What is mixed content on an HTTPS site
While applying HTTPS, it is essential to ensure only secure content on your site. Thus, all internal and external links to pictures, scripts, or other pages should be implemented relatively or over HTTPS protocol. It is recommended to apply links in a proportional form.
HTTPS pages are encrypted with TLS and protected from data theft. Mixed content makes your site fragile; it can undergo code altering if attacked. Subsequently, the connection fails to be secure.
In case an HTTPS page contains a link starting with http://, search systems identify it as "mixed content error" that degrades SEO.
According to W3C specification , browsers report warnings about pages with mixed content:
This error can be screened in Mozilla developer tools or in JavaScript console in Google Chrome tools.
Error warning in Chrome:
Error warning in Mozilla:
Mixed content types
There are two groups of mixed content, passive and active.
1. Passive mixed content includes generally accessible elements that do not allow obtaining any kind of confidential or financial data when hacked.
Stealing such data via an insecure protocol cannot bring financial gains to fraudsters. All they can succeed to do is garbling your site by changing this content.
Passive mixed content includes pictures, audio files, video materials, and other elements that intruders may replace with hard-hitting files, thus disrupting the resource's normal course of work.
2. Active mixed content includes scripts and frames that can seriously harm the site and its users if stolen. Src attributes of <script> and <iframe> tags are the foremost elements that refer to this type of content. Other endangered features are:
- href attribute of <link> tag;
- data attribute of <object> tag;
- URL parameter in CSS styles;
- XTMLHttpRequest including its queries.
In theory, this kind of mixed content may allow hackers to seize personal data, passwords, bank card numbers, etc. Even if users type in confidential information on a secure page, fraudsters can use scripts to arrange redirection to an unsafe resource where this important data will be stolen.
It is strongly recommended to avoid entering plastic card data if you have the slightest doubt about the site security.
Conclusion
Mixed content undermines site appearance and SEO; for this reason, it should be timely detected and removed. It contributes to SEO, helps to dismiss browser warnings, and ensures user security.
All browsers are obliged to inform users in case a site contains insecure elements; potential visitors may prefer a competitor site that provides safe content.
You can turn to developer tools to detect the problems manually; however, it may take very much time.
A resource should be scanned for insecure links shortly after the site was created or protected by https.
In order to deal with errors, you should replace the links with https://variant or upload required files directly to your server after downloading necessary information from other sites and then use relative links.
