In some pages that have Google Ads, Chrome Dev Tools console shows the warning for a Passive Mixed Content:

Mixed Content: The page at '...' was loaded over HTTPS, but requested an insecure image

My site is not HTTPS, and I obviously could not control the images the ads show. If I use

Content-Security-Policy: block-all-mixed-content

, the ads might not show. Will adding

Content-Security-Policy: upgrade-insecure-requests

be a good idea, or should I even be concerned about this?

2 Answers 2


First move your site to https because as of July 2018 Google chrome has started marking HTTP sites as not secure and I think other browsers will follow the suit. Link to official news

As for the CSP, I would recommend going with Content-Security-Policy: upgrade-insecure-requests. This requests a https resource and if not available the request fails and the resource is not loaded.

Why not to go with Content-Security-Policy: block-all-mixed-content - we will make mistakes once in a while till everyone is all caught up with HTTPS and no one uses HTTP anymore. Your favicon, logo or other resource might call HTTP request once in a while and that might block your main content.

upgrade-insecure-requests gives us an alternative to blocking it straight away than requesting a secure resource.

Assumption : Your site is not requesting too many 3rd party plugins or scripts or is an engine that calls 3rd party scripts to render content on your website. If yes, then by all means take precaution and use block-all-mixed-content


I believe that this topic is covered adequately somewhere else on the internet already.

I suspect that if you are using new ad code then the protocol is not specified in the code per this example.

I suspect but, cannot prove, that if you re-insert http into the code where it is missing before // then you may find that this resolves the issue. It is certainly a bug-bear when browsing.

I will update the answer if there is feedback.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.