https.mixed-content
An https page loads resources over http. Browsers block scripts, stylesheets, frames and responsive images (warning) and upgrade plain images, audio and video to https, which fails when the https URL does not exist (info). With a Content-Security-Policy of upgrade-insecure-requests, every resource is upgraded (info).
What to change
Load every resource over https: change http:// URLs to https:// (or make them relative), and host or replace any resource that has no https version. A Content-Security-Policy of upgrade-insecure-requests upgrades the rest.
The documentation on web.devA finding of this rule on a page carries the exact edits for that page: the markup it quotes, and what to write instead.
When it runs
Runs on every SEO audit: of a page, a crawl, a build directory or HTML. A warning is a problem that costs a page ranking, clicks or citations. Each finding takes 5 points off the page's score.
The severity here is the rule's usual one: a finding can be raised or lowered when the page gives a reason.
Run it, or skip it
Check a page for this rule alone, after a fix for instance:
npx @rivi-software/agentic-seo-check audit https://example.com --rule https.mixed-contentOr from an assistant, with the MCP tool seo_audit_page:
{
"url": "https://example.com",
"rules": [
"https.mixed-content"
]
}To leave it out of an audit, pass --disable https.mixed-content on the command, or disableRules: ["https.mixed-content"] to a tool.
More in The document
All 12 rules- Info
viewport.not-scalableThe viewport disables user zoom (user-scalable=no or maximum-scale=1). - Info
charset.missingNo character encoding is declared, in the HTML or in the Content-Type header. - Info
doctype.missingThe document does not start with <!DOCTYPE html>. - Info
document.html-too-largeThe HTML document is larger than 1.5 MB. - Error
head.closed-earlyAn element that does not belong in <head> (an <img>, <iframe>, <div>, stray text) ends it early, so search engines read the metadata after it as part of <body> and ignore it. - Warning
head.metadata-in-bodyMetadata that search engines read only in <head> (title, meta description, viewport, canonical, hreflang) is written in <body> (warning). Metadata a framework streams into a hidden part of <body> and moves into <head> with JavaScript, as Next.js does for an async generateMetadata, is info. Robots meta tags are not reported: Google honours them in <body> too. - Info
charset.lateThe character encoding is declared after the first 1024 bytes, where the HTML spec requires it, and the Content-Type header does not declare it. - Info
favicon.missingThe home page has no <link rel="icon"> (or apple-touch-icon). Google takes the icon it shows next to the site in search results from the home page.