Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
I have enabled https for my site. All images and files are served with https url, but favicon it is serving from http://example.com/sites/default/files/favicon.ico instead it should show as https://example.com/sites/default.files/favicon.ico. When I open the site in Firefox it is displaying below error message in console
Loading mixed (insecure) display content on a secure page "http://example.com/sites/default/files/favicon.ico"[Learn More]
Suggest me a way to resolve this.
I have also faced same situation where favicon is serving from http whereas all images including logo are serving from https. I am using Metatag module, in the module configuration default favicon path is given as http://example.com/sites.default/files/, so favicon is serving from http. I have changed the path to https://example.com/sites/default/files/favicon.ico. This fixes the problem, this may also the reason in your case.
If this is the case you can change the favicon default path, go to https://example.com/admin/config/search/metatags/config/global Under favicon and touch icon tab change the path.
May be some security reasons you can't upload by https:// but you can update favicon by below Process.
Please add below line into your /yourproject_folder/sites/all/themes/your_theme_name/your_theme_name.info
features[] = favicon
and place favicon.ico named files into /yourproject_folder/sites/all/themes/your_theme_name/
Check this blog may be it is helpful to solve your problem.
What is Mixed Content?
When a user visits a page served over HTTP, their connection is open for eavesdropping and man-in-the-middle (MITM) attacks. When a user visits a page served over HTTPS, their connection with the web server is authenticated and encrypted with SSL and hence safeguarded from eavesdroppers and MITM attacks.
However, if an HTTPS page includes HTTP content, the HTTP portion can be read or modified by attackers, even though the main page is served over HTTPS. When an HTTPS page has HTTP content, we call that content “mixed”. The webpage that the user is visiting is only partially encrypted, since some of the content is retrieved unencrypted over HTTP. The Mixed Content Blocker blocks certain HTTP requests on HTTPS pages.
What do I mean by “certain HTTP requests”? Why wouldn’t the Mixed Content Blocker just block all HTTP requests? To answer this question, I will first explain how the browser security community divides mixed content into two categories; Mixed Active Content and Mixed Passive Content.
