Mixed content occurs when initial HTML is loaded over HTTPS, but other resources (like images or scripts) are loaded over insecure HTTP. This creates security vulnerabilities as these insecure resources could be modified in transit. Modern browsers block mixed content by default, and security best practices require all resources to be served via HTTPS.
Mixed content occurs when a page delivered over HTTPS pulls in subresources over plaintext HTTP. The top-level document is encrypted and authenticated, but the insecure fetches for scripts, stylesheets, images, fonts, or XHR/fetch requests are not. Browsers classify it in two buckets. Active mixed content, such as scripts, stylesheets, iframes, and fetch calls, can alter the whole page and is blocked outright by modern browsers. Passive mixed content, such as images, audio, and video, cannot rewrite the page but still leaks and can be swapped, so browsers increasingly upgrade or block it too. The lock icon a user sees reflects the top document, which is why silent mixed content is deceptive.
An HTTP subresource travels unauthenticated across the network, so anyone positioned between the user and the server, on shared Wi-Fi, a rogue router, or a compromised upstream, can read or rewrite it in transit. Rewriting an HTTP-loaded script is effectively arbitrary JavaScript injection into an otherwise secure page: the attacker inherits the page's origin and can steal session tokens, exfiltrate form data, or plant a skimmer. Even passive assets can be altered for content spoofing or used to leak referrer and cookie signals. Mixed content also quietly undermines the guarantees HTTPS was meant to provide, giving users a false sense of a fully protected session while a weak link remains open.
Serve every resource over HTTPS and reference assets with protocol-relative or absolute https URLs. The upgrade-insecure-requests CSP directive tells the browser to rewrite eligible HTTP subresource requests to HTTPS automatically, and block-all-mixed-content hard-fails the rest; pairing these with HSTS keeps the whole delivery path encrypted. Audit third-party embeds, which are a common source of stray HTTP calls. Because mixed content is fundamentally about transport, cside's role here is indirect: it does not manage certificates, but by proxying and analysing third-party script payloads it can flag when a loaded script behaves maliciously, whichever transport delivered it, and keep a forensic record of what actually ran.
That is passive mixed content. An HTTP image cannot rewrite the page, so browsers historically allowed it with a downgraded security indicator instead of the full lock. Newer browsers may auto-upgrade or block it, so the cleanest fix is to serve the image over HTTPS.
Active mixed content, such as scripts, stylesheets, and iframes, can change the entire page, so browsers block it. Passive mixed content, such as images, audio, and video, can only affect the resource itself, so it has historically been allowed with a warning, though browsers now increasingly upgrade or block it as well.
We answer client-side security questions every day. Bring yours.