Symptom: mixed content blocked on HTTPS site

Browsers block or upgrade insecure http:// requests made from an https:// page (mixed content), so scripts, API calls or images silently fail after deploy. Change those URLs to https://, including API base URLs in env vars.

Cause: The HTTPS page loads resources or calls APIs over plain HTTP.

How to fix it

Open the browser console to find the http:// URLs.
Switch them to https:// (API base URLs, images, scripts).
Make sure your API/backend serves HTTPS.
Consider a Content-Security-Policy: upgrade-insecure-requests header as a safety net.

Example

Illustrative example, not from a customer project.

- VITE_API_URL=http://api.example.com
+ VITE_API_URL=https://api.example.com

FAQ

Why does it work locally?

Local dev usually runs on http://, so nothing is mixed.

Are images blocked too?

Browsers may upgrade some images to https; scripts and fetches are blocked.

Get a $149 diagnosis See pricing Launching soon? The Launch Path gets you ready for $1,195 flat.

Fixed, or we keep working free until it is (within the written scope).
A human reviews every fix before it ships.
read-only access; fixes arrive as pull requests you merge
Your $149 diagnosis is credited in full toward any paid job.