What causes IE’s “This page contains both secure and nonsecure items” warning and how to…

What causes IE’s “This page contains both secure and nonsecure items” warning and how to remove it

This usually happens when a page secured with SSL requests an external resource that can’t be secured with SSL, such as CSS, an image or JavaScript from another server that doesn’t use SSL.

The usual advice is to look through the source for ‘http://’ where a resource is being loaded, then remove the call to get rid of the warning. But something else can also cause it. You usually start looking for that once you realize there’s no ‘http://’ anywhere in the source.

This excerpt from a Microsoft discussion makes it clear.

IE gives this message when the page contains objects from HTTP server instead of HTTPS server: such as css, js, img etc or when we reference about:blank as the src of an iframe.

So it can be images, stylesheets or JavaScript, but also an incorrectly defined ‘src’ attribute on an iframe. In my case it wasn’t defined at all, so IE treated it as ‘about:blank’. Once I set src correctly, the warning went away and the page now appears fully secure.

I took this entire article from our company wiki with permission from Budík, who wrote it. Thanks again for letting me publish it. I think it’ll help a lot of people.