Mixed Content Example
I rode into the Sultan's parlor at full gallop, and the rear half of my horse arrived by a less respectable road.
The short answer
- What it is
- Mixed content is an HTTPS page that embeds a resource over plain HTTP, such as an image, script, iframe, or stylesheet. A plain link to an HTTP page is a separate issue.
- Why it matters
- An attacker on the network can read or swap anything loaded over HTTP. Browsers respond by blocking or upgrading these files, which can break the page.
- How a crawler should report it
- Report one row per resource with the page URL, the http:// resource URL, and its type: image, script, iframe, or stylesheet. Mark active types as high severity, because browsers block them by default.
- Live examples
/lab/mixed-content/(positive)/lab/mixed-content/near-miss/(near miss)
Insecure Files Loading Inside a Secure Page
Mixed content occurs when a secure page pulls in a file over an insecure connection. The HTML arrives over HTTPS, but a tag asks for http://example.com/banner.png. That one request is exposed. Most cases date from a move to HTTPS. Old posts keep hard-coded image URLs. Themes keep HTTP links in their settings. A third-party widget may also load its own files over HTTP, which is harder to spot.
Browsers split these files by risk. Scripts, stylesheets, and iframes can change or read the page, so browsers block them outright. Images, audio, and video have less power. Chrome and other modern browsers try to upgrade them to HTTPS and don't fall back if that fails. So a page can lose its styles or its menu with no visible error. The padlock can also change, and a warning may appear.
Search engines fetch pages much as a browser does. If a blocked script builds the main content, a rendered copy may be missing that content. If an image fails, it can drop out of image search. Google hasn't said that mixed content is a ranking penalty on its own. The harm comes from broken pages and lost trust. Page experience also suffers when a design falls apart.
To detect it, scan the source of each HTTPS page for http:// in src and stylesheet href values. Then open key pages in a browser and read the console, since scripts can add files later. To fix it, switch each URL to HTTPS once you confirm the file loads there. Update your database and theme settings, not just the templates. The Content-Security-Policy: upgrade-insecure-requests header is a good safety net. If a host has no HTTPS, copy the file to your own server or remove it.