How Firefox Handles Passive and Active Mixed Content

This article explains how the Mozilla Firefox web browser manages security risks when a secure HTTPS webpage attempts to load insecure HTTP subresources, a scenario known as mixed content. It breaks down the fundamental differences between passive and active mixed content, the specific security threats each category poses, and the exact mechanisms Firefox uses—such as automatic blocking, protocol upgrading, and visual security indicators—to protect users from data interception and manipulation.

Understanding Mixed Content

When you visit a website beginning with HTTPS, the connection between your browser and the website's server is encrypted and secure. However, if that secure HTML page loads additional subresources—such as images, videos, stylesheets, or scripts—over an unencrypted HTTP connection, it creates "mixed content." Because the HTTP components are vulnerable to eavesdropping and Man-in-the-Middle (MitM) attacks, they compromise the security of the entire HTTPS page. Firefox mitigates this risk by dividing mixed content into two categories: passive and active.

Passive Mixed Content (Display Content)

Passive mixed content refers to HTTP subresources that cannot directly interact with, alter, or control the rest of the webpage.

Examples of passive content include:

  • Images (<img>)
  • Audio files (<audio>)
  • Video files (<video>)
  • Object subresources (<object>)

The Security Risk: The threat level for passive content is relatively low to moderate. An attacker intercepting an HTTP image or video could replace it with an inappropriate file, deface the way the page looks to the user, or infer what page the user is viewing. However, the attacker cannot use an image or video to steal user passwords, hijack the session, or rewrite the webpage's code.

How Firefox Handles Passive Mixed Content:

  • Automatic Upgrading: In modern versions of Firefox, the browser automatically attempts to upgrade passive mixed content from HTTP to HTTPS in the background. If the server supports HTTPS for that media file, it loads securely without any issue.
  • Blocking Un-upgradable Content: If the automatic upgrade fails because the server does not host the media over HTTPS, modern Firefox blocks the passive content from loading altogether to maintain the integrity of the secure connection.
  • Visual Warnings (Legacy Behavior): In older versions of Firefox, or if automatic upgrading is manually disabled by the user, Firefox allows passive HTTP content to load so the webpage does not appear broken. When this happens, Firefox alters the padlock icon in the address bar by overlaying a yellow warning triangle. This informs the user that the connection is only partially encrypted and not fully secure.

Active Mixed Content (Scriptable Content)

Active mixed content refers to HTTP subresources that have access to all or part of the Document Object Model (DOM) of the HTTPS page. This type of content can alter the behavior of the webpage and interact with the user.

Examples of active content include:

  • JavaScript files (<script>)
  • CSS Stylesheets (<link>)
  • Iframes (<iframe>)
  • XMLHttpRequest and fetch() requests
  • Web fonts (@font-face)

The Security Risk: The threat level for active content is critical. If an attacker intercepts an unencrypted HTTP script or stylesheet, they can inject malicious code directly into the HTTPS page. This allows the attacker to gain complete control over the page, steal sensitive data, capture login credentials, hijack user sessions, or redirect the user to a phishing site.

How Firefox Handles Active Mixed Content:

  • Blocked by Default: Firefox strictly blocks all active mixed content by default. The browser intercepts and terminates the insecure HTTP request before it ever leaves the user's device.
  • Preserving the Padlock: Because Firefox prevents the dangerous content from loading, the security of the webpage remains intact. Consequently, the user continues to see the standard secure padlock icon in the address bar. However, blocking these scripts or stylesheets may cause the webpage to look broken or function incorrectly.
  • Developer Console Alerts: When active content is blocked, Firefox does not typically show a disruptive pop-up to the everyday user. Instead, it logs a detailed security error in the Web Developer Console, allowing website administrators to identify and fix the insecure HTTP links.

Advanced Configuration in Firefox

Firefox allows advanced users and developers to modify how the browser handles mixed content through its internal configuration page (about:config). While changing these settings can leave the browser vulnerable, they are controlled by three primary preferences:

  • security.mixed_content.block_active_content: Set to true by default. Changing this to false disables protection and allows dangerous active HTTP content to load on HTTPS pages.
  • security.mixed_content.upgrade_display_content: Set to true in modern Firefox. This instructs the browser to automatically rewrite passive HTTP media requests to HTTPS.
  • security.mixed_content.block_display_content: Set to false by default, as upgrading is preferred. If set to true (and upgrading is disabled), Firefox will strictly block all passive content just like it blocks active content.