Security: Mixed Content

HTML pages loaded over a secure HTTPS connection that have resources such as images, JavaScript or CSS that are loaded via an insecure HTTP connection.

Mixed content weakens HTTPS, and makes the pages easier for eavesdropping and compromising otherwise secure pages.

There are two types of mixed content: active and passive.

Passive mixed content, including images, video, and audio is of less risk, but most browsers will indicate it as ‘Not Secure’ in the address bar. Chrome will try and automatically upgrade some passive mixed content to HTTPS if available.

Active mixed content includes scripts, stylesheets and iframes that the browser can download and execute. This poses a greater risk, as attackers can control the page. Most browsers will block this content by default for users.

How to Analyse in the SEO Spider

Use the ‘Security’ tab and ‘Mixed Content’ filter to view these URLs.

HTTP resources can be viewed in the ‘outlinks’ tab for each URL, and exported alongside the pages they are on via ‘Bulk Export > Security > Mixed Content’.

What Triggers This Issue

This issue is triggered when a HTML page loaded over a secure HTTPS connection contains resources such as images, JavaScript, CSS, iframes or audio and video that are loaded via an insecure HTTP connection.

For example:

https://www.screamingfrog.co.uk/

Contains the image:

http://www.screamingfrog.co.uk/froggy.jpeg

How To Fix

All HTTP resources should be changed to HTTPS to avoid security issues, and problems loading in a browser.