Does your HTTPS page load insecure resources?
It separates insecure active resources from pages with insecure images only.
What Check Engine measures
The check runs on HTTPS sites. It scans successful pages for HTTP images, scripts, stylesheets and frames. Insecure scripts, styles or frames produce high severity. Image-only cases produce medium severity. A page counted in the active group is counted there once, even if it also has an insecure image.
The check reads resource addresses and types from successful pages. It does not test every feature in a browser. Review the actual file response before changing its URL.
How to read the result
Active mixed content is high severity and image-only mixed content medium. The report describes the resource addresses observed in markup rather than claiming to have measured every resulting browser error.
Why it matters
A secure document can refer to resources through a different scheme. Separating executable or embedded content from images keeps the report tied to the types of resources that actually produced the finding.
How to fix it
Replace insecure resource addresses with working secure equivalents and verify that the resource exists there. Update shared templates or stored content that supplies the old addresses. Remove an obsolete resource when it has no useful role. Check the browser for loading errors after editing, since changing the scheme text alone does not guarantee that the remote server supports it.
How to redirect http:// to https://
What we found in field audits
Problems in Security & trust were found on 14 of the 14 sites we audited. These are area totals. Read the field-audit method.
Method note
backend/seo_engine/checks/security.py, mixed_content, revision 0bb8e8d3.
Common questions
Are insecure scripts treated more seriously than insecure images?
Yes. Scripts and other active resources get high severity. An image-only case receives medium.
Which resource types are checked for mixed content?
The scanned types are images, scripts, stylesheets and frames using HTTP addresses on successful secure pages. Saved markup supplies the resource addresses.
Does the mixed-content check also run on an HTTP-only site?
No. Only HTTPS sites enter the check. It looks for insecure resources within that secure-page context.