i just discovered that firefox got two settings for mixed content (websites with TLS encryption that load things without):

security.mixed_content.block_active_content

and

security.mixed_content.block_display_content

while the first one is enabled since a couple versions, the latter is not.

As far as i can tell the split it into two settings after introducing the flag since completely blocking mixed_content broke too may sites. I’d suggest blocking display content too, most mixed content is ads anway.