The Mixed Content Block
Google Chrome takes security very seriously. If you visit a website secured with HTTPS (showing the padlock icon), Chrome expects every single element on that page—images, scripts, and downloads—to also be delivered securely via HTTPS. If you click a download link on a secure page, but the actual file is hosted on an older, unencrypted HTTP server, Chrome classifies this as an “Insecure Download” (or mixed content) and automatically blocks it to protect you from man-in-the-middle attacks.
While this is an excellent security measure for everyday browsing, it can be infuriating if you are a developer testing legacy servers, or if you regularly use an older corporate intranet portal that hasn’t fully migrated to HTTPS. You click the download link, and Chrome silently refuses to act. You must manually override this block for specific sites.
How to Allow Insecure Downloads
You should not disable this globally. Instead, add an exception for the specific website you trust.
- Open Google Chrome and navigate to the website where your downloads are being blocked.
- Look at the far left side of the URL address bar and click on the Padlock icon (or the “Tune” icon in newer Chrome versions).
- In the dropdown menu, click on Site settings.
- A new settings tab will open specifically for this website. Scroll down the long list of permissions until you find Insecure content.
- Click the dropdown menu next to “Insecure content” and change it from “Block (default)” to Allow.
- Close the settings tab and return to your website. You will see a prompt to Reload the page to apply your updated settings.
Once the page reloads, Chrome will lower its shields specifically for that domain. You can now click the legacy HTTP download links, and the files will save to your computer without Chrome interfering.