A secure page loading insecure resources.
WHAT HAPPENS
The page itself arrives over https, but something on it, an image, a script, a stylesheet, is requested over http.
Browsers treat this in two ways:
Passive mixed content, such as images, is usually loaded but the padlock is removed or marked. Active mixed content, such as scripts and stylesheets, is blocked outright. This can break layout and functionality entirely.
WHY BROWSERS CARE
An attacker able to modify an insecurely loaded script controls the page. Blocking active mixed content is not pedantry; it prevents a real attack.
WHAT YOU SEE
A padlock with a warning, or no padlock "Not fully secure" in the browser Missing images, broken layout, or a feature that silently stops working Warnings in the developer console
THE USUAL CAUSE
Content created before HTTPS was enabled, with absolute http URLs stored in the database.
THE FIX
A database search and replace, covered in the next articles.
