Check Mixed Content (HTTP)

Mixed content simply means the web page you’re visiting has been served securely (using “https”) but is itself requesting content over non-secure connections (“http”) in some or all cases.

It’s a common mistake on web pages, as SSL is still somewhat of an afterthought when websites are deployed (for instance, do you have an SSL testing script in place?).

Why you should care?

Having mixed content on your website is bad for two reasons: 1) the scripts you are loading over http become a gateway for man-in-the-middle attacks, which is what SSL tries to prevent in the first place; 2) having mixed content on a page causes browsers to show a “not secure” warning to users, and in many cases browsers simply block outgoing non-secure requests.

How to fix mixed content?

The fix is simple, at least in theory: change all the URLs in your web pages to begin with “https” or other secure protocols. However, in practice, it’s not so simple as the resource you’re loading may not be available over https.

It’s a shame that servers hosting analytics tools and public-facing APIs are still being run over plain http, but it happens more often than not. If you find that the https version of the resource isn’t available (or worse, throws an SSL error) talk to that company to get it fixed.