I have enabled https for my site. All images and files are served with https url, but favicon it is serving from http://example.com/sites/default/files/favicon.ico instead it should show as https://example.com/sites/default.files/favicon.ico. When I open the site in Firefox it is displaying below error message in console

Loading mixed (insecure) display content on a secure page "http://example.com/sites/default/files/favicon.ico"[Learn More]

Suggest me a way to resolve this.

  • If you go to the admin for the theme, how does the favicon setting appear? Have you tried re-uploading the file? Nov 6, 2015 at 9:45
  • Yes I tried but getting the same
    – user50991
    Nov 6, 2015 at 9:45
  • Might be a bug in the theme code, if it's using a non-standard way of injecting the icon. Have you checked for that? Nov 6, 2015 at 9:50
  • Do you have metatag module. If yes then below answer might provide the solution.
    – Vamsi
    Dec 10, 2015 at 10:24

3 Answers 3


I have also faced same situation where favicon is serving from http whereas all images including logo are serving from https. I am using Metatag module, in the module configuration default favicon path is given as http://example.com/sites.default/files/, so favicon is serving from http. I have changed the path to https://example.com/sites/default/files/favicon.ico. This fixes the problem, this may also the reason in your case.

If this is the case you can change the favicon default path, go to https://example.com/admin/config/search/metatags/config/global Under favicon and touch icon tab change the path.

enter image description here


May be some security reasons you can't upload by https:// but you can update favicon by below Process.

Please add below line into your /yourproject_folder/sites/all/themes/your_theme_name/your_theme_name.info

features[] = favicon

and place favicon.ico named files into /yourproject_folder/sites/all/themes/your_theme_name/


Check this blog may be it is helpful to solve your problem.

What is Mixed Content?

When a user visits a page served over HTTP, their connection is open for eavesdropping and man-in-the-middle (MITM) attacks. When a user visits a page served over HTTPS, their connection with the web server is authenticated and encrypted with SSL and hence safeguarded from eavesdroppers and MITM attacks.

However, if an HTTPS page includes HTTP content, the HTTP portion can be read or modified by attackers, even though the main page is served over HTTPS. When an HTTPS page has HTTP content, we call that content “mixed”. The webpage that the user is visiting is only partially encrypted, since some of the content is retrieved unencrypted over HTTP. The Mixed Content Blocker blocks certain HTTP requests on HTTPS pages.

What do I mean by “certain HTTP requests”? Why wouldn’t the Mixed Content Blocker just block all HTTP requests? To answer this question, I will first explain how the browser security community divides mixed content into two categories; Mixed Active Content and Mixed Passive Content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy