How do you eliminate mixed content systematically rather than chasing one warning at a time?

How do you eliminate mixed content systematically rather than chasing one warning at a time?

Mixed content is HTTPS pages loading sub-resources over HTTP. Browsers block active mixed content (scripts, iframes, XHR) outright and may upgrade or block passive content (images, media). The console warning shows symptoms; this playbook finds the source.

— Deploy Content-Security-Policy-Report-Only first with a reporting endpoint, so you collect every offending URL across real traffic before enforcing anything.
— Then add upgrade-insecure-requests to the CSP. It rewrites http to https for same-host and many cross-host sub-resources at request time, clearing the bulk automatically.
— Treat block-all-mixed-content as the strict fallback for resources that cannot be upgraded.
— Grep the codebase and database for hardcoded http:// in templates, stored CMS content, and email-rendered assets; protocol-relative // URLs are the safest legacy fix.
— Re-scan with the CSP report stream, not a single page load; passive resources only fire on the pages that use them.

Evidence vs. speculation: report-only data is ground truth; manual clicking misses conditionally-loaded assets.

Further reading: W3C Mixed Content specification; CSP Level 3, upgrade-insecure-requests.

Bottom line: upgrade in bulk via CSP, then hunt the residue the report stream names.