Mixed Content Detection

Detects HTTP resources (images, scripts, stylesheets) loaded on HTTPS pages. Mixed content causes browser security warnings, can break functionality, and undermines the trust your SSL certificate provides.

How It Works

The standalone Mixed Content check fetches your monitor's URL (a single page) and inspects its resource references to identify any loaded over an insecure http:// connection. Even a single mixed content resource can trigger browser warnings or block rendering entirely in modern browsers.

The check only applies to HTTPS pages — if the monitor URL is not https://, the check is skipped (mixed content cannot occur on an HTTP page).

The following elements and inline styles are inspected: img, script, link[rel=stylesheet], iframe, video, audio, source, embed, object, and form, plus inline <style> blocks and style attributes referencing resources via url().

Whole-site scanning

The standalone check inspects only the monitor's single URL. To scan an entire site for mixed content across many pages, enable Detect mixed content on a Broken Links crawl, which checks every page it discovers.

For background, there are two conceptual categories of mixed content. Browsers treat them differently, but Hoppla does not classify findings into these categories:

Category	Description	Browser Behavior
Passive (optionally-blockable)	Images, audio, video	Warning in console, may display broken padlock
Active (blockable)	Scripts, stylesheets, iframes, fetch requests	Blocked by default in all modern browsers

Active mixed content is especially dangerous because a man-in-the-middle attacker could inject malicious code through the insecure resource.

Configuration

Setting	Description	Default
URL	The HTTPS page to scan	Monitor URL
Check interval	How often to scan	User-configurable

The set of inspected elements is fixed and cannot be configured per monitor.

Results

Each check result includes a count of mixed content items found and a list of the individual items (up to 100):

Field	Description
Total items	The number of mixed content resources found on the page
Resource URL	The http:// URL of the insecure resource
Element	The element it was found on (img, script, iframe, style, etc.)
Attribute	The attribute carrying the URL (src, href, data, action, url(), or style)

Example Result

3 mixed content item(s) found on https://example.com/about:
  - http://cdn.example.com/logo.png   (img, src)
  - http://cdn.example.com/app.js      (script, src)
  - http://maps.example.com/embed      (iframe, src)

Alerts

Event	Trigger	Severity
warning.mixed_content	One or more mixed content resources detected on the page	Warning

The warning includes the count of mixed content items found on the page. Mixed content matters most when it is active (scripts, stylesheets, iframes), because browsers block it by default and it will break functionality.

Common Fixes

• Replace http:// URLs with https:// or protocol-relative // URLs
• Use Content-Security-Policy: upgrade-insecure-requests as a blanket fix
• Update hardcoded URLs in your CMS, templates, or database
• Check third-party embeds and CDN references