It's because you don't have https - most browser simply ignore such content nowadays, and if you embed it as an image it'll just disappear.
A direct link is better in that case.

I'm sure there's a switch somewhere in FF (or Chrom/e/ium) settings to re-enable mixed content, but that's the situation most users will be in.
It's sad because because "trusted" SSL certificates are clearly big business. Passive content without client-side scripting doesn't really require all that, but otoh the possibility of a MITM attack is still there.
Personally, I just bit the bullet and now spend ~25€/year on a certificate, but you can also use Letsencrypt for free. I hear they have it all automated so you basically just "install Letsencrypt".