Mixed Content (mixed-content)

Summary

HTTP subresources on HTTPS pages (mixed content).

Classification

• Category: SECURITY
• Plugin id: mixed-content
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */3 * * *', priority: 5 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for mixed-content.

Check	Typical severity	Why
Insecure script on HTTPS page	WARNING	Active mixed content is blocked or weakened in modern browsers — analytics, widgets, or JS features silently fail.
Insecure stylesheet on HTTPS page	WARNING	CSS over HTTP may be blocked, breaking layout and exposing users to stylesheet injection on untrusted networks.
Insecure image / video / audio / source / iframe / object / form action	WARNING	Passive or active mixed content triggers padlock warnings, blocks subresources, and enables network tampering with assets.

How each check works

1. HTTPS gate — If target URL does not start with https://, run passes immediately with skipped: not-https metric (no findings).
2. HTML fetch — GET target URL via fetchTarget() (default timeout 15s), parse with cheerio.
3. Selector scan — For each element type, collects attribute URLs starting with literal http:// (not https://, not protocol-relative //):
   • script[src], link[href], img[src], video[src], audio[src], source[src], iframe[src], object[data], form[action]
4. Finding rule — One WARNING finding per insecure URL with fingerprint mixed-content:{label}:{url} and truncated HTML element snippet in evidence.
5. Score — 100 if none; else max(0, 100 - findings.length × 10).

Caveats and concerns

• Initial HTML only — Resources injected by JavaScript after load are not scanned; SPAs may hide mixed content until runtime.
• http:// prefix only — Protocol-relative URLs (//example.com) and data:/blob: URLs are not evaluated.
• Link stylesheet noise — link[href] matches all links, not only stylesheets — favicons or preconnect with http:// trigger findings.
• No reachability check — Reports URL strings from markup without verifying the subresource still loads or returns 200.

Source

packages/test-plugins/src/plugins/mixed-content.ts