Skip to content

Mixed Content Detection

Catch HTTP resources on HTTPS pages before visitors see "Not Secure"

A single HTTP image on an HTTPS page triggers a browser security warning. A HTTP script breaks the page entirely. Mixed content creeps in after CMS updates, plugin installs, and content editor mistakes — and your uptime monitor never fires. Sitewatch scans for mixed content across all 9 resource types on every check, automatically.

  • 9 resource types scanned: scripts, images, stylesheets, iframes, video, audio, objects, embeds, and media
  • Active mixed content (scripts, iframes) flagged critical — browsers block these entirely
  • Passive mixed content (images, stylesheets) flagged high — browsers show "Not Secure" warnings

01Why it matters

Mixed content is the silent cause of "Not Secure" browser warnings

The padlock disappears

When an HTTPS page loads any HTTP resource, browsers remove the padlock icon or show a security warning. Visitors see "Not Secure" — and trust evaporates. Sitewatch finds mixed content before your clients' visitors do.

Active content breaks pages

Modern browsers block insecure scripts, frames and embeds outright. A single insecure analytics tag or chat widget can silently break part of your page while your server answers normally and every uptime dashboard stays green.

Passive content triggers warnings

HTTP images, stylesheets, video, and audio are still loaded by browsers — but with a visible security warning. Your HTTPS site looks insecure even though the page renders. Clients notice. Their customers notice.

It appears after every CMS update

Mixed content is rarely there at launch — it creeps in after plugin installs, theme updates, and migrations from HTTP to HTTPS. Sitewatch checks continuously so you catch it the moment it appears, not in a client complaint.

HTTPS alone is not enough

Having a valid SSL certificate doesn't protect you from mixed content. Certificate monitoring catches expiry — mixed content monitoring catches what happens inside the page. Together they give you complete HTTPS health coverage.

Agencies discover this from clients

Without continuous monitoring, agencies find mixed content via client complaints — "why does my site say Not Secure?" Sitewatch makes it automatic: you know before they do, with evidence of exactly which resources are the problem.

02Complete HTTPS coverage

Sitewatch monitors every layer of your HTTPS security

SSL certificate monitoring

Expiry warnings, full chain validation, and TLS protocol checks. Sitewatch monitors every certificate continuously — 30-day early warning so no client site ever expires silently.

Security header monitoring & regression

CSP, HSTS, X-Frame-Options, and more — checked on every scan. Sitewatch also detects security header regressions: if a deployment removes a header that was previously present, you get a high-severity alert within the hour.

Domain expiry monitoring

Domain registration expiry tracked automatically via RDAP for every monitored site. 30-day early warning before a client domain lapses — no WHOIS tools, no calendar reminders.

03Detection coverage

Every mixed content type. Every check. No configuration.

Critical — browsers block these

  • HTTP scripts — JavaScript files over HTTP are blocked entirely by modern browsers. Any script running over HTTP on an HTTPS page fails silently or breaks functionality outright.
  • HTTP iframes — Embedded pages over HTTP are blocked. Login forms, payment widgets, and embedded tools stop working.
  • HTTP objects and embeds — Plugins and embedded content served over HTTP are blocked. PDF viewers, media players, and embeds fail without warning.

High — browsers warn and still load

  • HTTP images — Photos, logos, and product images served over HTTP trigger the "Not Secure" indicator even though the image loads. The padlock disappears.
  • HTTP stylesheets — CSS files over HTTP trigger security warnings and may be blocked in strict configurations. Unstyled or partially broken layouts result.
  • HTTP video and audio — Media files over HTTP trigger mixed content warnings. The media may play, but the security indicator is broken.
  • HTTP media sources — Source, track, and srcset attributes pointing to HTTP URLs in video and audio elements.

04How it works

Automatic detection on every check — zero configuration

  1. 01

    Page fetched on schedule

    Sitewatch fetches your HTTPS page on its normal monitoring schedule. Mixed content detection is built into every full-page check — no separate scan, no extra setup.

  2. 02

    All resource references inspected

    Every resource on the page is inspected: src, href, srcset, and inline styles. HTTP URLs on an HTTPS page are flagged by type and severity.

  3. 03

    Severity determined automatically

    Active mixed content (scripts, iframes, objects, embeds) generates a Critical incident — browsers block these. Passive content (images, stylesheets, media) generates a High incident — browsers warn but load them.

  4. 04

    Incident created with evidence

    An incident is created listing each HTTP resource found, its type, and its URL. The evidence table is the audit report — forward it directly to whoever manages the site.

05What you get

Outcomes, not a feature list.

Keep the padlock, and everything behind it.

One insecure resource on a secure page is enough for browsers to block it and for visitors to see a warning about your site. It usually arrives through a plugin or a pasted embed, long after launch. Sitewatch checks every resource on every visit.

$ sitewatch check yoursite.com --mixed-content
page · served securely
styles and scripts · 9/10 secure
chat widget · loaded insecurely, blocked by browsers
✕ visitors see a security warning on a secure page

9

Resource types scanned

Every check

Detection frequency

All plans

Included on

Find mixed content before your clients' visitors do

Free plan. 1 site. Automatic detection. No credit card.

06FAQ

Frequently asked questions