It's highly unlikely that someone will perform a MITM attack with mixed content, but it is possible. I'm talking about external resources though. (resources which are not hosted on the current domain)

http://www.troyhunt.com/2013/06/unde...d-content.html
https://support.google.com/chrome/answer/1342714?hl=en
https://community.qualys.com/blogs/s...y-to-break-ssl
http://webmasters.stackexchange.com/...-https-session
http://www.securitee.org/files/mixedinc_isc2013.pdf

Correct, but even images hosted on external domains behind only http dont do any harm, they are categorized as passive and all browsers do that, correct?

Browsers warn you that there is mixed content when you have content coming from outside non https hosted domains, that is just warning the users that downloading certain content may be dangerous but it's not necessarily dangerous which is the case with images.

So only those elements which are not behind http can pose a threat or be unencrypted ... that is how I understand it works.

Browsers with good security will block it from being loaded, until you give it the okay to be. That would be Firefox/IE. Not sure if chrome does that yet.

On my site no browser blocks images behind just http, any scripts yes especially iframes , but images always load up without having to give the ok ... that's on all the browsers ...

My entire Vbulletin 4 forum is running though SSL/HTTPS, and it runs perfectly fine. I even installed some Optimized Addons to make the pages load faster.

I havent had any problems at all with running my forum on HTTPS.

Yeah, if someone posts an image from a site using HTTP with the Image BBCode, there will be a tiny little Yellow sign (Chrome) in your browser on top of the Padlock. But no one sees a Security Warning or anything like that. Honestly, you wouldn't even know about the Tiny Yellow Sign if you weren't looking for it, because it really isnt a big deal. If it was a big deal, the user will see a Big Security Warning before he or she enters the page.

But like I said, running SSL with vBulletin is fine. It runs really, really well. I have even setup my web.config (Windows Server 2008R2) to redirect users to HTTPS. So if they type in "mysite.com" in their address bar, it would redirect them to https://mysite.com.

I setup a Test Thread on my site, and I posted an image from tinypic.com that uses HTTP and not HTTPS.

Check it out for yourself:
https://thetechgenius.net/threads/4-Test-Thread

Using htaccess will be good way for this, do some researches for information. :)