Mixed content is insecure because of active content to be very honest. Most people don&#x27;t care about passive, but of course, you can make some fake banner if you are able to MiTM. You&#x27;d like javascript coming from HTTPS rather than HTTP. HTTP itself is insecure but doesn&#x27;t mean every website has to be over HTTPS. However, given HTTPS is cheaper to deploy it should be encouraged. Do I really need HTTPS to show an album of cat photos I share with the world? No. But I do anyway.<p>However, the biggest challenge is actually internal traffic are almost always over HTTP, and the reason is almost always &quot;because self-signed cert is invalid.&quot; In some way this is okish since internal traffic is a darknet, but as we have proper toolset make Let&#x27;s Encrypt available, more people should consider deploying full SSL support for internal traffic as well. At this point, the toolchain to actually make Let&#x27;s Encrypt simple and useful is still, ugh, a little hackish. Cron job here and there. Sort of complicated process to get started...