The Mixed Content Vulnerability
Modern internet security relies heavily on HTTPS (Hypertext Transfer Protocol Secure) to encrypt data between your browser and the website. However, some older or poorly configured websites suffer from a vulnerability called “Mixed Content.” This occurs when the main website loads securely over HTTPS, but the website’s developer carelessly embedded an image, a video, or an external script using an old, unencrypted HTTP link. By default, Google Chrome sometimes allows this insecure media to load to prevent breaking the webpage layout. If you are browsing highly sensitive banking portals or corporate networks, allowing unencrypted scripts to execute inside a secure tab is a massive security risk. You must force Chrome to block all mixed content.
How to Block Insecure Content Globally
You can permanently force the browser to reject any unencrypted media elements via the Site Settings.
- Open the Google Chrome desktop browser.
- Click the three vertical dots (â‹®) in the top right corner and select Settings.
- In the left-hand sidebar, click on Privacy and security.
- In the main window, click on Site settings.
- Scroll down to the bottom and click on Additional content settings to expand the hidden menu.
- Click on Insecure content.
- Under the “Default behavior” heading, click the radio button next to “Block sites from showing insecure content.”
Strict Encryption Only
The change is instantaneous. Google Chrome will completely lock down its rendering engine. When you visit a secure HTTPS website, Chrome will strictly evaluate every single image, video, and JavaScript file requested by the page. If any element attempts to load over an unencrypted HTTP connection, Chrome will violently terminate the request. The media element will appear as a broken link on the screen, guaranteeing that 100% of the data rendering inside your browser is fully encrypted.