Mixed content

highsecurity-mixed-content

Mixed content is an http:// resource loading on an https:// page. Why browsers block or warn on it, and how the fix is usually one string.

What it is

Mixed content is any http:// resource — a script, stylesheet, image or iframe — loaded on a page served over https://. The page itself is encrypted; the mixed-content resource is not.

Modern browsers block the highest-risk kind (scripts and stylesheets) outright and show a warning or broken-lock icon for the rest.

Why it matters

Every http:// request is visible and modifiable in transit, so a script loaded that way can be swapped out by anyone between the visitor and the server — on a page that's otherwise protected by TLS. It's usually left over from a domain migration or a third-party embed that never updated its own URLs.

The fix is almost always changing one string, for the specific resource the browser is warning about: http:// becomes https://, or a protocol-relative //.

How to fix it

with a reference doc
html
<!-- before -->
<script src="http://cdn.example.com/widget.js"></script>

<!-- after -->
<script src="https://cdn.example.com/widget.js"></script>

Reference documentation

Related checks

3
criticalSSL certificate validityThis checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.lowContent-Security-Policy headerContent-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

See whether your own site passes mixed content.

One page, all 75 checks, free. No account, no card.

Run a scan