HTTPS pages with mixed content issues
Some secure (HTTPS) pages display content from unsecured (HTTP) sources. Most often this is content (images, videos, styles, scripts) loaded onto your page over an unsecured http connection.
Besides mixed content errors, there are many other factors to check so your website works properly over secure HTTPS connections. Review all issues with the HTTP / HTTPS versions of your pages, and make sure the HTTP / HTTPS redirect is correct and the SSL certificate is valid.
HTTPS / HTTP errors and SEO
Secure encryption is highly recommended for websites, especially those that process transactions and collect sensitive user information. One of the most common mistakes when moving a website from HTTP to HTTPS is so-called mixed content (secure HTTPS pages containing insecure content). If an HTTPS page includes content loaded over the unsecured HTTP protocol, it weakens the security of the whole page, as unencrypted content can be intercepted. That’s why many modern browsers block this content or show visitors a very unfriendly “insecure connection” warning.
Google detects active and passive mixed content:
- Passive mixed content is content that doesn’t affect the page’s structure or technical design. An interception attack is therefore limited to what attackers can do by changing existing content on the page. Passive mixed content includes images, video and audio content, and other resources that don’t interact with the rest of the page.
- Active mixed content interacts with the page and affects it as a whole, so it gives an attacker almost complete control over the page! Active mixed content includes scripts, styles, iframes, Flash resources and other code that browsers can download and run.