Mixed content blocking in Waterfox

Waterfox blocks or upgrades insecure resources on pages that are supposed to use a secure HTTPS connection. This protects the page from resources that could be read or changed while they travel over the network.

What is mixed content?

HTTP does not encrypt traffic between a browser and a web server. HTTPS authenticates the server and encrypts that traffic. Most sites now use HTTPS for their main pages.

Mixed content occurs when an HTTPS page requests a resource over HTTP. The main page may be encrypted, but the insecure resource can still be observed or modified by an attacker on the network. An altered script, frame or other active resource could steal information, change the page or perform actions as the signed-in user.

For a technical overview of active and passive mixed content, see Mixed content on MDN Web Docs.

How Waterfox handles mixed content

• Upgradable content, such as many images, is requested over HTTPS instead. Waterfox blocks it if the secure request cannot be loaded.
• Blockable content, such as insecure scripts and frames, is blocked because it can directly change the secure page.

These protections also apply when an insecure resource is nested inside another page resource.

Check a page’s connection

Use the site information or connection icon at the left of the address bar to review the page’s connection security. A secure indicator means the main connection is encrypted. A warning indicator can appear when the page is insecure or when insecure content has loaded.

The shield icon also shows the status of Enhanced Tracking Protection. Tracking protection and connection security are separate features.

Secure page

On a fully secure page, Waterfox reports that the connection is secure. If it blocked an insecure page resource, the connection details explain that parts of the page were blocked.

Insecure or mixed page

A crossed-out or warning connection indicator means the page is not fully secure. Do not enter passwords, payment details or other sensitive information on such a page.

If blocking breaks a page

Current Waterfox releases do not provide a normal per-page control to load blocked active mixed content. The site must serve every required resource over HTTPS. If a page is incomplete, contact the site owner or use a secure alternative rather than weakening browser security.

Developers: Use the mixed content developer console guidance on MDN Web Docs to find and replace insecure resource URLs.

---