Matan · Security · Transport

Mixed content (Security)

An HTTPS page must not load scripts, images or iframes over http://.

Pass condition in our engine: No http:// subresource URLs on this HTTPS page.

This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.

1. Problem description

Browsers block mixed active content (scripts) and warn on mixed images. Attackers on the path can swap those assets. We scan src/href/action attributes for http:// on an https page.

2. Most common causes

  • Hard-coded http:// CDN URLs from 2014.
  • User-generated content with http images.
  • Form action="http://…".

3. How to fix it

  1. Change assets to https:// or protocol-relative URLs.
  2. Content-Security-Policy upgrade-insecure-requests as a safety net.
  3. Fix at the source, not only with a plugin that rewrites HTML.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free website audit

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Analyze My Website — FreeView sample report