Mixed Content
In one sentence
A secure page loading some of its resources over plain HTTP.
Analogy Mental model
A sealed bag with a leaking bottle inside. The bag is fine and the contents are still contaminated.
In practice What you actually do
Find it in the browser security panel, then change every absolute URL to the secure scheme. Protocol-relative URLs avoid the problem entirely, and a content security policy in report-only mode surfaces what you missed.
Where people get burned Pitfalls
Browsers block the insecure script and the insecure stylesheet outright, so the page arrives with broken layout or dead interaction, and nothing in the network tab reads as an error until you look properly.
This entry was written in English from the Chinese original, not machine-translated. Read the Chinese version →