2 million pages with mixed content issues

As soon as I clicked “publish” in the article about mixed content, I started wondering how common this problem was. Mixed content means having insecure http:// resources on https:// pages, e.g. images, video or JavaScript. Non-encrypted JavaScript is already blocked by Chrome, and the upcoming versions of Chrome will be blocking http:// images and videos too. I was curious how many websites would face problems with proper loading in Chrome in 2020. I decided to check this with our existing user base at Pulno and it turned out that around 12% of users had analyzed websites which had resources that would fail to load over https://. In order to investigate it even further, we have created a dedicated algorithm, which has analyzed our data, i.e. 37 million pages from over 400 thousand domains. Read on to see the results and conclusions.

Mixed Content

According to statcounter (03/2019), Chrome accounts for about 62,61% of the internet browser market share. Our own data from a big medical website show even higher numbers for Chrome, reaching 68% (11/2019).

Almost 5% of the hosts analyzed by us are affected by the issues with insecure http:// resources.

Of all 30911 hosts with mixed content:

20.552 have problems with images

5285 have problems with JavaScript elements

All major web browsers are already blocking scripts loaded over http://. As of the beginning of 2020, the same will apply to images in Chrome.

What are the possible outcomes of Chrome blocking mixed content?

In many cases the outcomes are not severe - a user will just receive a notification in the address bar informing them about the insecure resources and some functionalities or elements of a website, such as images may be gone. It may happen, however, that the subresources that are blocked are crucial for the website to function properly.

As you can see, some websites may lose more than just pieces of content and some functionalities. They may, in fact, lose their analytical data and even ad revenue, as we have found incorrect ad scripts in over a hundred websites. Finally, we have detected issues with cookie policy alerts in at least 300 sites, which means they will simply stop working in the new versions of Chrome.

You may effectively leverage information on issues on a website in your customer acquisition strategy. If you can tell a prospective customer what is wrong with their website using a simple audit, it’s easier to appear as an expert. It makes a good opportunity to offer your services. Especially if it’s about such issues as pieces of website missing because of mixed content or lack of encryption. 

Detecting errors

Internet browsers use a shield icon in the address bar to inform about blocked scripts. The image below illustrates how it looks in Chrome.

It may be troublesome to check all pages on your website manually. It’s much easier to use Pulno instead, and generate a report with the encryption issues on all pages of your website.

A notification about issues with resources (JavaScript, CSS) loaded over a non-encrypted connection (HTTP).

A notification about issues with images loaded over a non-encrypted connection (HTTP).

Use of the https protocol

55% of websites use encrypted protocol (HTTPS).

Over 83% of Chrome users on Windows visit websites loaded over https://.

More and more websites migrate from http:// to https://, especially after Google announced that HTTPS website protocols would be used as a ranking factor. Make sure that after the migration there’s no mixed content left on your website. Best-case scenario, a few images will be gone from your website. But it might also happen that some crucial scripts will stop working or even that your website will stop bringing ad revenue.