Quick answer
Mixed content occurs when an HTTPS page references an HTTP resource. NOTABIS reports mixed-content when it finds one or more absolute http:// values in src or href attributes on an HTTPS page. Serve those resources securely or remove them, then test the final page and browser console.
What the issue means
An HTTPS document that loads an insecure stylesheet, script, image, frame, or link can expose part of the visit to an unencrypted connection:
<script src="http://cdn.example.test/app.js"></script>
Browsers block or upgrade some active and passive mixed content differently. A protocol-relative URL (//example.com/file) is not an absolute HTTP value for this rule, but an explicit HTTPS URL is clearer.
Why it matters for SEO
Mixed content can stop important resources from loading, degrade user trust, and create an inconsistent HTTPS experience. It is a technical and security problem rather than a direct ranking switch. If scripts or styles fail, the page may also be harder for users and search crawlers to render correctly.
How NOTABIS detects it
The mixed-content rule runs on a page whose parsed URL uses HTTPS, then scans [src],[href] attributes for values beginning with http://. It records the count and resolved URLs as a page-level finding. The check does not fetch every resource, inspect CSS files for nested URLs, or determine whether a browser later upgrades or blocks the request.
How to check it yourself
Open the page over HTTPS and inspect the browser console and Network panel for blocked or upgraded requests. Search templates, JavaScript bundles, CSS, redirects, and CMS content for http://. Use a plain GET and a security scanner to compare the public response with the source repository.
How to fix it
Change first-party and third-party resource URLs to HTTPS, configure external providers for secure delivery, and update redirects and canonical assets. Remove unused resources and check CSS, JavaScript, iframes, images, fonts, and API endpoints. If a dependency cannot be served securely, replace it rather than weakening the page’s security policy.
<script src="https://cdn.example.test/app.js"></script>
Re-test the page at desktop and mobile widths and verify that essential content still renders.
When this is intentional or does not need fixing
An HTTP link to an external site is still a navigation choice, but a page should not load active content insecurely. Local development environments may use HTTP; keep that configuration out of production templates. Do not ignore a warning just because a browser currently upgrades the resource.
Related issues
Review HTTPS availability, render-blocking resource candidates, and HTTP error responses.
Run a NOTABIS audit
NOTABIS lists the absolute HTTP references it found on HTTPS pages, giving you a starting point for source, CDN, and third-party resource fixes.