What is mixed content?

Mixed content is an HTTPS page that requests a subresource over plain HTTP. Because the insecure request is readable and modifiable in transit, the browser either blocks it outright or upgrades it to HTTPS, depending on what kind of resource it is.

What is the difference between active and passive mixed content?

Active mixed content — scripts, stylesheets, iframes, XHR — can change the page, so browsers block it unconditionally. Passive mixed content — images, video, audio — cannot execute, so modern browsers attempt to auto-upgrade the request to HTTPS and block it only if the upgrade fails.

How do you fix mixed content in a generated report?

Change the URLs to HTTPS, or vendor the resource into the report directory so it is requested relatively. Protocol-relative URLs (`//host/file.js`) also work but are a legacy pattern. Hard-coded `http://` in a generator template is the usual culprit.

Is a mixed-content error the same as a CSP error?

No. Mixed content is about the scheme of the request; CSP is about whether the host allows that origin at all. The console text distinguishes them: 'requested an insecure resource' versus 'Refused to load … Content Security Policy'.

Mixed content

Mixed content is an HTTPS page requesting a subresource over plain HTTP. Since the insecure request can be read and rewritten in transit, the browser refuses to let it silently weaken the page.

Mixed Content: The page at 'https://example.com/report/' was loaded over HTTPS,
but requested an insecure resource 'http://cdn.example.net/chart.js'.
This request has been blocked; the content must be served over HTTPS.

Active versus passive

Kind	Resources	Browser behaviour
Active	`<script>`, `<link rel=stylesheet>`, `<iframe>`, `fetch`/XHR, web fonts	Blocked unconditionally
Passive	`<img>`, `<video>`, `<audio>`	Auto-upgraded to HTTPS; blocked if the upgrade fails

The split follows capability. Active content can rewrite the page, so there is no safe degraded mode. Passive content cannot, so Chrome, Firefox and Safari now try the HTTPS URL first and only fail if the host does not answer.

This is why a broken report often shows some damage: images survive the upgrade, and the chart library does not.

Why generated reports hit this more often

Hand-written pages are maintained. Generated ones inherit URLs from templates that may be years old:

A generator template with a hard-coded http:// CDN reference.
An internal asset host that never got a certificate, fine while the report was opened from file://, fatal once it is published over HTTPS.
A plugin or theme pinned to an old version whose template predates universal TLS.
Report data referencing screenshots on an internal HTTP server.

The report worked locally because file:// pages have no HTTPS context to violate. Publishing it is what surfaces the problem — not what caused it.

Fixes, in order of durability

Vendor the resource into the report directory so it is requested relatively. Immune to the host's scheme, the CDN's certificate, and the reader's network.
Change the URL to https://. Most CDNs have served both for a decade; the template is simply stale.
Protocol-relative (//host/file.js) — works, but it is a legacy pattern from the mixed-HTTP era and not worth introducing now.

Not the same as a CSP block

Content Security Policy refusals concern whether the host permits an origin at all; mixed content concerns the scheme. Read the console string to tell them apart — the full side-by-side is in mixed content vs CSP.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a report over HTTPS →