Web e performance

Mixed Content Warnings

Mixed content occurs when an HTTPS page loads sub-resources (images, scripts, stylesheets) over insecure HTTP. Browsers block "active" mixed content (scripts, iframes) and warn about "passive" mixed content (images). This degrades security and user trust.

Sintomas

  • Browser console showing mixed content warnings
  • Padlock icon showing "Not Secure" despite HTTPS
  • Some images or scripts not loading on HTTPS pages

Causas comuns

  • Hardcoded HTTP URLs in HTML, CSS, or JavaScript
  • Third-party resources served over HTTP
  • CMS or theme using HTTP URLs for assets
  • Missing HTTPS redirect on asset CDN

Solução passo a passo

  1. 1

    Check HTTP headers

    Verify the Content-Security-Policy and upgrade-insecure-requests headers.

    Usar HTTP Headers →
  2. 2

    Scan for broken links

    Find mixed content references by scanning your site.

  3. 3

    Update resource URLs

    Change HTTP URLs to HTTPS or use protocol-relative URLs (//example.com/resource).

  4. 4

    Add CSP header

    Add Content-Security-Policy: upgrade-insecure-requests to automatically upgrade HTTP requests to HTTPS.

Ferramentas de diagnóstico recomendadas

HTTP HeadersSSL Certificate Check

Monitor HTTPS Health

Track SSL configuration and detect mixed content issues.

Problemas relacionados

Perguntas frequentes