Not-for-profit hobby site/community with a couple hundred regular users. Have been running https with Let's Encrypt certs for a year but not advertising or defaulting to it. No legacy systems or other entanglements.
There is a forum that allows users to post inline images and media from other domains.
Depending on your server setup, if you run multiple web domains from the same server then web clients that do not support SNI may fail[2].
You could do this quite subtly as a way to influence people by making certain figures appear more sinister.
These warnings tend to get tougher over time, so what's grey now may be red next year.
Surely the GP wouldn't have asked the question they did if their https site was already broken...
1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
Let's Encrypt certs work on pretty much every device. (Some Comodo certs don't work on older Android, for instance - we hit this at work and switched those sites to Let's Encrypt, problem solved.)
Add the header "Content-Security-Policy: upgrade-insecure-requests" and the mixed content errors will go away, but you'll experience a new problem.
About 30% of images/avatars will break, and of those, roughly 10% of them will cause the page loading animation to keep going for 2-3 minutes before finally timing out. I presume this is due to some sort of server misconfiguration on their part, as most non-HTTPS sites fail fast.
Give it a few months and users will slowly update their avatars and stick to sources that support HTTPS (like imgur), but don't expect the problem to ever go away completely.
Eg. https://yourdomain.com/usercontent/worldofcats.com/foobar.jp...
There exist simple php scripts which can do that for you. Beware to sanitize the URL very well, and probably enforce file size rules.
Plus TLS false start and TLS resumption are already here and work great for repeat visits to remove that extra overhead.
Performance isn't an excuse for not using TLS anymore.