Detects HTTP resources on HTTPS pages and CSP upgrade directive
Detects HTTP resources loaded on HTTPS pages and checks for Content Security Policy upgrade-insecure-requests directive to prevent mixed content vulnerabilities.
This checker crawls your HTTPS landing pages to identify mixed content vulnerabilities by:
Monitors all network requests during page load
Detects any HTTP:// URLs being requested from HTTPS pages
Captures resource types (images, scripts, stylesheets, etc.)
Scans HTML elements for HTTP URLs in src/href attributes:
<img src="http://...">
<script src="http://...">
<link href="http://...">
<iframe src="http://...">
<video> and <audio> elements
Examines HTTP response headers for Content-Security-Policy
Looks for upgrade-insecure-requests directive
Also checks for CSP meta tags as fallback
Determines if mixed content will be automatically upgraded to HTTPS
| Output | Condition | Description | Action Required |
|---|---|---|---|
| ✅ SUCCESS | No mixed content found | All resources (images, scripts, stylesheets, etc.) are loaded over HTTPS or use relative URLs | ✅ No action needed - your site is secure |
| ⚠️ WARNING | Mixed content found + CSP upgrade directive | HTTP resources detected, but Content-Security-Policy: upgrade-insecure-requests header is present | 🔍 Monitor: CSP will auto-upgrade HTTP to HTTPS, but consider updating URLs to HTTPS directly |
| ❌ FAIL | Mixed content found + no CSP protection | HTTP resources detected without CSP upgrade-insecure-requests directive | 🚨 Fix Required: Update all HTTP URLs to HTTPS or add CSP upgrade directive |
Page Load: Navigate to HTTPS page with network monitoring
Resource Detection: Capture all HTTP requests and scan DOM for HTTP URLs
CSP Analysis: Check response headers and meta tags for upgrade-insecure-requests
Result Determination:
No HTTP resources → SUCCESS
HTTP resources + CSP upgrade → WARNING
HTTP resources + no CSP → FAIL
JavaScript over HTTP: Can be modified by attackers to inject malicious code
Stylesheets over HTTP: Can be manipulated to hide content or create fake interfaces
Iframes over HTTP: Can load malicious content in trusted context
Images over HTTP: Can be replaced with malicious content or tracking pixels
Audio/Video over HTTP: Can be replaced with inappropriate content
Browser Warnings: Modern browsers show "Not Secure" warnings
SEO Penalties: Search engines may downrank sites with security issues
User Trust: Visitors may leave due to security warnings
Compliance: May violate security standards and regulations
Data Interception: HTTP resources can be intercepted and modified by attackers
Add this auditor to your monitoring setup and start identifying issues on your websites today.