Mixed Content Checker

Detects HTTP resources loaded on HTTPS pages and checks for Content Security Policy upgrade-insecure-requests directive to prevent mixed content vulnerabilities.

What This Checker Validates

This checker crawls your HTTPS landing pages to identify mixed content vulnerabilities by:

Network Monitoring

• Monitors all network requests during page load

• Detects any HTTP:// URLs being requested from HTTPS pages

• Captures resource types (images, scripts, stylesheets, etc.)

DOM Analysis

• Scans HTML elements for HTTP URLs in src/href attributes:

  • 

Checker Output Documentation

Test Logic

1. Page Load: Navigate to HTTPS page with network monitoring

2. Resource Detection: Capture all HTTP requests and scan DOM for HTTP URLs

3. CSP Analysis: Check response headers and meta tags for upgrade-insecure-requests

4. Result Determination:

   • No HTTP resources → SUCCESS

   • HTTP resources + CSP upgrade → WARNING

   • HTTP resources + no CSP → FAIL

Security Risks of Mixed Content

High Risk - Active Mixed Content

• JavaScript over HTTP: Can be modified by attackers to inject malicious code

• Stylesheets over HTTP: Can be manipulated to hide content or create fake interfaces

• Iframes over HTTP: Can load malicious content in trusted context

Medium Risk - Passive Mixed Content

• Images over HTTP: Can be replaced with malicious content or tracking pixels

• Audio/Video over HTTP: Can be replaced with inappropriate content

Business Impact

• Browser Warnings: Modern browsers show "Not Secure" warnings

• SEO Penalties: Search engines may downrank sites with security issues

• User Trust: Visitors may leave due to security warnings

• Compliance: May violate security standards and regulations

• Data Interception: HTTP resources can be intercepted and modified by attackers