Bulk Export > Security > HTTP URLs Inlinks’.<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>\n- HTTPS URL<\/strong>: includes all URLs that feature a trusted protocol such as HTTPS.<\/li>\n
- Mixed Content<\/strong>: through the filter you will be able to browse all HTML pages with HTTPS protocol but that have resources such as images, JavaScript or CSS with HTTP protocol that are not considered secure. Mixed content weakens HTTPS by making pages more vulnerable and compromisable.
\nYou can view the HTTP resources for each URL in the ‘outlinks’ tab and export them along with the source pages with the “Mixed Content” report.<\/li>\n<\/ul>\n<\/div><\/div><\/div><\/div><\/div>Bulk Export > Security > Mixed Content.<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>\n- Form URL Insecure<\/strong>: the filter displays HTML pages with a Contact Form that has an insecure (HTTP) link as an action attribute. All URLs contained in forms on a Web site should be encrypted and therefore must be HTTPS. The URL of the HTTP form can be viewed by clicking on the source URL in the upper window and then on the ‘URL Details’ tab of the lower screen. These can be exported along with the pages they are on with the report “Form URL Insecure.<\/li>\n<\/ul>\n<\/div>
Bulk Export > Security > Mixed Content<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>Bulk Export > Security > Form URL Insecure<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>\n- Form on HTTP URL<\/strong>: identifies HTTP protocol pages that have a form and may be blocked by the browser. All data entered in the form, including usernames and passwords could be intercepted and create harm to the surfer. The form can be viewed by clicking on the URL in the upper window and then on the ‘URL Details’ tab of the lower window, which shows you the details of the form on the HTTP URL.<\/li>\n
- Unsafe Cross-Origin Links<\/strong>: all pages that link to external sites using the target=”_blank” attribute (to open a page in a new tab) are displayed, without using rel=”noopener” (or rel=”noreferrer”) at the same time. Just using target=”_blank” exposes pages to security and performance issues. Ideally rel=”noopener” should be used on all links that contain the target=”_blank” attribute to avoid “Reverse Tabnabbing.”<\/li>\n<\/ul>\n<\/div>
Bulk Export > Security > Mixed Content<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>IN-DEPTH STUDY:<\/strong><\/p>\nReverse tabnabbing<\/strong>: a situation in which the page opened using the “target=”_blank” attribute can gain control of the source page by using “window.opener.location.assign()” to replace the tab in the background with malicious documents. Through the rel=”noopener” the malicious user will not be able to access the window object via window.opener.<\/p>\nUsing the “noopener” attribute does not affect Seo level but preserves security and performance by preventing processes on the target page from running in the same thread as the source page. Some doubts remain about the use of the “noreferrer” attribute, which removes the click reference data at the browser level and, does not allow the owner of the site linked to and opened via the click, to know its origin. In the case of Google Analytics the attribute “noreferrer, changes the “traffic source” from “referral” to “direct” altering the traffic statistics. Assuming that the inclusion of an external link is intended, we do not consider the attribute inescapable.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
External links that contain the target=”_blank” attribute can be displayed in the ‘outlinks’ tab and the ‘target’ column. They can be exported along with source pages from the “Unsafe Cross-Origin Links” report<\/p>\n<\/div>
Bulk Export > Security > Mixed Content<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>Bulk Export > Unsafe> Cross Links<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>\n- Protocol-Relative Resource Links<\/strong>: this filter shows you all pages that load resources such as images, JavaScript and CSS using relative links without specifying the protocol (e.g. “\/\/screamingfrog.co.uk”).<\/li>\n<\/ul>\n
This situation is very common and adopted by developers to save time by letting the browser specify the protocol. However, this habit may expose some sites to being compromised and could outline performance problems.<\/p>\n
Resource links that are protocol related can be viewed for each URL by clicking on the ‘outlinks’ tab and viewing the ‘Path Type’ column for ‘Protocol Relative’. They can be exported together with source pages from the Protocol-Relative Resource Links report.<\/p>\n<\/div>
Bulk Export > Security > Mixed Content<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>Bulk Export > Security > Protocol-Relative Resource Links<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>\n- Missing HSTS Head<\/strong>er: identifies all URLs that are missing the HSTS response header. The HTTP Strict-Transport-Security (HSTS) response tells browsers that they should only be accessed via HTTPS, rather than HTTP. If a Web site accepts a connection to HTTP, before being redirected to HTTPS, visitors will still initially communicate over HTTP. The HSTS header tells the browser to never load over HTTP and to automatically convert all requests to HTTPS. The Seo Spider itself will follow the instructions of the HSTS header, but will report any link encountered on HTTP URLs with a 307 status code and ‘HSTS Policy’ status.<\/li>\n
- Missing Content-Security-Policy-Header<\/strong>: identifies any URL that is missing the Content-Security-Policy response header. This header allows a Web site to control what resources are loaded for a page. This policy can help protect against cross-site scripting (XSS) attacks that exploit the browser’s trust in the content received from the server. The Seo Spider only checks the existence of the header, and does not query the directives found within to determine if they are well set up for the website. This should be done manually.<\/li>\n
- Bad Content Type<\/strong>: displays any URL where the actual content type does not match the content type set in the Header header. It also identifies any used but invalid MIME type.<\/li>\n<\/ul>\n<\/div>
Bulk Export > Security > Mixed Content<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div>
<\/span>Security Tab Video<\/h3><\/span>
![\"Tab](\"http:\/\/screamingfrog.club\/wp-content\/uploads\/2024\/03\/screaming-frog-external-security-tab.png\")
<\/a><\/span><\/div><\/div><\/div><\/div><\/div>