# What Is Mixed Content? — HTTP Resources on an HTTPS Page

Canonical: https://commareports.com/glossary/mixed-content
Published: 2026-09-11

> Mixed content is an HTTPS page requesting an HTTP subresource. Active versus passive, what browsers block versus upgrade, and why generated reports hit it more than hand-written pages.

# Mixed content

**Mixed content is an HTTPS page requesting a subresource over plain
HTTP.** Since the insecure request can be read and rewritten in transit,
the browser refuses to let it silently weaken the page.

```
Mixed Content: The page at 'https://example.com/report/' was loaded over HTTPS,
but requested an insecure resource 'http://cdn.example.net/chart.js'.
This request has been blocked; the content must be served over HTTPS.
```

## Active versus passive

| Kind        | Resources                                                               | Browser behaviour                                    |
| ----------- | ----------------------------------------------------------------------- | ---------------------------------------------------- |
| **Active**  | `<script>`, `<link rel=stylesheet>`, `<iframe>`, `fetch`/XHR, web fonts | Blocked unconditionally                              |
| **Passive** | `<img>`, `<video>`, `<audio>`                                           | Auto-upgraded to HTTPS; blocked if the upgrade fails |

The split follows capability. Active content can rewrite the page, so
there is no safe degraded mode. Passive content cannot, so Chrome,
Firefox and Safari now try the HTTPS URL first and only fail if the host
does not answer.

This is why a broken report often shows _some_ damage: images survive the
upgrade, and the chart library does not.

## Why generated reports hit this more often

Hand-written pages are maintained. Generated ones inherit URLs from
templates that may be years old:

- A generator template with a hard-coded `http://` CDN reference.
- An internal asset host that never got a certificate, fine while the
  report was opened from `file://`, fatal once it is published over
  HTTPS.
- A plugin or theme pinned to an old version whose template predates
  universal TLS.
- Report data referencing screenshots on an internal HTTP server.

The report worked locally because `file://` pages have no HTTPS context
to violate. Publishing it is what surfaces the problem — not what caused
it.

## Fixes, in order of durability

1. **Vendor the resource** into the report directory so it is requested
   relatively. Immune to the host's scheme, the CDN's certificate, and
   the reader's network.
2. **Change the URL to `https://`.** Most CDNs have served both for a
   decade; the template is simply stale.
3. **Protocol-relative (`//host/file.js`)** — works, but it is a legacy
   pattern from the mixed-HTTP era and not worth introducing now.

## Not the same as a CSP block

[Content Security Policy](/glossary/content-security-policy) refusals
concern whether the host permits an origin at all; mixed content concerns
the scheme. Read the console string to tell them apart — the full
side-by-side is in
[mixed content vs CSP](/fix/mixed-content-blocked-html-report).

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Publish a report over HTTPS →](https://commareports.com/)**

### Related

- [Content Security Policy](/glossary/content-security-policy) · [Same-origin policy](/glossary/same-origin-policy)
- [Mixed content blocked](/fix/mixed-content-blocked-html-report) · [My report lost its CSS](/html-report-broken-css)
- [Troubleshooting](/fix) · [Glossary](/glossary)