IIS SEO Toolkit: Find warnings of HTTP content linked by pages using HTTPS

Are you an developer/owner/publisher/etc of a site that uses HTTPS (SSL) for secure access? If you are, please continue to read.

Have you ever visited a Web site that is secured using SSL (Secure Sockets Layer) just to get an ugly Security Warning message like:

Do you want to view only the webpage content that was delivered securely?

This webpage contains content that will not be delivered using a secure HTTPS connection, which could compromise the security of the entire webpage.

How frustrating is this for you? Do you think that end-users know what is the right answer to the question above? Honestly, I think it actually even feels like the Yes/No buttons and the phrasing of the question would cause me to click the wrong option.

What this warning is basically trying to tell the user is that even though he/she navigated to a page that you thought was secured by using SSL, the page is consuming resources that are coming from an unsecured location, this could be scripts, style-sheets or other types of objects that could potentially pose a security risk since they could be tampered on the way or come from different locations.

As a site owner/developer/publisher/etc should always make sure that you are not going to expose your customers to such a bad experience, leaving them with an answer that they can’t possibly choose right. For one if they ‘choose Yes’ they will get an incomplete experience being broken images, broken scripts or something worse; otherwise they can ‘choose No’ which is even worse since that means you are actually teaching them to ignore this warnings which could indeed in some cases be real signs of security issues.

Bottom-line it should be imperative that any issue like this should be treated as a bug and fixed in the application if possible.

But the big question is how do you find these issues? Well the answer is very simple yet extremely time consuming, just navigate to every single page of your site using SSL and as you do that examine every single resource in the page (styles, objects, scripts, etc) and see if the URL is pointing to a non-HTTPS location.

Enter the IIS Search Engine Optimization (SEO) Toolkit.

The good news is that using the SEO Toolkit is extremely simple to find these issues.

1. To do that just start a new Analysis using the IIS SEO Toolkit using the HTTPS URL of your site, for example: https://www.example.com/
2. Once the analysis is over just select the option “Query->Open Query” and open the following XML file:
   
<?xml version="1.0" encoding="utf-8"?>
<query dataSource="links">
  <filter>
    <expression field="LinkingUrl" operator="Begins" value="https://" />
    <expression field="LinkedUrl" operator="Begins" value="http://" />
    <expression field="LinkType" operator="NotEquals" value="Link" />
    <expression field="LinkType" operator="NotEquals" value="Rss" />
  </filter>
  <displayFields>
    <field name="LinkingUrl" />
    <field name="LinkedUrl" />
    <field name="LinkedStatus" />
    <field name="LinkType" />
  </displayFields>
</query>
3. Just by doing that it will open a Query Window that will show all the links in your site that have such a problem. Note that the query simply looks for all the resources that are being linked by a URL that begins with HTTPS and that the target resource is using HTTP and that are not normal links (since they do not have that problem).
   
4. This is how my quick repro looks like. Note that it actually tells you the type of resource it is (an image and a style in this case). Additionally if you double click the row it will show you exactly the place in the markup where the problem occurs so you can easily fix it.

Summary

Using the IIS SEO Toolkit and it powerful Query Engine you can easily detect conditions on your site that otherwise would take an incredible amount of time and that would be prohibitively expensive to do constantly.