An HTTPS page is meant to be secure end to end. Mixed content is what happens when that page, while loading, reaches out over plain http:// for something it needs, such as an image. The browser is already showing the padlock, then partway through rendering it fetches an insecure resource, so it blocks or warns on what it finds.
What this finding means
Crawl Cove's mixed-content check looks at every HTTPS page in your crawl and flags any <img> tag pointing at an absolute http:// URL. It only fires on pages served over HTTPS in the first place: a plain http:// page has nothing to "downgrade" to, so that is a different, separate finding (see security headers, below).
A real finding looks like this:
3 insecure http:// subresource(s): img src: http://example.com/logo.png; img src: http://example.com/hero-banner.jpg; img src: http://cdn.example.com/icons/facebook.png
One finding per page, listing every offending image so the fix is a single pass rather than a hunt.
Why it matters
A browser part-way through an HTTPS page that reaches out over plain http:// will block or warn on what it finds, so images can vanish and some visitors see a security warning on a page you paid to rank. Links to other http:// sites are not affected: a hyperlink is somewhere the visitor may go, not something this page loads.
How to fix it
- Find every offending
<img src="http://...">on the page. Crawl Cove's finding already lists them; if you are checking by hand, view the page source and search forsrc="http:. - Change each one to
https://. Most images already exist on a secure version of the same host, or the same asset is available from a CDN over HTTPS; try swapping the scheme first before re-uploading anything. - If the image is hosted by a third party that has no HTTPS version, host a copy yourself (your media library, your CDN) rather than linking to the insecure original.
- Re-crawl the page to confirm the finding clears, then spot-check it in a real browser: an open padlock or a "not fully secure" warning in the address bar is the visible symptom this fix removes.
Note
On WordPress, a bulk mixed-content fix is usually a search-and-replace across the database (http://yourdomain.com → https://yourdomain.com) run through a plugin such as Better Search Replace, rather than editing each post by hand. Back up the database first, as with any bulk find-and-replace.
False positives and edge cases
Two things look like mixed content and are not, and Crawl Cove's check deliberately ignores both:
- A hyperlink to an
http://page (<a href="http://...">). That is a navigation the visitor may or may not make, not a resource this page fetches. No browser warns about it, and flagging it would send you chasing links that were never insecure to begin with. http://schema.orginside JSON-LD structured data."@context": "http://schema.org"is a namespace identifier, not a URL anything retrieves. It is the standard way JSON-LD has been written for years, and Google's own documentation examples use it too.
If your audit tool flags either of those as mixed content, that is a false positive from the tool, not a real problem on your site.
Related reading
For the transport-security headers that sit next to this check (HSTS, Content-Security-Policy and friends), see Missing Security Headers.
Frequently asked questions
- Does a link to an http:// site count as mixed content?
- No. A hyperlink is somewhere a visitor may choose to go, not something the current page fetches. Browsers only warn about resources the page itself loads, such as an image, script or stylesheet.
- Does "http://schema.org" inside JSON-LD count as mixed content?
- No. That string is a namespace identifier, not a URL the browser retrieves. Google's own JSON-LD examples have used it for years, and it is standard, correct markup.
- Why does this only flag images?
- Scripts, stylesheets and iframes get blocked outright by the browser and are rarer in practice; images are the one type browsers still load with a warning, so they are also the one a site owner might never notice without an audit.
- Does mixed content affect rankings directly?
- Not as a named ranking factor, but a blocked or warned-on resource can break how a page looks and reads, and Google has said a secure, working page is part of a good page experience.