What mixed content is
Mixed content happens when a page served over HTTPS pulls in one or more resources over plain HTTP. The page itself is encrypted, but a script, stylesheet, image, font, or iframe arrives on an unencrypted connection. That single weak link undoes much of the protection HTTPS is meant to give you, because anyone sitting on the network between the visitor and the server can read or rewrite whatever travels over HTTP.
Active and passive mixed content
Browsers split mixed content into two groups. Active content is anything that can change how the page behaves, such as scripts, stylesheets, and iframes. Browsers block active mixed content completely, so a script loaded over HTTP simply never runs and the page can break. Passive content is media that only displays, like images and audio. Browsers usually still load passive content but mark the page as not fully secure and remove the clean lock icon, which erodes trust.
Why browsers block it
The whole point of HTTPS is an encrypted, tamper proof channel. When a page mixes in HTTP resources, an attacker on the same network can swap a real script for a malicious one or quietly read what loads. Rather than let that slip through, browsers refuse the dangerous parts and warn about the rest, which is why a single HTTP resource can stop a feature from working.
How to fix mixed content
Start by switching every resource URL from http to https, since most services already serve the same asset securely. Replace hardcoded HTTP links in templates, theme files, and stored content, which is a common source on older sites. For anything you cannot edit directly, add the upgrade-insecure-requests directive to your Content Security Policy so the browser rewrites remaining HTTP requests to HTTPS for you. For a deeper walkthrough with examples, read the mixed content guide.