This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung
SEO
What is Mixed Content and why does the browser block parts of my page?
A website with a lock symbol promises that everything will be transmitted encrypted. If the page then embeds an image, script or style file via an unencrypted http address, it breaks that promise — this is called mixed content. Browsers react staggered: scripts, stylesheets and iframes over http are silently blocked, the page seems broken without an error message appearing; Images are loaded, the lock disappears or is marked as unsafe. The SEO test area counts such integrations on the measured side.
Where Mixed Content Comes From
Almost always from the past: The website once ran over http, was converted to https, and text, templates or database fields still contain absolute addresses with http://. Other embedments — an old map service, a counter, a font server — also occasionally provide http addresses. The check area reads the source addresses of all embedded elements of the measured page: images, scripts, style sheets, iframes, media. Everyone who starts with http:// counts. References to other pages (ordinary links) do not count — they are navigation, not content. Rated is only on an https page; who delivers without encryption, has another, larger problem, which the data protection check area reports.
Why This Is More Than a Beauty Mistake
A silently blocked script can cripple a menu, form, or consent request — the page is then partially unusable for visitors while it looks normal in the editorial system. A missing style sheet breaks down the layout. And a loaded http image opens an unencrypted channel through which an attacker can exchange content on the same network. Search engines have favored encrypted pages for years and classified mixed content as a security shortcoming. In the seo-v2 rulebook, the rule costs 4 out of 100 points and is used as a serious finding because the effect is visible and immediate.
- In databases and templates, replace all occurrences of http:// on your domain with https:// or with relative addresses, Editorial systems provide search-and-replace tools for this.
- Add a content security policy with upgrade-insecure-requests: The browser then raises remaining http integrations to https itself.
- Check foreign embeddings individually; If a provider only delivers http, replace it.
- After the correction, open the browser’s developer tools: the console names any address that is still blocked.
