Fix guide · Webflow
How to Fix Mixed Content Warnings in Webflow (2026)
Your Webflow site loads over HTTPS but some resources (images, scripts, iframes) are referenced with http:// URLs. Browsers block or warn about this "mixed content", which can break page functionality and show security warnings. Since Webflow enforces HTTPS on all published sites, the fix is finding and updating the hard-coded HTTP references in your content.
Why it matters
What this issue costs you
Mixed content triggers browser security warnings — the padlock icon disappears or shows a warning triangle. This destroys trust, especially on pages where users enter information. Browsers are increasingly blocking mixed content entirely, meaning HTTP images won't load and HTTP scripts won't execute.
Step-by-step
How to fix: Mixed content (HTTP on HTTPS)
Webflow
- 1
Find mixed content sources
Open your published site in Chrome, press F12 (DevTools) > Console tab. Mixed content warnings appear as yellow/red messages showing the exact HTTP URLs. Note the URLs and what type of resource they are (image, script, iframe). Common sources: embed elements, custom code, and CMS rich text fields.
- 2
Fix HTTP URLs in Embed elements
In the Designer, find Embed elements (they show as grey code blocks). Double-click to edit. Search the code for "http://" and replace with "https://". If the external resource doesn't support HTTPS, remove it or find an alternative that does.
- 3
Fix HTTP URLs in CMS rich text content
If mixed content comes from images or links in CMS rich text fields: open the CMS item in the Editor, click on the offending image, and update its URL to HTTPS. For images uploaded through Webflow's asset manager, they're always HTTPS — the issue is usually images pasted from external sources with HTTP URLs.
- 4
Fix HTTP URLs in Project Settings custom code
Check Project Settings > Custom Code (both Head and Footer sections). Search for "http://" in any script tags, stylesheet links, or tracking pixels. Replace with "https://". Also check page-level custom code: Pages panel > gear icon > Custom Code for each page that was flagged.
Verify the fix
Run the checker to confirm the issue is resolved
After applying the steps above, paste your URL below. Our checker will re-run every applicable check and show whether mixed content (http on https) still shows as a failing check.
FAQ
Common questions about mixed content (http on https)
Does Webflow force HTTPS on all sites?
Yes. All Webflow sites (both staging and production) are served over HTTPS with auto-provisioned SSL certificates. Mixed content only occurs when you embed or reference external resources using http:// URLs in your code, embeds, or CMS content.
Can Webflow auto-fix mixed content?
No. Webflow serves your site over HTTPS but doesn't scan your content for HTTP references. You need to find and fix them manually. Images uploaded through Webflow's asset manager are always HTTPS, but pasted URLs and embeds from external sources can still be HTTP.
I fixed the URLs but DevTools still shows mixed content warnings. Why?
Try a hard refresh (Ctrl+Shift+R) to bypass browser cache. Also check if a third-party script you've embedded is loading its own HTTP resources — you may need to contact the provider for an updated embed code. Use DevTools Network tab filtered to "mixed" to identify the exact source.
While you're here
Related fix guides for Webflow
Need a full audit?
This checker spots individual issues instantly. deepseoanalysis.com crawls your whole site and tracks changes weekly, from $24/mo.
See all WordPress fix guides, or run a free check now.