Glossary
Mixed content
A secure page loading something over plain HTTP.
What it means
Mixed content is an HTTPS page that pulls in a script, an image, a font or a frame over plain HTTP. The padlock is still there, but part of the page arrived unprotected and can be read or changed on the way.
Browsers block the dangerous kinds outright now, which is why mixed content usually shows up as a feature that silently does not work rather than as a warning anyone sees. An analytics script that never loads, a map that stays blank, a font that falls back.
It creeps in through copied snippets and old documentation. The fix is to serve everything over HTTPS, and to stop hard-coding protocols in URLs. A check reads the published page, so this is one of the items observable from outside.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026