What actually is the difference between blocked mixed content and upgraded mixed content?

What actually is the difference between blocked mixed content and upgraded mixed content?

The distinction is enforced by the browser, defined in the W3C Mixed Content specification, and it is finer than "the padlock turned grey."

Mixed content is a resource loaded over plain HTTP on a page delivered over HTTPS. The spec splits it into two categories with different treatment.

Active mixed content — scripts, stylesheets, iframes, XMLHttpRequest/fetch — can rewrite the whole page, so it is blocked outright. The browser refuses to load it and logs a console error. There is no "proceed anyway" for these in modern browsers.

Passive (or "optionally-blockable") mixed content — images, audio, video — historically only downgraded the security indicator, because a tampered image can mislead but not execute. That tolerance is now closing: browsers increasingly auto-upgrade passive references to HTTPS and block on failure.

The operator's lever is the upgrade-insecure-requests Content Security Policy directive. It tells the browser to rewrite every http:// subresource on the page to https:// before fetching — a migration aid for sites with thousands of hardcoded HTTP URLs in legacy content. It does not relax security; it tightens it, and it does not affect navigation to other origins.

Note upgrade-insecure-requests differs from block-all-mixed-content, which blocks rather than rewrites.

Further reading: W3C Mixed Content spec; CSP Level 3, upgrade-insecure-requests.

Bottom line: active mixed content is always blocked, passive is increasingly auto-upgraded — and upgrade-insecure-requests rewrites HTTP subresources to HTTPS rather than letting them fail.