og:image is served over HTTP
Your og:image URL starts with http:// rather than https://. X refuses these outright and other platforms treat them inconsistently. Here is how to fix it.
What you are seeing: Your card renders on Facebook but the image is blank on X, or the image appears for some people and not others.
Why the protocol matters here
Preview cards are rendered inside pages that are themselves served over HTTPS. Pulling an image over plain HTTP into an HTTPS page is mixed content, and browsers block it. X does not attempt the request at all — a non-HTTPS og:image is simply treated as no image.
Other platforms are less strict but not reliable. Facebook will often fetch an HTTP image and re-host it, so the card looks fine there while being broken on X. That inconsistency is what makes this hard to spot: the preview works in whichever debugger you happened to check first.
The fix is usually one character
If your image host already serves HTTPS — and almost every host and CDN does — change http:// to https:// in the tag and you are done. Confirm the HTTPS URL actually loads in a browser first, since some older setups have a certificate that only covers the apex domain and not the subdomain the images sit on.
When you cannot move the image
The Open Graph spec provides og:image:secure_url for exactly this case. Leave og:image pointing at the HTTP URL for older consumers and add og:image:secure_url with the HTTPS equivalent alongside it. Platforms that require HTTPS use the secure variant.
Treat this as a stopgap. If the image genuinely has no HTTPS URL, the practical fix is to move it to a host that provides one rather than to maintain two tags indefinitely.
Prefer a single HTTPS URL
<meta property="og:image" content="https://example.com/og.png" />
<!-- Only if the image cannot move off HTTP -->
<meta property="og:image" content="http://example.com/og.png" />
<meta property="og:image:secure_url" content="https://example.com/og.png" />Frequently asked
My site is HTTP-only. Does that change anything?
No. The requirement is on the image URL, not your page, because the card is rendered inside the platform's own HTTPS interface. An HTTP image will still be blocked on X even if your page is HTTP too.
Does a protocol-relative URL like //example.com/og.png work?
No. Crawlers read the tag out of raw HTML without a page context to resolve against, so og:image needs a fully absolute URL including the scheme. Protocol-relative URLs are treated as invalid.
Check your page
Run your URL through the checker to confirm the fix is live and see how the card renders on every platform.
Test a URL
ZippyStarter