Fix guide · Squarespace
How to Fix Mixed Content Warnings in Squarespace (2026)
Squarespace serves all sites over HTTPS with automatic SSL certificates via Let's Encrypt, so mixed content warnings are unusual. When they occur, the cause is almost always external: a code block with an http:// iframe, a custom code injection snippet referencing HTTP resources, or a third-party embed using an insecure URL. This guide shows you how to find and fix those insecure references.
Why it matters
What this issue costs you
Browsers display security warnings when HTTPS pages load resources over HTTP. Mixed content can cause images to not load, scripts to be blocked, and visitors to see a "Not Secure" indicator. Google uses HTTPS as a ranking signal, and mixed content means your page is not fully secure.
Step-by-step
How to fix: Mixed content (HTTP on HTTPS)
Squarespace
- 1
Find the mixed content sources
Open your published Squarespace page in Chrome. Open DevTools (F12 or right-click > Inspect) > Console tab. Look for "Mixed Content" warnings — they list the exact URLs being loaded over HTTP. Common sources on Squarespace sites: code blocks with http:// iframes or scripts, Code Injection snippets with http:// URLs, and third-party embed codes.
- 2
Fix code blocks and embed blocks
In the Squarespace editor, find the Code Block or Embed Block on the page that contains the insecure URL. Click it to edit. Search for "http://" and replace with "https://". If the embedded resource does not support HTTPS, consider removing it or finding an alternative provider that does.
- 3
Fix Code Injection snippets
Go to Settings > Advanced > Code Injection. Review both the site-wide Header and Footer fields for any http:// references in script src, image URLs, or stylesheet links. Update them to https://. Also check individual page Code Injection (Page Settings > Advanced) for the same issue.
- 4
Fix third-party integrations
If the mixed content comes from a third-party widget or integration (chat widget, booking tool, map embed), check the provider's documentation for an HTTPS-compatible embed code. Most modern services support HTTPS — the embed code may simply be outdated. If the service does not support HTTPS, replace it with a secure alternative.
Verify the fix
Run the checker to confirm the issue is resolved
After applying the steps above, paste your URL below. Our checker will re-run every applicable check and show whether mixed content (http on https) still shows as a failing check.
FAQ
Common questions about mixed content (http on https)
Does Squarespace handle HTTPS automatically?
Yes. All Squarespace sites are served over HTTPS with auto-provisioned SSL certificates from Let's Encrypt. You cannot disable HTTPS on Squarespace. Mixed content only occurs when you embed or reference external resources using http:// URLs in code blocks, Code Injection, or third-party embeds.
Can Squarespace auto-fix mixed content?
No. Squarespace serves your site over HTTPS but does not scan your custom code or embeds for HTTP references. You need to find and fix them manually by checking the browser console for mixed content warnings.
I did not add any custom code. Why do I have mixed content?
Check for embed blocks, video blocks with custom URLs, or integrations that inject external scripts. Some older third-party tools may still reference HTTP URLs. Open Chrome DevTools Console to see the exact source of the mixed content warning.
While you're here
Related fix guides for Squarespace
Need a full audit?
This checker spots individual issues instantly. deepseoanalysis.com crawls your whole site and tracks changes weekly, from $24/mo.
See all WordPress fix guides, or run a free check now.