Description
When a user visits a page served over HTTPS, their connection with the web server is encrypted with TLS, protecting it from most sniffers and man-in-the-middle attacks. However, if the page includes content fetched using cleartext HTTP, it becomes a mixed content page. Such pages are only partially encrypted, leaving the unencrypted content vulnerable to sniffers and man-in-the-middle attackers. Passive content, such as images, audio, or videos, controls the appearance of the webpage and is often referred to as display content.
Recommendation
Ensure all resources are loaded using the HTTPS protocol to prevent mixed content issues and enhance overall security.
References
Could your website be exposed too?
SmartScanner can check your website for Passive Mixed Content and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Ori - Vulnerability
- Denial of Service in content - Vulnerability
- content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE - CVE-2025-55164
- docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token - CVE-2025-53624
