Does HTTPS affect SEO? Security, Mixed Content, and Browser Features
guide // , 5 min read, by Darthwares
HTTPS is a fundamental protocol for securing communication over the internet, and it plays a crucial role in website security and user trust. It ensures data integrity and is a prerequisite for many modern browser features. However, the presence of mixed content on an HTTPS page can undermine these essential security benefits, potentially leading to browser warnings or content blocking.
On this page // 5 sections
The short version
- HTTPS protects user data from tampering and eavesdropping during communication.
- Many new browser features, especially for progressive web apps, require a secure HTTPS connection.
- Mixed content occurs when an HTTPS page loads some resources over an insecure HTTP connection.
- Browsers block active mixed content by default due to the high security risks it poses to users.
- Fix mixed content by updating resource URLs to HTTPS or by implementing a Content Security Policy.
What is HTTPS, and why does it matter for websites?
HTTPS, or Hypertext Transfer Protocol Secure, is a secure version of the HTTP protocol that encrypts communication between a user's browser and a website. Google documents that HTTPS provides critical security and data integrity for both websites and users' personal information. It helps prevent intruders from tampering with communications, making it harder for them to access site resources or passively listen to exchanges between the website and its users.
Intruders often exploit unprotected communications to trick users into revealing sensitive information, installing malware, or inserting their own content into a page. By using HTTPS, websites can protect against these on-path attacks. Google recommends protecting all websites with HTTPS, regardless of whether they handle sensitive communications, to ensure a secure environment for all users.
Beyond security, HTTPS is also a requirement for many new web platform features. These include functionalities like taking pictures or recording audio with `getUserMedia()`, enabling offline app experiences with service workers, and building progressive web apps. HTTPS is a key component in the permission workflows for both new and updated features, making it essential for modern web development.
What is mixed content?
A page has mixed content when its initial HTML is loaded over a secure HTTPS connection, but other resources on that page, such as images, videos, stylesheets, or scripts, are loaded over an insecure HTTP connection. Requesting these subresources using the insecure HTTP protocol weakens the page's overall security. This is because these requests are vulnerable to on-path attacks, where an attacker can eavesdrop on a network connection or modify the communication between two parties.
Google explains that there are two main types of mixed content: active and passive. The distinction between them lies in how much they interact with the rest of the page and, consequently, the level of risk they pose.
Passive mixed content includes resources like images, video, and audio. These elements generally do not interact with the rest of the page, so an on-path attack that intercepts or changes this content has a restricted impact. In contrast, active mixed content interacts with the page as a whole. This category typically includes scripts, iframes, and other executable code, which can pose a much higher security risk if compromised.
How do browsers handle mixed content?
Because the risks associated with active mixed content are high, most browsers block this type of content by default to protect users. This behavior can vary between browser vendors and versions, but the general trend is towards increased security. Google notes that most browsers now block mixed content for security reasons, preventing potentially malicious scripts or other active elements from loading insecurely on an otherwise secure page.
When Google Chrome detects mixed content, it provides alerts to the user or developer. For example, when visiting an HTTPS page, Chrome logs detailed messages to the Issues tab in DevTools. It also displays errors and warnings in the JavaScript console to advise on specific issues. Chrome may also automatically upgrade passive mixed content requests from HTTP to HTTPS if possible, logging this action as well.
How do you fix mixed content?
Supporting HTTPS for your website is a crucial step in protecting your site and users from attacks. However, mixed content can render that protection useless, as it reintroduces vulnerabilities on a page that appears secure. Therefore, identifying and fixing mixed content is essential for maintaining a truly secure website.
One way to fix mixed content is to search directly in your source code for HTTP URLs that are loading resources on HTTPS pages. If you receive a console message indicating that a resource request has been automatically upgraded from HTTP to HTTPS, you can safely update the HTTP URL for that resource in your code to HTTPS. This ensures the resource is always requested securely.
For managing mixed content at scale, Content Security Policy (CSP) is a multi-purpose browser feature that can be used. The CSP reporting mechanism helps track mixed content across your site, and enforcement policies can be set to protect users by upgrading or blocking insecure content. Specifically, the `upgrade-insecure-requests` CSP directive instructs the browser to automatically upgrade insecure URLs to HTTPS before making network requests. This directive also cascades into `<iframe>` documents, ensuring that the entire page, including embedded content, is protected.
Common questions
Why should all websites use HTTPS?
Google recommends that all websites use HTTPS because it provides critical security and data integrity for both the site and its users. It prevents intruders from tampering with communications, protecting against malware, sensitive information theft, and unauthorized content insertion. Additionally, HTTPS is required for many modern browser features, including those used in progressive web apps.
What are the security risks of mixed content?
Mixed content weakens a page's security because insecure HTTP requests are vulnerable to on-path attacks. An attacker can eavesdrop on or modify communications between the user and the website. While passive mixed content has limited impact, active mixed content, such as scripts, poses a high risk because it interacts with the entire page, potentially leading to compromised user data or website functionality.
What is the difference between active and passive mixed content?
Google defines two types of mixed content. Passive mixed content, such as images, video, and audio, does not interact with the rest of the page, so its compromise has a restricted impact. Active mixed content, which includes scripts and iframes, interacts with the page as a whole. Due to its ability to manipulate the page, active mixed content carries a much higher security risk.
How can Content Security Policy help with mixed content?
Content Security Policy (CSP) is a browser feature that helps manage mixed content at scale. It offers a reporting mechanism to track insecure content on your site and allows you to set enforcement policies. The `upgrade-insecure-requests` CSP directive is particularly useful, as it instructs the browser to automatically upgrade insecure HTTP URLs to HTTPS before making network requests, protecting the entire page, including embedded iframes.
Primary sources and further reading
This article was researched and written by an AI model and published automatically. It was written from sentences that were checked to appear on the pages below, but a person has not reviewed the text. If something is wrong, tell us at chibivikramathithan@darthwares.com and we will correct it.