When the insecure resource is not yours.
THE SITUATION
The console names a URL on another domain: an image hosted elsewhere, a script from a service, a font, an advertisement.
YOUR OPTIONS
- Try the https version. Change http:// to https:// in the URL and test. Most services support it and this resolves it immediately.
- Get updated embed code from the provider. Old code copied years ago often uses http.
- Host the resource yourself. For images and fonts this is straightforward, and often faster too.
- Find an alternative service, if the provider genuinely does not support https.
- Remove it, if you no longer need it. Many mixed content warnings come from services abandoned years ago whose code is still loading.
WHAT NOT TO DO
Do not use a plugin that rewrites all insecure requests without fixing the underlying references. It masks the problem, and the underlying data stays wrong.
CHECKING
After each change, reload with the console open and confirm the warning has gone.
