# What Is Mixed Content? Definition and Examples

> Mixed content is an HTTPS page that loads some subresources, such as scripts, images or iframes, over plain HTTP, undermining the page's protection.

Source: https://ssl.sh/glossary/mixed-content/
Last updated: 2026-11-10

Mixed content occurs when a page delivered over [HTTPS](https://ssl.sh/glossary/https/) includes subresources fetched over plain HTTP. Browsers distinguish two kinds. Active (blockable) mixed content, such as scripts, stylesheets, iframes and fetch or XHR requests, can change the whole page, so browsers block it. Passive (upgradable) content, such as images, audio and video, is automatically retried over HTTPS by current Chrome and Firefox versions and simply not loaded if that fails.

## Why it matters
An attacker who can modify a single HTTP script controls the HTTPS page that loads it, including its forms and any cookies not marked HttpOnly. Users see a missing or warning padlock, and features break because blocked resources never load. Typical causes are hard-coded `http://` URLs in templates or CMS content, old third-party widgets, and applications moved behind an HTTPS [reverse proxy](https://ssl.sh/glossary/reverse-proxy/) that still believe they run on HTTP and therefore generate `http://` links.

## Example
Find hard-coded HTTP references, or run the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/):

```bash
curl -s https://example.com | grep -oE '(src|href)="http://[^"]+"'
```

Fix URLs at the source; as a safety net, ask browsers to upgrade the rest:

```nginx
add_header Content-Security-Policy "upgrade-insecure-requests" always;
```

## Common misconceptions
- **Mixed content is only a cosmetic padlock issue.** For images that is close to true now that browsers auto-upgrade them, but mixed scripts or iframes hand control of the page to anyone on the network path.
- **A redirect to HTTPS on the resource host fixes it.** Browsers block active mixed content before the request is sent, so no redirect is ever seen; the URL in the page must change.
- **HSTS fixes mixed content.** [HSTS](https://ssl.sh/glossary/hsts/) only upgrades requests to hosts that sent the header; third-party HTTP resources are not covered.

## Related terms

- [HTTPS](https://ssl.sh/zh/glossary/https/): HTTPS 是在 TLS 加密连接之上传输的 HTTP，默认使用 443 端口，使网页内容、Cookie 和表单数据被加密，并验证服务器身份。
- [HSTS](https://ssl.sh/zh/glossary/hsts/): HSTS 是一个 HTTP 响应头，告诉浏览器在指定时间内只通过 HTTPS 访问该站点，并且遇到证书错误时不允许用户继续访问。
- [反向代理](https://ssl.sh/zh/glossary/reverse-proxy/): 反向代理是代表后端服务器接收客户端连接、再把请求转发给后端的服务器，通常同时承担 TLS 终止。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。
- [TLS 终止](https://ssl.sh/zh/glossary/tls-termination/): TLS 终止是指网络路径上客户端 TLS 连接结束并被解密的位置，可以是 CDN 边缘、负载均衡、反向代理，也可以是应用服务器本身。