What does the mixed content check look for?
It checks whether a page served over HTTPS pulls in any resources over insecure HTTP. Specifically:
- Insecure resources — images, scripts, stylesheets, fonts, iframes or media loaded via
http://on an HTTPS page. - Active vs. passive — active mixed content (scripts, iframes) is the most serious and is usually blocked; passive (images) triggers warnings.
- Hard-coded HTTP URLs — references that should be updated to HTTPS or made protocol-relative.
No mixed content passes; some passive mixed content (e.g. images) is a warning; active mixed content or widespread insecure resources is a fail.
How is it evaluated, and how is it scored?
GEObubbly scans an HTTPS page for resources loaded over insecure HTTP. It's an extended Security check that runs directly against the page's resource references.
Why mixed content matters for SEO and GEO
Serving a page over HTTPS only fully protects it if everything on the page also loads securely. Mixed content happens when an HTTPS page references resources — images, scripts, stylesheets, fonts, iframes — over plain HTTP, leaving those parts of the page unencrypted and tamperable. Browsers treat this seriously: active mixed content (scripts and iframes, which can change the whole page) is typically blocked outright, which can break layout or functionality, while passive mixed content (images, media) triggers a security warning and downgrades the padlock. Either way, the user no longer sees a clean secure indicator, and the page's security promise is broken. Mixed content usually creeps in from hard-coded http:// URLs left over after a migration to HTTPS, or third-party embeds that don't support HTTPS. The fix is to update every resource reference to HTTPS (or protocol-relative), replace embeds that can't be served securely, and use a Content Security Policy to catch regressions. Keeping pages fully secure preserves the trust and access benefits of HTTPS. For GEO, a clean, fully-secure page is part of the baseline reliability engines expect.