Third-party embeds and widgets — social media buttons, video embeds, chat widgets, old ad tags — are a common, easy-to-miss source of mixed content warnings after an otherwise successful HTTPS migration, since they often live in areas of a CMS (widget settings, custom code blocks) that a database search-and-replace doesn't always reach.
Where to look
- Embedded video or map iframes with a hardcoded http:// source URL
- Old social sharing widgets or badges pulling assets from an http:// CDN
- Custom HTML/JS code blocks added manually to a page, outside your CMS's normal content editor
- Third-party analytics or chat widget scripts loaded via a hardcoded http:// script tag
Fixing it
Most modern embed providers offer an https:// version of their embed code — regenerating the embed from the provider's current tool usually resolves it. For genuinely abandoned or unmaintained third-party services still only offering http://, you may need to remove the embed entirely, since there's often no way to force HTTPS on content you don't control the source of.
Why old embeds are one of the last things people think to check
Embedded content added years ago, an old YouTube embed, a social sharing widget, is easy to forget about specifically because it usually sits quietly working without requiring any regular attention — it's only during a protocol migration that its potentially outdated, hardcoded http:// source becomes a visible problem.
What to do about an embed provider that never updated to offer HTTPS
For a genuinely abandoned or unmaintained third-party service still only offering an http:// embed with no HTTPS alternative available, removing the embed entirely is usually the only real option, since there's no way to force HTTPS on content whose source you don't control.
Why checking analytics and marketing pixels deserves its own specific pass
Beyond visible content embeds, marketing and analytics pixels loaded via a hardcoded http:// script tag can silently fail to load entirely under strict mixed content blocking, affecting your data collection without any visible, obvious symptom on the page itself — worth checking specifically as part of a mixed content audit.
What a Content Security Policy header can do to help catch this category of issue
A CSP header configured with upgrade-insecure-requests or a report-only mode can help identify remaining insecure resource references across your site systematically, functioning as an automated detection mechanism beyond manually checking DevTools console output page by page.
How to audit your site systematically for third-party embeds rather than relying on memory
Crawling your own site with a tool capable of flagging http:// resource references across every page, rather than relying on memory of what embeds exist where, catches forgotten embeds on older, less-visited pages that a manual review of recently active content would likely miss.
Why some embed platforms require re-generating rather than just editing existing embed code
Some third-party embed providers tie their embed code to a specific protocol at generation time, meaning simply editing the existing embed's URL from http to https doesn't always work correctly — regenerating the embed code fresh from the provider's current tool is sometimes necessary rather than manually editing old code.
A closing recommendation for maintaining ongoing embed hygiene
Treating third-party embed auditing as a periodic maintenance task rather than a one-time migration step catches new embeds added over time before they accumulate into the same kind of forgotten, hardcoded-URL problem the original migration had to clean up.
What browser extensions exist specifically to help find mixed content at scale
Several browser extensions and dedicated web-based scanning tools can crawl an entire site systematically and report every mixed content instance found across all pages, considerably faster than manually checking DevTools console output page by page for a site with many pages.
How to prioritize which embeds to fix first on a page with many of them
Prioritizing active content (scripts, iframes) over passive content (images) makes sense given browsers block active mixed content outright, and prioritizing your highest-traffic pages over rarely visited ones ensures the most visible issues get addressed first when facing a large backlog of embeds to review.