When you visit a webpage that contains insecure content, Firefox blocks that content and displays the shield icon in the address bar. We'll explain what is mixed content, why Firefox blocks it and what options you have.

HTTP is a system for transmitting information from a web server to your browser. HTTP is not secure, so when you visit a page served over HTTP, your connection is open for eavesdropping and man-in-the-middle attacks. Most websites are served over HTTP because they don't involve passing sensitive information back and forth and do not need to be secured.

When you visit a page fully transmitted over HTTPS, such as your bank, you'll see a padlockgreen padlock padlock icon in the address bar (For details, see How do I tell if my connection to a website is secure?). This means that your connection is authenticated and encrypted, and thus safeguarded from both eavesdroppers and man-in-the-middle attacks.

However, if the HTTPS page you visit includes HTTP content, the HTTP portion can be read or modified by attackers, even though the main page is served over HTTPS. When an HTTPS page has HTTP content, we call that content “mixed”. The page you are visiting is only partially encrypted and even though it appears to be secure, it isn't. For more information about mixed content (active and passive), see this blog post.

What options do I have?

Most websites will continue to work normally without any action on your part.

If you need to allow the mixed content to be loaded, displayed or executed, you can do that easily:

• Click the shield icon in the address bar, click Options and choose Disable protection for now.

• The icon in the address bar will change to an orange warning triangle to remind you that insecure content is being displayed.

Firefox protects you from attacks by blocking potentially harmful, insecure content on web pages. Keep reading to learn more about mixed content and how to tell when Firefox has blocked it.

HTTP is a system for transmitting information from a web server to your browser. HTTP is not secure, so when you visit a page served over HTTP, your connection is open for eavesdropping and man-in-the-middle attacks. Most websites are served over HTTP because they don't involve passing sensitive information back and forth and do not need to be secured.

When you visit a page fully transmitted over HTTPS, such as your bank, you'll see a padlockgreen padlock padlock icon in the address bar (For details, see How do I tell if my connection to a website is secure?). This means that your connection is authenticated and encrypted, and thus safeguarded from both eavesdroppers and man-in-the-middle attacks.

However, if the HTTPS page you visit includes HTTP content, the HTTP portion can be read or modified by attackers, even though the main page is served over HTTPS. When an HTTPS page has HTTP content, we call that content “mixed”. The page you are visiting is only partially encrypted and even though it appears to be secure, it isn't. For more information about mixed content (active and passive), see this blog post.

How can I tell if a page has mixed content?

Look for an icon in your address bar to determine if the page has mixed content.

No mixed content: secure

• : You’ll see a green lock when you are on a fully secure page that doesn’t attempt to load any insecure elements.

Mixed content is blocked: secure

• : You'll see a green lock with a grey warning triangle when Firefox has blocked any insecure elements on the page. This means that the page is now secure. Click on the icon to expand the Control Center and see more security details about that page.

Mixed content is not blocked: not secure

• : If you see a lock with a red line over it, Firefox is not blocking insecure elements, and that page is open to eavesdropping and attacks where your personal data from the site could be stolen. Unless you’ve unblocked mixed content using the instructions in the next section, you shouldn’t see this icon.

• : A grey lock with an orange triangle indicates that Firefox is not blocking insecure passive content. Attackers may be able to manipulate parts of the page, for example, by displaying misleading or inappropriate content, but they shouldn’t be able to steal your personal data from the site.

Unblock mixed content

Unblocking insecure elements is not recommended, but can be done if necessary:

1. Click the lock icon in the address bar.
2. Click the arrow on the Control Center:

   

3. Click Disable protection for now.

   

To enable protection, follow the preceding steps and click Enable protection.