Home / server / Questions / 760693
Accepted
Dan Hastings
Asked: 2016-03-02 03:14:07 +0800 CST

Is my site secure if the SSL padlock does not appear?

  • 772

I have moved a website to https and its working fine. The admin area and login page display the green https padlock when i visit the pages, but none of the other pages display the padlock. I ran a scan on the page it came back saying that there were links to insecure websites such as facebook, twitter, adsense, jquery...etc. All the links are trusted websites (generally speaking). I dont consider adsense ads a security threat, but the browser does.

Are pages still secure in this case or was it a waste of my time even using SSL?

This image perfectly describes what is happening.

https://blog.servertastic.com/wp-content/uploads/dubious-as-neutral.png

Some pages are secure with the green padlock and others have the minor errors. is it a big deal?

ssl

2 Answers

  1. Best Answer

    Is my site secure if the SSL padlock does not appear?

    I ran a scan on the page it came back saying that there were links to insecure websites such as facebook, twitter, adsense, jquery...etc.

    No, it is not. Those sound like "mixed content" warnings, and your site is entirely insecure if you've got them. Facebook, Twitter, AdSense, and jQuery can - and should - all be referenced as HTTPS.

    Note: This applies to stuff like <img src> and <script src>. Simple <a href> links to HTTP content on a HTTPS page won't trigger a mixed-content warning.

    If you're loading their scripts over HTTP, a MITM attacker can inject any code they like into your site and attack your users. If you take credit cards, they could inject JavaScript to capture the numbers and send them off-site.

    • 2

  2. Generally speaking: No, but it may affect you in the future.

    Make sure that embedded / linked resources are located on destinations that are also secured (https).

    You should also check that your cert is not affected from sha1 deprecation (https://blog.qualys.com/ssllabs/2014/09/09/sha1-deprecation-what-you-need-to-know).

    Things that may today be seen as minor issue, may get major in the future. So it's always good to get a good result today.

    To check your certificate and ssl security in general, i recommend to check your site with ssl labs (https://www.ssllabs.com/).

    Depending on how you deliver cookies (should be set to HTTP-only) you may be at risk - but this is a more general advice.

    • 1