coderef

Mixed content handlingBaseline · Widely available

When a document is loaded over HTTPS, browsers ensure that none of the document's resources are loaded over an insecure protocol. Instead, resources that the document attempts to load over an insecure protocol are either loaded over HTTPS or are blocked.

Supported in all major browsers for at least 30 months — safe to use without fallbacks. Baseline since Jan 15, 2020. Widely available since Jul 15, 2022.

Browser support

DesktopChrome
1–43Not supported
44+Supportedsince Jul 21, 2015
Current: 155
Edge
12–18Not supported
79+Supportedsince Jan 15, 2020
Current: 154
Firefox
1–22Not supported
23+Supportedsince Aug 6, 2013
Current: 157
Safari
1–9Not supported
≤9.1+Supportedsince Mar 21, 2016
Current: 27
MobileChrome Android
18–43Not supported
44+Supportedsince Jul 29, 2015
Current: 155
Firefox Android
4–22Not supported
23+Supportedsince Aug 6, 2013
Current: 157
Safari iOS
1–9Not supported
≤9.3+Supportedsince Mar 21, 2016
Current: 27

How to use

This feature is Baseline widely available — use it freely, no fallback needed.

Example

Full syntax and examples are on MDN: Mixed content.

Feature detection

There’s no simple runtime check for this feature; rely on the support table and test in your target browsers.

Sub-features

Support for each part of the feature (8). The overall table above shows when the whole feature works.

Sub-featureChromeEdgeFirefoxSafariChrome AndroidFirefox AndroidSafari iOS
http.mixed-content447923≤9.14423≤9.3
http.mixed-content.allow_file_urls≤797923✕≤7923✕
http.mixed-content.allow_localhost_url≤797984✕≤7984✕
http.mixed-content.allow_loopback_url≤797955✕≤7955✕
http.mixed-content.auto_upgrade_images8686127✕86127✕
http.mixed-content.auto_upgrade_video_audio8080127✕80127✕
http.mixed-content.block_mixed_downloads929290✕9290✕
http.mixed-content.blockable_mixed_content797923≤9.17923≤9.3