--- title: "Mixed Content Statistics: 659,120 HTTPS Homepages Affected" url: https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites description: "Mixed content statistics: 659,120 HTTPS homepages, 4.5% of them, still load at least one file over insecure HTTP, mostly on smaller sites. See the data." lang: en --- Share Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fmixed-content-https-websites&text=659%2C120%20Secure%20Homepages%20Still%20Load%20Files%20Over%20Insecure%20HTTP Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fmixed-content-https-websites Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fmixed-content-https-websites Share on Reddit: https://www.reddit.com/submit?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fmixed-content-https-websites&title=659%2C120%20Secure%20Homepages%20Still%20Load%20Files%20Over%20Insecure%20HTTP **659,120** homepages served over secure HTTPS, 4.5% of them, still pull in at least one image, script or other file over insecure HTTP. Websites outside the 10 million most visited do it at more than twice the rate of the 10,000 most visited. Analysis of 14,502,945 HTTPS homepages · the public HTTP Archive crawl, September 2026 ## Key Findings 1. 1. **659,120** homepages served over secure HTTPS, 4.5% of them, still load at least one file over insecure HTTP. Copy stat 2. 2. **215,350** more homepages are still served entirely over insecure HTTP, bringing the share of homepages that fail the basic HTTPS test to 5.9%. Copy stat 3. 3. **5.1%** of HTTPS homepages outside the 10 million most visited websites load insecure files, more than twice the 2.4% of the 10,000 most visited. Copy stat 4. 4. **97%** of HTTPS homepages that load insecure files belong to websites outside the 1 million most visited. Copy stat 5. 5. Among the 1 million most visited websites the rate of insecure files barely moves, from **2.4%** to 2.7%, then jumps to 4.3% for websites ranked 1 million to 10 million. Copy stat ## Summary A dental practice moved its website to HTTPS and the address bar shows a padlock. The photo of the team on the homepage, though, was uploaded years ago with an http:// address. Chrome either upgrades that request or blocks it, so some visitors see a gap where the photo should be, and the page quietly stops being fully secure. That is mixed content: a secure HTTPS page that loads something, usually an image, script or font, over an insecure http:// connection. Browsers block some of these requests and upgrade others, so the result can be a broken layout, a missing image, a script that never runs or a lost padlock. An insecure file can also be read or altered on its way to the visitor. **659,120** HTTPS homepages still load at least one insecure file, 4.5% of all homepages served over HTTPS. Another 215,350 homepages skip HTTPS altogether. The problem is concentrated among less-visited websites, the ones least likely to have anyone checking browser warnings. ## What we measured We used the September 2026 HTTP Archive crawl, a public project that loads millions of homepages in a real browser each month and runs a set of page-quality tests on each one. One test lists every request on the page that uses plain HTTP. We took the 14,502,945 homepages served over HTTPS with a test result, counted those that failed it, counted the 215,350 homepages served entirely over plain HTTP, and split both groups by how popular each website is. HTTPS is the encrypted version of the web's basic protocol; browsers mark pages without it as "Not secure". A file is any separate resource a page loads, such as an image, stylesheet, script or font. Popularity groups rank websites by real Chrome visits, from the 10,000 most visited to those outside the top 10 million. ## 659,120 secure homepages still load insecure files 4.5% of homepages served over HTTPS still load at least one file over insecure HTTP. That is 659,120 homepages that did the hard part of moving to HTTPS and left something behind. Add the 215,350 homepages that never moved at all, and 5.9% of homepages fail the basic HTTPS test, about one in seventeen. For a business, mixed content rarely looks like a security problem. It looks like a missing photo, a form that will not submit or a padlock that disappears on one page, and visitors notice those before the owner does. ## Less-visited websites have twice the rate of the most popular Among popular websites mixed content is rare and flat: 2.4% of the 10,000 most visited HTTPS homepages have it, and the rate stays between 2.4% and 2.7% all the way to the millionth website. Below that it jumps, to 4.3% for websites ranked 1 million to 10 million and 5.1% beyond the top 10 million, more than twice the rate of the most visited. Share by website popularity 10,000 most visited 2.4% 10k to 100k 2.6% 100k to 1 million 2.7% 1 million to 10 million 4.3% Beyond the top 10 million 5.1% All websites 4.5% Source: Suff Digital analysis of 14,502,945 HTTPS homepages · the public HTTP Archive crawl, September 2026 | Website popularity | HTTPS homepages | Loading insecure files | Share | Homepages on HTTP only | | --- | --- | --- | --- | --- | | 10,000 most visited | 6,898 | 165 | 2.4% | 13 | | 10k to 100k | 62,220 | 1,630 | 2.6% | 227 | | 100k to 1 million | 666,367 | 17,781 | 2.7% | 4,152 | | 1 million to 10 million | 7,193,671 | 307,313 | 4.3% | 88,784 | | Beyond the top 10 million | 6,573,789 | 332,231 | 5.1% | 122,174 | | All websites | 14,502,945 | 659,120 | 4.5% | 215,350 | The less-visited web holds nearly all of the problem. Websites outside the top 1 million account for 639,544 of the 659,120 affected homepages, 97% of the total. Homepages served only over HTTP follow the same curve: 13 among the 10,000 most visited, against 122,174 beyond the top 10 million. ## Mixed content is left over from the move to HTTPS Most mixed content predates the switch to HTTPS. Images uploaded years ago were saved with full http:// addresses, theme files point at old file servers, and widgets from other companies were pasted in with whatever address they had at the time. Turning on HTTPS at the server changes none of that; each address has to be updated in the content. The same unfinished move shows up in links. In a separate Suff Digital study of small business websites, 37% still link to at least one http:// address. Loaded files do more harm than links, because the browser fetches them automatically on every visit, but both come from an HTTPS move that stopped at the server. ## What this means for website owners Open your homepage in Chrome, press F12 and look at the Console tab. Mixed content warnings list every insecure file by address. Fix each one by switching the address to https:// or hosting the file on your own website. On WordPress, a search and replace for your own http:// domain fixes most of them in one pass. Then add a Content-Security-Policy header with the upgrade-insecure-requests setting, which tells browsers to request every file over HTTPS, as a safety net for anything you missed, and check a few inner pages too. Our technical seo services (https://www.suffdigital.com/seo/technical-seo-services) include this check on every page of a website, alongside the redirects and certificates that make HTTPS work. ## Embed this research Paste this on your site to embed the charts. It links back to the source automatically.

Source: 659,120 Secure Homepages Still Load Files Over Insecure HTTP - Suff Digital

## Cite this study APA Suff Digital. (2026). 659,120 Secure Homepages Still Load Files Over Insecure HTTP. https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites Plain link 659,120 Secure Homepages Still Load Files Over Insecure HTTP - Suff Digital - https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites ## Frequently asked questions ### How many HTTPS websites have mixed content? ### Are popular websites better at avoiding mixed content? ### How many websites still do not use HTTPS at all? ### How do I find mixed content on my website? ## Related studies - Website Migration 37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses: https://www.suffdigital.com/resources/data-studies/http-links-on-https-sites - Website Migration 382,097 Websites Still Load a Google Analytics Tag That Stopped Working in 2023: https://www.suffdigital.com/resources/data-studies/universal-analytics-still-installed - Website Migration 24,332 Websites Still Run Drupal 7, 20 Months After Security Support Ended: https://www.suffdigital.com/resources/data-studies/drupal-7-sites-after-end-of-life - Website Migration 20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites: https://www.suffdigital.com/resources/data-studies/small-business-https-redirect ## Structured data ```json [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://www.suffdigital.com/#organization", "name": "Suff Digital", "alternateName": "Suff Digital Marketing", "url": "https://www.suffdigital.com/", "logo": { "@type": "ImageObject", "@id": "https://www.suffdigital.com/#logo", "url": "https://www.suffdigital.com/logo.png", "contentUrl": "https://www.suffdigital.com/logo.png", "caption": "Suff Digital" }, "image": { "@id": "https://www.suffdigital.com/#logo" }, "description": "Suff Digital is a full-stack digital marketing agency that turns websites into predictable revenue engines, SEO, paid media, content, CRO, and web design built around revenue, not vanity metrics.", "slogan": "Digital marketing built for what's next.", "email": "hello@suffdigital.com", "telephone": "+1-629-236-0099", "foundingDate": "2022", "founder": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO" }, "contactPoint": [ { "@type": "ContactPoint", "telephone": "+1-629-236-0099", "email": "hello@suffdigital.com", "contactType": "sales", "areaServed": "US", "availableLanguage": [ "en" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Nashville", "addressRegion": "TN", "postalCode": "37219", "addressCountry": "US" }, "areaServed": { "@type": "Country", "name": "United States" }, "sameAs": [ "https://www.linkedin.com/company/suff-digital/", "https://www.instagram.com/suffdigital/", "https://www.youtube.com/@suffdigitalmarketing", "https://www.tiktok.com/@suffdigital" ], "knowsAbout": [ "Search Engine Optimization", "Pay-Per-Click Advertising", "Paid Social Advertising", "Conversion Rate Optimization", "Web Design", "Digital PR", "Link Building", "Website Migration", "Website Maintenance and Support", "Technical SEO", "Local SEO", "AI Search Optimization" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Suff Digital Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Search Engine Optimization (SEO)", "url": "https://www.suffdigital.com/" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Pay-Per-Click (PPC) Advertising", "url": "https://www.suffdigital.com/services/ppc" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Paid Social Advertising", "url": "https://www.suffdigital.com/services/paid-social" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Conversion Rate Optimization (CRO)", "url": "https://www.suffdigital.com/services/cro" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Web Design", "url": "https://www.suffdigital.com/services/web-design" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Digital PR & Link Building", "url": "https://www.suffdigital.com/services/digital-pr" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Migration", "url": "https://www.suffdigital.com/services/website-migration" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Maintenance & Support", "url": "https://www.suffdigital.com/services/website-maintenance" } } ] } }, { "@type": "WebSite", "@id": "https://www.suffdigital.com/#website", "url": "https://www.suffdigital.com/", "name": "Suff Digital", "inLanguage": "en-US", "publisher": { "@id": "https://www.suffdigital.com/#organization" } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Article", "@id": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites#article", "headline": "659,120 Secure Homepages Still Load Files Over Insecure HTTP", "description": "659,120 homepages served over secure HTTPS, 4.5% of them, still pull in at least one image, script or other file over insecure HTTP. Websites outside the 10 million most visited do it at more than twice the rate of the 10,000 most visited.", "image": [ "https://www.suffdigital.com/images/suff-digital-share-16x9.jpg" ], "url": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites", "datePublished": "2026-09-24", "dateModified": "2026-09-24", "author": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO", "url": "https://www.suffdigital.com/who-we-are" }, "publisher": { "@id": "https://www.suffdigital.com/#organization" }, "mainEntityOfPage": { "@id": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites", "@type": "WebPage" }, "isPartOf": { "@id": "https://www.suffdigital.com/#website" } }, { "@type": "BreadcrumbList", "@id": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.suffdigital.com/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://www.suffdigital.com/resources" }, { "@type": "ListItem", "position": 3, "name": "Data Studies", "item": "https://www.suffdigital.com/resources/data-studies" }, { "@type": "ListItem", "position": 4, "name": "659,120 Secure Homepages Still Load Files Over Insecure HTTP" } ] }, { "@type": "Dataset", "@id": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites#dataset", "name": "659,120 Secure Homepages Still Load Files Over Insecure HTTP", "description": "659,120 homepages served over secure HTTPS, 4.5% of them, still pull in at least one image, script or other file over insecure HTTP. Websites outside the 10 million most visited do it at more than twice the rate of the 10,000 most visited.", "url": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites", "creator": { "@id": "https://www.suffdigital.com/#organization" }, "datePublished": "2026-09-24", "dateModified": "2026-09-24", "license": "https://creativecommons.org/licenses/by/4.0/", "isAccessibleForFree": true, "measurementTechnique": "The public HTTP Archive crawl and its page-quality test results" }, { "@type": "FAQPage", "@id": "https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites#faq", "mainEntity": [ { "@type": "Question", "name": "How many HTTPS websites have mixed content?", "acceptedAnswer": { "@type": "Answer", "text": "659,120 homepages served over HTTPS, 4.5% of them, still load at least one file over insecure HTTP (HTTP Archive, September 2026)." } }, { "@type": "Question", "name": "Are popular websites better at avoiding mixed content?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. 2.4% of the 10,000 most visited HTTPS homepages load insecure files, against 5.1% of HTTPS homepages outside the 10 million most visited." } }, { "@type": "Question", "name": "How many websites still do not use HTTPS at all?", "acceptedAnswer": { "@type": "Answer", "text": "215,350 homepages are still served entirely over insecure HTTP. Together with homepages that load insecure files, 5.9% of homepages fail the basic HTTPS test." } }, { "@type": "Question", "name": "How do I find mixed content on my website?", "acceptedAnswer": { "@type": "Answer", "text": "Open the browser console (F12 in Chrome) on each page. Mixed content warnings list every file loaded over http://, and 4.5% of HTTPS homepages have at least one." } } ] } ] } ] ```