Does HTTPS on the page stop mixed content?

No. HTTPS covers that document request. Child requests listed as http:// are a separate problem and must be upgraded or removed.

Is mixed content the same as a missing HSTS header?

No. HSTS teaches browsers to skip HTTP for your host on later visits. Mixed content is http:// URLs already written into the HTTPS page.

How does RoastMyOpsec find mixed content?

The vault mixed-content check parses the landing HTML for http:// script, style, and image URLs. It is a defensive read of a public page you own — not a man-in-the-middle test.

Safety

Mixed Content vs HTTPS for Marketing Sites

September 14, 2024

Mixed content vs HTTPS is not a choice between two equivalent setups. HTTPS on the HTML document only protects that response. If the page then loads scripts, stylesheets, or other active assets over http://, a network attacker gets a second chance to inject. Passive mixed content (images, audio, video) is quieter but still trains browsers and users to ignore the lock. Marketing sites should serve every first-party asset on HTTPS and stop pasting ancient http:// URLs from CMS fields. RoastMyOpsec's deeper vault check parses landing HTML for cleartext resource URLs — it does not intercept your visitors' traffic.

The practical difference

HTTPS is a transport property of one request. Mixed content is a document property: the page is HTTPS, a child request is not. Browsers treat active mixed content (scripts, iframes, XHR/fetch to http://) more strictly than images.

HSTS and a redirect fix the next visit to your host. They do not rewrite a hardcoded http://cdn.example/old.js inside the HTML. That is why a site can pass a TLS check and still fail mixed content.

How to choose what to fix first

Fix active mixed content before decorative images. A cleartext script undoes the point of TLS. Then upgrade stylesheets, then media. Prefer changing the stored URL in the CMS or CDN to https:// rather than relying on a browser upgrade hint alone.

Asset type	Risk if loaded over HTTP	First move	Takeaway
Script	Code injection on a hostile network	Upgrade or remove the tag	Active mixed content is the emergency
Stylesheet	UI spoofing and some injection paths	Serve CSS from HTTPS	Treat as active-adjacent
Image / media	Tampered pixels, weaker user trust	HTTPS CDN or self-host	Still a miss on a marketing site
XHR / fetch / websocket	API calls in the clear	Same-origin HTTPS or wss://	Do not leave 'just this one widget'

When HTTPS-only still fails the roast

A 301 to HTTPS with HSTS is the right envelope. Mixed content is leftover furniture from HTTP-era WordPress, Webflow embeds, and email-exported HTML. Editors paste http:// because the asset 'still loads on office Wi-Fi.'

Content-Security-Policy upgrade-insecure-requests can help as a belt. It is not a substitute for deleting the http:// URLs you control.

Common mistakes

The first mistake is checking the address bar and never viewing source for http://.

The second mistake is upgrading the apex and leaving a blog or /assets/ host on HTTP.

The third mistake is a third-party widget whose vendor still publishes an HTTP embed snippet.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Does HTTPS on the page stop mixed content?: No. HTTPS covers that document request. Child requests listed as http:// are a separate problem and must be upgraded or removed.
Is mixed content the same as a missing HSTS header?: No. HSTS teaches browsers to skip HTTP for your host on later visits. Mixed content is http:// URLs already written into the HTTPS page.
How does RoastMyOpsec find mixed content?: The vault mixed-content check parses the landing HTML for http:// script, style, and image URLs. It is a defensive read of a public page you own — not a man-in-the-middle test.