Commit 67e2fbe


Every website's mixed content situation will be different, but the general approach is:

Note: the below instructions use tools **optimized for an OS X or Linux environment**. Documentation for Windows-based tools would be a welcome contribution to this guide.

Most commonly used third party services, such as Google Analytics or AddThis, **will automatically adapt** when migrating to HTTPS.

This is a great opportunity to improve your website's privacy and lessen your dependency on third parties, by copying those media files to your own server instead and hosting them yourself.

After identifying and fixing the obvious issues, you can scan your website's files for leads. On a Mac or Linux-based system, `grep` is very handy:

grep -r "http:" | grep -v "](http:"

[`mixed-content-scan`](https://github.com/bramus/mixed-content-scan) is a very handy command line tool that can crawl an `http://` or `https://` website to see if it contains any references to insecure resources. This is especially helpful if your content is primarily managed in a CMS.

mixed-content-scan https://https.cio.gov --format=json

If mixed content were not blocked, an attacker could control the main website by conducting a MITM attack against any of its active resources.