Matan · Security · Transport

Mixed content

An HTTPS page must not load scripts, images or iframes over http://.

Pass condition in our engine: No http:// subresource URLs on this HTTPS page.

1. Problem description

Browsers block mixed active content (scripts) and warn on mixed images. Attackers on the path can swap those assets. We scan src/href/action attributes for http:// on an https page.

2. Most common causes

  • Hard-coded http:// CDN URLs from 2014.
  • User-generated content with http images.
  • Form action="http://…".

3. How to fix it

  1. Change assets to https:// or protocol-relative URLs.
  2. Content-Security-Policy upgrade-insecure-requests as a safety net.
  3. Fix at the source, not only with a plugin that rewrites HTML.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report