What the inventory shows
Images, fonts, videos, or site features may come from outside services. This inventory helps you recognize those services and decide whether you meant to use them. An unexpected service is worth checking; its presence alone does not establish a problem.
An external dependency is a reference in an examined page to a resource on a different origin from that page. An origin includes the scheme, host name, and effective port. For example, https://www.example.com and https://cdn.example.com are different origins. So are http://example.com and https://example.com; a different explicit port, such as https://example.com:8443, identifies a different origin.
TrustyRunner Light groups the static references it could extract from captured pages by external origin for that scan. An external origin is often expected: a site may use images, fonts, stylesheets, or embedded content hosted elsewhere. Before changing anything, compare the list with resources you intended to use.
The inventory does not test for vulnerabilities, identify who operates an origin, or observe every request a browser might make when it runs the page.
What the observed resource types mean
Types describe where a reference was found in the page. They do not confirm that the resource loaded successfully.
- Script: a JavaScript file referenced by the page.
- Stylesheet: a stylesheet linked from the page.
- Style reference: a resource URL found in a style context, such as a background image.
- Image: an image referenced in examined content or image attributes.
- Iframe / embed / object: outside content inserted or embedded in the page; the type names the observed element.
- Video / audio / source: a media reference or a declared source for a media element.
- Preload / font preload: a resource marked for early loading; font preload means the page declares it as a font. This describes markup, not a confirmed load.
You may also see other link for another resource link declared in the page, such as an icon. Ordinary navigation links are excluded.
How to read counts and example pages
- Pages observed: the number of captured pages with at least one static reference to this origin. It counts distinct pages within the available scan coverage, not every page on the site.
- Captured references: the number of distinct static references to this origin retained and evaluated. One page can contribute several references; this is not a count of visits, browser requests, or loaded files.
- Example source pages: some pages where the origin was observed. Displayed URLs omit queries and fragments; an indicator may show that a query was removed.
Example pages belong to the origin as a whole. A listed page is not necessarily the exact page containing an HTTP reference from HTTPS or any particular resource type. To find a specific reference, inspect the markup, content, or configuration that generates resources on relevant pages.
How to review an origin
If you did not expect it
Check the host name and observed types, then compare them with the themes, plugins, services, and content you chose to use. Search templates and content for references to the same origin. If you cannot explain it, involve whoever manages the site before removing references. An unexpected origin is a reason to investigate, not proof of a problem.
If it appears on many pages
Check whether a shared element, such as the layout, theme, or a common component, adds the reference. Confirm that it is still needed and configured as intended. The page count shows how widespread it is among examined pages; by itself, it does not measure impact, performance, or priority.
If it has several resource types
The same origin can host, for example, scripts and stylesheets. The types help you decide which parts of the site to inspect. Their combination is information, not an alarm: counts and example pages apply to the origin overall, not separately to each type.
HTTPS page with an HTTP reference to an external origin
What was observed
On at least one examined HTTPS page, TrustyRunner found a static reference to an http:// resource on a different origin. This is a relationship observed in captured content. It does not prove that a browser loaded or blocked the resource, and it does not establish a vulnerability.
Why review it
An HTTP reference on an HTTPS page is worth checking because actual behavior can depend on the resource type and browser. This observation alone cannot tell you what happened for visitors.
What to do
- Find the HTTP reference that produces this relationship in the markup, CMS, theme, or configuration. The listed source pages are examples for the origin, so they may not contain that specific HTTP reference.
- Try the same resource over
https://and verify that it is available and serves the expected content. Do not change the scheme in the URL without checking the destination. - If the HTTPS version works and is appropriate, update the reference where it is generated and check that the page still works. If no suitable HTTPS version exists, consider replacing or removing the resource.
- Run a new scan and check whether an HTTP reference is still observed in the pages examined again. Take any partial coverage into account before interpreting its absence.
For the dedicated check's behavior, read the Mixed Content guide.
Coverage and no observed origins
The per-scan inventory has limits on the pages and references examined, origins retained, and examples shown. If the report indicates partial coverage, read it as: Partial inventory: some pages or resources may not appear.
If the list is empty, the accurate conclusion is: No external origins observed in the examined pages. The result still applies only to that scan and its coverage.