How it works
A page is only delivered securely if everything it loads comes over HTTPS as well. If an https page includes a script from http://cdn.example.com, that file travels unencrypted. How browsers handle this is defined in the W3C Mixed Content specification.
Browsers distinguish two kinds. Active content such as scripts, stylesheets, iframes and JavaScript requests can change the whole page and gets blocked. For passive content such as images, audio and video, Chrome and Firefox now try an automatic upgrade to https; if that fails, the resource stays empty or the page loses its padlock.
Typical causes are hard-coded http URLs in database content after the switch to HTTPS, outdated theme or plugin files, third-party embeds and forms whose action still starts with http://.
Why it matters
Blocked scripts and stylesheets break layout and features: menus will not open, the cart stops responding, consent banners or forms disappear. Because this only happens inside the browser, a basic uptime check never notices.
Anything that still travels unencrypted can be read or swapped out along the way, on public Wi-Fi for instance. A form posting to http is the worst case: passwords, contact and payment details cross the network in plain text, and browsers warn on submit.
How to prevent it
- Replace hard-coded http URLs with https; in WordPress, WP-CLI does it with wp search-replace "http://example.com" "https://example.com" (take a backup first).
- Search the theme, plugins and custom templates for hard-coded http links to fonts, scripts and images.
- Add the Content-Security-Policy directive upgrade-insecure-requests as a safety net so browsers rewrite any leftover http URLs to https on their own.
- Move form actions and embedded services to https, or replace services that do not offer HTTPS.
- Redirect http to https permanently and enable HSTS so the page itself is never served unencrypted.
How DomainWarn detects it
The Page health check analyzes the daily browser visit to the homepage: if the https page embeds resources over http, that is a warning and immediately opens the incident “Insecure content (mixed content)”. A form submitting to an http address is critical and opens “Form without encryption”.
The Website check also inspects up to 50 HTML pages from the sitemap and internal links: scripts, stylesheets, frames, objects or form actions over http:// are critical and open the incident “Mixed content: scripts or stylesheets over http”, while images and media over http:// are a warning. Protocol-relative URLs (//…) do not count. The free Website Check tool shows the same findings for a single run.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.