content often returns via content edits.
The practical takeaway
Mixed content is HTTPS pages requesting HTTP subresources. Active mixed content is especially dangerous because network attackers can alter scripts and seize the page.
Eliminate insecure URLs, use CSP upgrade helpers during migration, and monitor continuously so the lock icon matches the actual security of every byte the page executes.
Related security terms
HTTPS
Encrypted transport that mixed content partially undermines.
HTTP Strict Transport Security (HSTS)
Helps keep top-level navigations on HTTPS alongside mixed content fixes.
Content Security Policy (CSP)
Can include upgrade-insecure-requests and block-all-mixed-content style controls.
Secure Cookie
Cookie transport hardening that assumes HTTPS completeness.
Frequently asked questions
What is mixed content in simple terms?
It means an HTTPS page is also pulling some files over insecure HTTP—like a script or image—so part of the page is no longer fully protected.
What is active vs passive mixed content?
Active mixed content can alter page behavior (scripts, stylesheets, iframes, XHR). Passive mixed content mainly displays media (images, video, audio). Browsers treat active mixed content more strictly.
Why do browsers block mixed scripts?
An attacker who can modify an HTTP script can take over an otherwise HTTPS page, defeating the point of HTTPS for that document.
How do I find mixed content?
Use browser developer tools console warnings, CSP reports, and automated crawlers that flag http:// subresource URLs on https:// pages.
What is upgrade-insecure-requests?
A CSP directive that asks the browser to rewrite http:// subresource requests to https:// before fetching, useful during migrations.
Does HSTS fix mixed content automatically?
HSTS upgrades navigations to the host; it does not by itself rewrite every third-party http:// asset URL embedded in HTML.
Can mixed content affect cookies?
Yes indirectly. Insecure subresources and broken HTTPS assumptions increase network attack options, and Secure cookies will not be sent on HTTP requests.
References
Explore authoritative guidance and frameworks related to mixed content.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.