I have a drupal 9 site where I use the media library. I've created a media type with source "External video", allowing youtube videos. As far as I can see this uses oEmbed.

I've added a media reference field for this type in a contenttype and created content. However, when I try to view the page the video won't show and I have a mixed content warning in the console of the browser.

Mixed Content: The page at 'https://xxx' was loaded over HTTPS, but requested an insecure frame
This request has been blocked; the content must be served over HTTPS.

I've set all correct settings for reverse proxy in settings.php, and the base url in the settings reflects this by showing https, but somehow this particular part of Drupal insists on using http, rather than https.

How can I make sure it requests this video frame using https?

  • What is your setting for I-Frame domain in /admin/config/media/media-settings?
    – Hudri
    Commented Feb 18, 2021 at 12:00
  • Haven't added anything there, it's still empty. Commented Feb 18, 2021 at 12:07
  • I'm having the same issue in a Drupal 10 site. But it varies depending on the server. In my local copy of the site, Drupal loads the iframe over https, so there is no problem. But on the remote server, Drupal loads the iframe over http, preventing the content from displaying and causing "mixed content" errors in the console.
    – arnoldbird
    Commented Apr 18 at 17:42

1 Answer 1


As @Hudri suggested, supply an iFrame domain at /admin/config/media/media-settings

See the help text below the field for further assistance.

Filling in this field with the site's URL (using the https protocol) resolved the issue for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.