Data Study · Website Migration

    659,120 Secure Homepages Still Load Files Over Insecure HTTP

    Matt SuffolettoWritten by Matt Suffoletto
    Published Sept. 24, 2026 5 min read
    Share

    659,120 homepages served over secure HTTPS, 4.5% of them, still pull in at least one image, script or other file over insecure HTTP. Websites outside the 10 million most visited do it at more than twice the rate of the 10,000 most visited.

    Analysis of 14,502,945 HTTPS homepages · the public HTTP Archive crawl, September 2026

    Key Findings

    1. 1.659,120 homepages served over secure HTTPS, 4.5% of them, still load at least one file over insecure HTTP.
    2. 2.215,350 more homepages are still served entirely over insecure HTTP, bringing the share of homepages that fail the basic HTTPS test to 5.9%.
    3. 3.5.1% of HTTPS homepages outside the 10 million most visited websites load insecure files, more than twice the 2.4% of the 10,000 most visited.
    4. 4.97% of HTTPS homepages that load insecure files belong to websites outside the 1 million most visited.
    5. 5.Among the 1 million most visited websites the rate of insecure files barely moves, from 2.4% to 2.7%, then jumps to 4.3% for websites ranked 1 million to 10 million.

    Summary

    A dental practice moved its website to HTTPS and the address bar shows a padlock. The photo of the team on the homepage, though, was uploaded years ago with an http:// address. Chrome either upgrades that request or blocks it, so some visitors see a gap where the photo should be, and the page quietly stops being fully secure.

    That is mixed content: a secure HTTPS page that loads something, usually an image, script or font, over an insecure http:// connection. Browsers block some of these requests and upgrade others, so the result can be a broken layout, a missing image, a script that never runs or a lost padlock. An insecure file can also be read or altered on its way to the visitor.

    659,120 HTTPS homepages still load at least one insecure file, 4.5% of all homepages served over HTTPS. Another 215,350 homepages skip HTTPS altogether. The problem is concentrated among less-visited websites, the ones least likely to have anyone checking browser warnings.

    What we measured

    We used the September 2026 HTTP Archive crawl, a public project that loads millions of homepages in a real browser each month and runs a set of page-quality tests on each one. One test lists every request on the page that uses plain HTTP. We took the 14,502,945 homepages served over HTTPS with a test result, counted those that failed it, counted the 215,350 homepages served entirely over plain HTTP, and split both groups by how popular each website is.

    HTTPS is the encrypted version of the web's basic protocol; browsers mark pages without it as "Not secure". A file is any separate resource a page loads, such as an image, stylesheet, script or font. Popularity groups rank websites by real Chrome visits, from the 10,000 most visited to those outside the top 10 million.

    659,120 secure homepages still load insecure files

    4.5%
    of homepages served over HTTPS still load at least one file over insecure HTTP.

    That is 659,120 homepages that did the hard part of moving to HTTPS and left something behind. Add the 215,350 homepages that never moved at all, and 5.9% of homepages fail the basic HTTPS test, about one in seventeen.

    For a business, mixed content rarely looks like a security problem. It looks like a missing photo, a form that will not submit or a padlock that disappears on one page, and visitors notice those before the owner does.

    Mixed content is left over from the move to HTTPS

    Most mixed content predates the switch to HTTPS. Images uploaded years ago were saved with full http:// addresses, theme files point at old file servers, and widgets from other companies were pasted in with whatever address they had at the time. Turning on HTTPS at the server changes none of that; each address has to be updated in the content.

    The same unfinished move shows up in links. In a separate Suff Digital study of small business websites, 37% still link to at least one http:// address. Loaded files do more harm than links, because the browser fetches them automatically on every visit, but both come from an HTTPS move that stopped at the server.

    What this means for website owners

    Open your homepage in Chrome, press F12 and look at the Console tab. Mixed content warnings list every insecure file by address. Fix each one by switching the address to https:// or hosting the file on your own website. On WordPress, a search and replace for your own http:// domain fixes most of them in one pass.

    Then add a Content-Security-Policy header with the upgrade-insecure-requests setting, which tells browsers to request every file over HTTPS, as a safety net for anything you missed, and check a few inner pages too. Our technical seo services include this check on every page of a website, alongside the redirects and certificates that make HTTPS work.

    Embed this research

    Paste this on your site to embed the charts. It links back to the source automatically.

    <iframe id="sd-mixed-content-https-websites" src="https://www.suffdigital.com/embed/data-studies/mixed-content-https-websites" width="100%" height="600" style="width:100%;border:1px solid #E5E7EB;border-radius:12px" loading="lazy" title="659,120 Secure Homepages Still Load Files Over Insecure HTTP - Suff Digital"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.sdEmbed==="mixed-content-https-websites"&&e.data.height){var f=document.getElementById("sd-mixed-content-https-websites");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites">659,120 Secure Homepages Still Load Files Over Insecure HTTP - Suff Digital</a></p>

    Cite this study

    APA

    Suff Digital. (2026). 659,120 Secure Homepages Still Load Files Over Insecure HTTP. https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites

    Plain link

    659,120 Secure Homepages Still Load Files Over Insecure HTTP - Suff Digital - https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites

    Frequently asked questions

    Related studies