Audit and fix all mixed content warnings

Mixed content happens when an HTTPS page loads even one resource, an image, a script, a stylesheet, over plain HTTP instead of HTTPS, breaking the security guarantee for the whole page even though the address bar still shows a padlock.

Modern browsers actively block the most dangerous mixed content (like scripts) and visibly warn on the rest, so unresolved mixed content both weakens real security and looks unpolished to any visitor who notices the warning.

How to do it

1. 1
   Scan every page for mixed content warnings

   Open browser dev tools console on your key pages and look for mixed content warnings, or use an automated scanner across the whole site.
2. 2
   Update every hardcoded http:// reference found

   Images, scripts, embeds, and stylesheets referencing http:// should point to the https:// version instead.
3. 3
   Check old content specifically

   Blog posts or pages written before your site had HTTPS are the most common source of leftover http:// references.
4. 4
   Re-scan after fixing to confirm

   Console should show zero mixed content warnings on a fresh load of each key page.