What it is
Once a page is served securely over HTTPS, every single thing loaded on that page — every image, script, stylesheet, and embedded video — is also supposed to load over HTTPS. "Mixed content" is what happens when the main page is secure but one or more of those individual pieces is still being loaded over the old, unencrypted http:// instead, often because of an old image link or embed code that was never updated when the site moved to HTTPS.
It's called "mixed" because the page ends up serving a mix of secure and insecure connections at the same time, which defeats much of the purpose of switching to HTTPS in the first place.
Why it matters
Browsers treat mixed content as a real security concern, not a cosmetic one — they'll often silently block the insecure resource from loading at all (so an image or script just doesn't appear), or show a visible warning icon in the address bar that undoes the trust the padlock was supposed to provide. Either outcome is worse than simply not having HTTPS at all in the eyes of a security-conscious visitor, because it looks like something is actively broken or half-configured.
Because mixed content usually comes from just one or two overlooked links buried in a page's code (an old image URL, a third-party embed), it's also one of the easier issues on this list to fully resolve once it's found.
How to fix it
- Open your page in a browser and check the developer console (usually opened with
F12or right-click → Inspect → Console tab) for warnings mentioning "mixed content" or "insecure content". - Each warning will name the specific resource (an image, script, or stylesheet URL) that's still loading over
http://. - Update each of those URLs to start with
https://instead — most resources are available over HTTPS even if the specific link on your page wasn't updated. - For third-party embeds (videos, widgets, ads) that only provide an
http://version, check whether the provider offers an HTTPS embed code instead. - Reload the page and recheck the console to confirm the warnings are gone.