Mixed Content: the page was loaded over HTTPS, but requested an insecure resource

  • Browser console

What it means

Your secure (https) page tried to load or call something over plain http, and the browser blocked it. Usually a hard-coded http:// address or a development URL left in production.

Why it happens

  • An API address written as http:// in the code or settings.
  • A development address (http://localhost) left in a production setting.
  • Images or scripts linked with http://.

How to fix it

  1. Use https:// everywhere, or relative paths for your own site.
  2. Check production environment variables for http:// and localhost.
  3. Run the website security check to confirm HTTPS and its headers.

Let your AI find the cause

Paste this into Claude Code, Cursor, Lovable or whichever AI built your app. It looks first and changes nothing until you have read the answer.

My live app shows 'Mixed Content' errors. Without changing anything yet, find every http:// address in the code and settings, and tell me which one the failing request uses.