What this check inspects
On an https page, Shipwork scans the script, img, link, iframe, source, video, audio and object elements for src, href or data values that start with http://. It reports the count and the first fifty offenders. On an http page it notes that mixed content does not apply, since everything is already insecure.
What a failure means
Any insecure resource on an https page is an error. Browsers block active mixed content outright and may rewrite or block passive content, so a stylesheet, image or tracking script can simply not load. The page often looks subtly broken rather than obviously wrong.
How to fix it
- Change the resource URL to https. Most third parties serve both schemes and only the link needs updating.
- If a third party does not support https, move that asset to a host that does.
- Use root-relative URLs rather than protocol-relative ones on an https-only site.
- Search the templates and any embedded widgets, not just the main theme, since old testimonial or chat widgets are common sources.
A typical failure, worked through
The setupA store migrates to https but an old review widget still injects a badge image over http from a legacy domain.
What the check reportsThe check reports one insecure img resource. The browser blocks it, leaving a broken image where the badge should be, while the rest of the page looks fine.
The pointMixed content is usually one forgotten third-party asset, not the main theme. The check names the exact tag so you do not have to hunt.