DigitalBanzai Knowledge

Mixed Content

Why an HTTPS page can contain HTTP references, what may happen, and how to review them.

Italian version
Severity
Moderate
Estimated fix time
10-30 min
Technical level
Beginner / Intermediate
Applies to
WordPressStatic SitesCMS / E-commerceCDN / Third-Party Embeds

Quick answer

An HTTPS page uses a protected connection, but it may refer to images, scripts, or other resources at http:// addresses. This combination is called mixed content. Depending on the resource and browser, a reference may be blocked, handled another way, or reduce protection for that part of the page.

Why it may affect the page

If a needed resource is not loaded, a feature or visual element may not work as expected. If a resource is requested without HTTPS, that request lacks the same protection as the page. The guide shows Moderate, but the real effect depends on the resource and browser: an observed reference does not prove an attack or malfunction.

When it is worth checking

It is especially useful to check if the reference is part of an essential page feature or you notice content failing to load. This also matters after moving to HTTPS, when themes, plugins, or old content may still contain http:// URLs.

What TrustyRunner observes

TrustyRunner examines the starting page reached by the scan and resource references it can extract from its HTML and analyzed style contexts. It looks for http:// URLs only when the page's final address uses HTTPS. It does not open the page as a browser or verify whether a resource was actually loaded or blocked.

How to read the result

  • HTTP reference observed: at least one http:// address appears in the examined contexts of an HTTPS page. It is a specific point to review, not a measure of visitors' experience.
  • No reference observed: the result is conclusive only if resource extraction was complete in the analyzed scope.
  • Final page uses HTTP: the check does not apply because this test concerns HTTPS pages.

Truncated content, incomplete analysis, or an unavailable page can leave partial data: finding zero references then does not establish that none exist.

Find the reported reference in the content, theme, or configuration. Check that the same resource is available over HTTPS and works as expected before updating the address. If no suitable version exists, consider replacing or removing it. Test the page after each change.

Limits of this check

TrustyRunner does not simulate every browser, automatically identify which resources are blocked, or establish exploitation or overall site security. It examines only references available in the acquired page and contexts, not every page or dynamically loaded resource.

Verify with a new scan

Run a new scan and check whether the HTTP reference still appears in acquired data. To learn how the page actually works, also check its behavior in a browser.