Secure pages loading scripts or styles over plain HTTP

What is wrong

Your website uses HTTPS (the secure protocol) on some pages, but loads JavaScript files or stylesheets over plain HTTP instead. When a visitor's browser tries to load these insecure resources on a secure page, it either blocks them entirely or shows a warning—either way, your page breaks.

Why it costs you

Broken pages send visitors away immediately and damage trust. Browsers treat this as a genuine security risk, and they are right to do so. A visitor on a public WiFi network could be intercepted and served malicious code in place of your stylesheet or script. Your page may not display properly, scripts may not run, or the browser may refuse to load the page at all.

How to fix it

Check every `<link>` tag that loads a stylesheet and every `<script>` tag that loads JavaScript. Change the URL from `http://` to `https://` in both your page templates and hardcoded page content. If a third-party service does not support HTTPS, you need a new service provider. The same fix applies to any images, fonts or other resources loaded over HTTP on HTTPS pages.