Check Mixed Content (HTTP)

About Mixed Content Testing Tool

Mixed content simply means the web page you're visiting has been served securely (using "HTTPS") but is itself requesting some content (an image, for ex.) over non-secure connections ("HTTP").

It's a common mistake on web pages, as SSL is still somewhat of an afterthought when websites are deployed (for instance, do you have an SSL testing script in place?).

Why should you care?

Having mixed content on your website is terrible for two reasons.

First, the HTTP scripts can become a gateway for man-in-the-middle attacks, which SSL tries to prevent in the first place.

And second, having mixed content on a page causes browsers to show users a "not secure" warning. Besides, in many cases, the browsers block outgoing non-secure requests, which may cost you a substantial loss in web traffic.

How to fix mixed content?

The fix is simple, at least in theory: change all the URLs in your web pages to connect over "HTTPS" or other secure protocols. However, in practice, it's not as simple as the resource you're loading may not be available over HTTPS.

It's a shame that servers hosting analytics tools and public-facing APIs are still running over plain HTTP.

So, talk to the associated institution if you find that the HTTPS version of any resource isn't available (or worse, throws an SSL error) to get it fixed. Alternatively, you can host that specific resource on your web server if possible.