You could also use an online crawler like SSL-check or Missing Padlock that will check your website recursively and find links to insecure content. The mixed content resource that was loaded via HTTP will show up in red, along with the text 'mixed content', which links to this page.Īs well as finding these warnings in the Web Console, you could use Content Security Policy (CSP) to report issues. The Firefox Web Console displays a mixed content warning message in the Net pane when a page on your website has this issue. Other resource types like web fonts and workers may be considered active mixed content, as they are in Chrome. All cases in CSS where a url() value is used ( cursor, background-image, and so forth).( href attribute) (this includes CSS stylesheets).This section lists some types of HTTP requests which are considered active content:

If the webpage is public and has no sensitive data about the user, using mixed active content still provides the attacker with the opportunity to redirect the user to other HTTP pages and steal HTTP cookies from those sites.

The webpage may have public data visible to the world or private data visible only when authenticated. The risk involved with mixed content does depend on the type of website the user is visiting and how sensitive the data exposed to that site may be. Malicious active content can steal the user's credentials, acquire sensitive data about the user, or attempt to install malware on the user's system (by leveraging vulnerabilities in the browser or its plugins, for example). The attacker can also rewrite the response to include malicious JavaScript code. In the mixed active content case, a man-in-the-middle attacker can intercept the request for the HTTP content. Hence, in addition to the risks described for mixed display content above, mixed active content is vulnerable to a few other attack vectors. This type of mixed content can alter the behavior of the HTTPS page and potentially steal sensitive data from the user. Mixed active content is content that has access to all or parts of the Document Object Model of the HTTPS page.

Most insecure browser