**A secure HTTPS page that still loads images, scripts or styles over insecure HTTP has "mixed content" — and it undermines the security it's supposed to have.** This check looks for HTTP resources loaded on your HTTPS pages. Browsers warn about or outright block mixed content, so it can break functionality and downgrade the padlock to a security warning.
It checks whether a page served over HTTPS pulls in any resources over insecure HTTP. Specifically:
- Insecure resources — images, scripts, stylesheets, fonts, iframes or media loaded via http:// on an HTTPS page.
- Active vs. passive — active mixed content (scripts, iframes) is the most serious and is usually blocked; passive (images) triggers warnings.
- Hard-coded HTTP URLs — references that should be updated to HTTPS or made protocol-relative.
No mixed content passes; some passive mixed content (e.g. images) is a warning; active mixed content or widespread insecure resources is a fail.
GEObubbly scans an HTTPS page for resources loaded over insecure HTTP. It's an extended Security check that runs directly against the page's resource references.
Serving a page over HTTPS only fully protects it if everything on the page also loads securely. Mixed content happens when an HTTPS page references resources — images, scripts, stylesheets, fonts, iframes — over plain HTTP, leaving those parts of the page unencrypted and tamperable. Browsers treat this seriously: active mixed content (scripts and iframes, which can change the whole page) is typically blocked outright, which can break layout or functionality, while passive mixed content (images, media) triggers a security warning and downgrades the padlock. Either way, the user no longer sees a clean secure indicator, and the page's security promise is broken. Mixed content usually creeps in from hard-coded http:// URLs left over after a migration to HTTPS, or third-party embeds that don't support HTTPS. The fix is to update every resource reference to HTTPS (or protocol-relative), replace embeds that can't be served securely, and use a Content Security Policy to catch regressions. Keeping pages fully secure preserves the trust and access benefits of HTTPS. For GEO, a clean, fully-secure page is part of the baseline reliability engines expect.
Mixed content occurs when a page served over secure HTTPS loads some of its resources — images, scripts, stylesheets, fonts, iframes or media — over insecure HTTP. The page itself is encrypted, but those individual resources are not, leaving parts of the page vulnerable to interception or tampering. Because this defeats the purpose of HTTPS, browsers flag or block it. Mixed content commonly appears after a site migrates to HTTPS but leaves some hard-coded http:// resource URLs behind, or when a third-party embed only offers an insecure version.
Active mixed content is insecure resources that can control or alter the whole page — scripts, iframes, stylesheets — and browsers usually block it outright because a tampered script could compromise the entire page. Passive (or display) mixed content is insecure resources that only affect a portion of the page, like images and media; browsers typically allow it but show a security warning and downgrade the padlock. Active mixed content is the more serious problem because it both breaks functionality when blocked and poses a real security risk, so it should be the first priority to fix.
Find every resource on your HTTPS pages that's referenced over http:// and update it to https://. Most often this means correcting hard-coded HTTP URLs left over from before a migration, in templates, content, or stylesheets. For third-party embeds that only offer HTTP, switch to an HTTPS version or replace the provider. A Content Security Policy with upgrade-insecure-requests can automatically upgrade references and help catch regressions. After fixing, reload the page and confirm the browser shows a clean padlock with no mixed-content warnings in the console.
Mixed content's main impact is on security and user trust rather than being a direct ranking penalty, but it still matters for SEO. It downgrades or removes the secure padlock and can trigger browser warnings, undermining the trust benefit of HTTPS, and when active mixed content is blocked it can break page functionality or rendering, which harms user experience. Since a fully-secure, properly-rendering page is part of the quality baseline engines favour, eliminating mixed content protects the HTTPS advantage you've already invested in and keeps the page working and trustworthy.
Indirectly. Mixed content that causes resources to be blocked can break parts of a page's rendering, and a page flagged with security issues is a weaker signal of a well-maintained, trustworthy site. AI crawlers favour clean, reliable sources, so eliminating mixed content keeps your pages fully secure and functioning as intended, which supports the baseline credibility engines look for. While mixed content isn't a direct GEO factor, resolving it is part of presenting a secure, properly-rendered page that engines can trust and cite.