Home/ Glossary/ Mixed Content

Mixed Content (Mixed Content)

Security Glossary - SSL/TLS

Definition: Mixed content occurs when an HTTPS page loads sub-resources (images, scripts, stylesheets, iframes) over plain HTTP. This creates a security vulnerability because the HTTP resources can be intercepted and modified by an attacker, even though the main page was loaded securely over HTTPS.

Why You Should Care About Mixed Content

Mixed content undermines the security that HTTPS provides. If an HTTPS page requests a script over HTTP, an attacker on the network could replace that response with malicious code.

Current web-platform guidance classifies mixed content as upgradable or blockable. Browsers may automatically rewrite some image, audio, and video requests from HTTP to HTTPS. More dangerous resource types, and requests that cannot be safely upgraded, are blocked. This can create both security problems and broken functionality.

Fix the source URLs to use HTTPS. Do not replace them with protocol-relative URLs, which inherit an insecure scheme when a page is reached over HTTP. The upgrade-insecure-requests CSP directive can provide migration defense-in-depth, but the destination still needs to support HTTPS.

Testing Your Configuration

Use browser developer tools and a crawler that renders representative pages to find mixed-content requests. DomainOptic checks HTTPS and headers but does not guarantee a complete mixed-content crawl. Fix source URLs, then use upgrade-insecure-requests only as defense-in-depth.

See how your site handles Mixed Content

Run a Security Audit

Questions and Answers

How do I find mixed content on my site?
Check the browser developer-tools Console and Network panels on representative pages, then use a rendered crawler for broader coverage. Search templates and stored content for HTTP resource URLs. DomainOptic does not claim a complete mixed-content crawl.
What is the upgrade-insecure-requests directive?
It is a CSP directive that tells the browser to automatically upgrade HTTP resource requests to HTTPS before fetching them. Adding Content-Security-Policy: upgrade-insecure-requests as a header is a quick fix for mixed content caused by hardcoded HTTP URLs.

Learn More

Hypertext Transfer Protocol Secure Content Security Policy upgrade-insecure-requests CSP Directive block-all-mixed-content CSP Directive SSL/TLS Certificate
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.