{"id":71,"date":"2026-08-24T22:56:53","date_gmt":"2026-08-24T19:56:53","guid":{"rendered":"https:\/\/secradar.net\/blog\/karisik-icerik-mixed-content-nedir\/"},"modified":"2026-08-24T22:56:53","modified_gmt":"2026-08-24T19:56:53","slug":"karisik-icerik-mixed-content-nedir","status":"publish","type":"post","link":"https:\/\/secradar.net\/blog\/karisik-icerik-mixed-content-nedir\/","title":{"rendered":"Kar\u0131\u015f\u0131k \u0130\u00e7erik (Mixed Content) Nedir ve Nas\u0131l D\u00fczeltilir?"},"content":{"rendered":"<p>Sitenizi HTTPS&#8217;e ta\u015f\u0131d\u0131n\u0131z, ge\u00e7erli bir SSL sertifikan\u0131z var; ama taray\u0131c\u0131 h\u00e2l\u00e2 adres \u00e7ubu\u011funda tam bir kilit g\u00f6stermiyor ya da &#8220;Bu sayfa tam olarak g\u00fcvenli de\u011fil&#8221; diyor. Bunun en yayg\u0131n sebebi <strong>kar\u0131\u015f\u0131k i\u00e7erik (mixed content)<\/strong>: g\u00fcvenli (HTTPS) bir sayfan\u0131n, i\u00e7indeki baz\u0131 kaynaklar\u0131 g\u00fcvensiz (HTTP) olarak y\u00fcklemesidir.<\/p>\n<p>Bu yaz\u0131da kar\u0131\u015f\u0131k i\u00e7eri\u011fin ne oldu\u011funu, neden riskli oldu\u011funu, t\u00fcrlerini ve \u2014 en \u00f6nemlisi \u2014 ad\u0131m ad\u0131m nas\u0131l d\u00fczeltilece\u011fini ve bir daha ya\u015fanmamas\u0131 i\u00e7in nas\u0131l \u00f6nlenece\u011fini ele al\u0131yoruz.<\/p>\n<h2>Kar\u0131\u015f\u0131k \u0130\u00e7erik Nedir?<\/h2>\n<p>Bir web sayfas\u0131 <code>https:\/\/<\/code> \u00fczerinden y\u00fcklendi\u011finde, taray\u0131c\u0131 o sayfan\u0131n <strong>t\u00fcm<\/strong> kaynaklar\u0131n\u0131n (g\u00f6rsel, script, stil dosyas\u0131, font, video, iframe) da \u015fifreli ba\u011flant\u0131 \u00fczerinden gelmesini bekler. E\u011fer sayfa i\u00e7indeki herhangi bir kaynak <code>http:\/\/<\/code> ile \u00e7a\u011fr\u0131l\u0131yorsa, sayfa &#8220;kar\u0131\u015f\u0131k&#8221; h\u00e2le gelir: bir k\u0131sm\u0131 \u015fifreli, bir k\u0131sm\u0131 a\u00e7\u0131k. Taray\u0131c\u0131 bu durumu bir g\u00fcvenlik sorunu olarak i\u015faretler.<\/p>\n<p>Bu genellikle bilerek yap\u0131lmaz; siteyi HTTPS&#8217;e ta\u015f\u0131rken \u015fablonlarda, veritaban\u0131nda veya \u00fc\u00e7\u00fcnc\u00fc taraf kodlarda kalan eski <code>http:\/\/<\/code> ba\u011flant\u0131lar\u0131ndan kaynaklan\u0131r.<\/p>\n<h2>Neden Riskli? (SSL&#8217;in Anlam\u0131 Kaybolur)<\/h2>\n<p>HTTPS&#8217;in amac\u0131, sayfa ile ziyaret\u00e7i aras\u0131ndaki t\u00fcm trafi\u011fi \u015fifreleyip <a href=\"https:\/\/secradar.net\/blog\/ortadaki-adam-mitm-saldirisi-nedir\">ortadaki adam (MITM) sald\u0131r\u0131lar\u0131na<\/a> kar\u015f\u0131 korumakt\u0131r. Sayfan\u0131n i\u00e7inde tek bir HTTP kaynak bile olsa, o kaynak a\u00e7\u0131k\u00e7a iletilir ve sald\u0131rgan taraf\u0131ndan okunabilir veya <strong>de\u011fi\u015ftirilebilir<\/strong>. \u00d6zellikle HTTP \u00fczerinden y\u00fcklenen bir JavaScript dosyas\u0131 ele ge\u00e7irilirse, sald\u0131rgan t\u00fcm sayfan\u0131n kontrol\u00fcn\u00fc alabilir. Yani kar\u0131\u015f\u0131k i\u00e7erik, ge\u00e7erli SSL sertifikan\u0131z\u0131n sa\u011flad\u0131\u011f\u0131 g\u00fcvenceyi b\u00fcy\u00fck \u00f6l\u00e7\u00fcde bo\u015fa \u00e7\u0131kar\u0131r.<\/p>\n<h2>\u0130ki T\u00fcr Kar\u0131\u015f\u0131k \u0130\u00e7erik: Pasif ve Aktif<\/h2>\n<p>Taray\u0131c\u0131lar kar\u0131\u015f\u0131k i\u00e7eri\u011fi tehlike d\u00fczeyine g\u00f6re iki gruba ay\u0131r\u0131r:<\/p>\n<ul>\n<li><strong>Pasif (g\u00f6r\u00fcnt\u00fcleme) kar\u0131\u015f\u0131k i\u00e7erik:<\/strong> G\u00f6rseller (<code>&lt;img&gt;<\/code>), video ve ses gibi, sayfan\u0131n geri kalan\u0131yla etkile\u015fime girmeyen kaynaklar. Taray\u0131c\u0131 bunlar\u0131 genellikle y\u00fckler ama kilit simgesini &#8220;eksik\/uyar\u0131&#8221; durumuna d\u00fc\u015f\u00fcr\u00fcr.<\/li>\n<li><strong>Aktif kar\u0131\u015f\u0131k i\u00e7erik:<\/strong> Script (<code>&lt;script&gt;<\/code>), stil dosyalar\u0131 (CSS), iframe, XMLHttpRequest\/fetch gibi sayfan\u0131n davran\u0131\u015f\u0131n\u0131 de\u011fi\u015ftirebilen kaynaklar. Bunlar \u00e7ok daha tehlikeli oldu\u011fu i\u00e7in modern taray\u0131c\u0131lar <strong>varsay\u0131lan olarak engeller<\/strong> \u2014 dosya hi\u00e7 y\u00fcklenmez, site bozuk g\u00f6r\u00fcnebilir (stil gitmi\u015f, buton \u00e7al\u0131\u015fm\u0131yor).<\/li>\n<\/ul>\n<h2>Taray\u0131c\u0131da Nas\u0131l G\u00f6r\u00fcn\u00fcr?<\/h2>\n<p>Kar\u0131\u015f\u0131k i\u00e7eri\u011fin belirtileri:<\/p>\n<ul>\n<li>Adres \u00e7ubu\u011funda tam kilit yerine uyar\u0131 simgesi ya da &#8220;G\u00fcvenli de\u011fil \/ Tam olarak g\u00fcvenli de\u011fil&#8221; ifadesi.<\/li>\n<li>Sayfan\u0131n bir k\u0131sm\u0131n\u0131n g\u00f6r\u00fcnmemesi veya stilin bozulmas\u0131 (aktif i\u00e7erik engellendi\u011finde).<\/li>\n<li>Taray\u0131c\u0131 geli\u015ftirici konsolunda (F12 \u2192 Console) <em>&#8220;Mixed Content: The page at &#8216;https:\/\/&#8230;&#8217; was loaded over HTTPS, but requested an insecure resource &#8216;http:\/\/&#8230;'&#8221;<\/em> uyar\u0131lar\u0131.<\/li>\n<\/ul>\n<p>En h\u0131zl\u0131 te\u015fhis y\u00f6ntemi: sayfada F12 ile konsolu a\u00e7\u0131p &#8220;Mixed Content&#8221; uyar\u0131lar\u0131n\u0131 okumakt\u0131r; her uyar\u0131, sorunlu HTTP kayna\u011f\u0131n\u0131n tam adresini verir.<\/p>\n<h2>Kar\u0131\u015f\u0131k \u0130\u00e7erik Nas\u0131l D\u00fczeltilir?<\/h2>\n<ol>\n<li><strong>Sorunlu kaynaklar\u0131 bulun.<\/strong> Konsoldaki &#8220;Mixed Content&#8221; sat\u0131rlar\u0131n\u0131 ve sayfa kayna\u011f\u0131n\u0131 (view-source) tarayarak <code>http:\/\/<\/code> ile ba\u015flayan ba\u011flant\u0131lar\u0131 tespit edin.<\/li>\n<li><strong>HTTP&#8217;yi HTTPS yap\u0131n.<\/strong> Bu kaynaklar\u0131n HTTPS s\u00fcr\u00fcm\u00fc varsa (\u00e7o\u011fu CDN, font ve API HTTPS sunar) ba\u011flant\u0131y\u0131 <code>https:\/\/<\/code> olarak g\u00fcncelleyin. Protokol\u00fc tamamen belirtmeyen &#8220;protokol-g\u00f6reli&#8221; (<code>\/\/example.com\/...<\/code>) bi\u00e7im de sayfan\u0131n protokol\u00fcn\u00fc kullan\u0131r.<\/li>\n<li><strong>Veritaban\u0131\/\u015fablon de\u011fi\u015fimi.<\/strong> WordPress gibi sistemlerde eski HTTP ba\u011flant\u0131lar\u0131 veritaban\u0131na g\u00f6m\u00fcl\u00fc olabilir; <code>wp search-replace 'http:\/\/siteniz.com' 'https:\/\/siteniz.com'<\/code> ile toplu d\u00fczeltebilirsiniz (\u00f6nce <code>--dry-run<\/code>).<\/li>\n<li><strong>\u00dc\u00e7\u00fcnc\u00fc taraf kaynaklar.<\/strong> Bir reklam, widget veya eski bir k\u00fct\u00fcphane yaln\u0131zca HTTP sunuyorsa, HTTPS destekleyen bir alternatifle de\u011fi\u015ftirin; HTTPS sunmayan kaynak modern taray\u0131c\u0131larda zaten \u00e7al\u0131\u015fmaz.<\/li>\n<li><strong>CSP ile otomatik y\u00fckseltme.<\/strong> Sunucunuza <code>Content-Security-Policy: upgrade-insecure-requests<\/code> ba\u015fl\u0131\u011f\u0131 ekleyerek taray\u0131c\u0131n\u0131n t\u00fcm HTTP istekleri otomatik olarak HTTPS&#8217;e \u00e7evirmesini sa\u011flayabilirsiniz. Bu, ka\u00e7an birka\u00e7 ba\u011flant\u0131 i\u00e7in g\u00fc\u00e7l\u00fc bir g\u00fcvenlik a\u011f\u0131d\u0131r. G\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 <a href=\"https:\/\/secradar.net\/blog\/http-guvenlik-basliklari-rehberi\">HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 rehberimizde<\/a> ayr\u0131nt\u0131l\u0131 anlatt\u0131k.<\/li>\n<\/ol>\n<p>Sertifikan\u0131z\u0131n ve HTTPS yap\u0131land\u0131rman\u0131z\u0131n sa\u011flam oldu\u011funu <a href=\"https:\/\/secradar.net\/ssl-sorgulama\">SSL Sorgulama<\/a> ile; g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131z\u0131 (CSP dahil) <a href=\"https:\/\/secradar.net\/guvenlik-basliklari\">G\u00fcvenlik Ba\u015fl\u0131klar\u0131<\/a> arac\u0131yla kontrol edebilirsiniz.<\/p>\n<h2>Bir Daha Ya\u015fanmamas\u0131 \u0130\u00e7in: \u00d6nleme<\/h2>\n<ul>\n<li><strong>Yaln\u0131zca HTTPS kaynak y\u00fckleyin.<\/strong> Tema\/\u015fablon geli\u015ftirirken ba\u011flant\u0131lar\u0131 protokol-g\u00f6reli veya do\u011frudan HTTPS yaz\u0131n; asla sabit <code>http:\/\/<\/code> kullanmay\u0131n.<\/li>\n<li><strong>upgrade-insecure-requests<\/strong> CSP direktifini kal\u0131c\u0131 olarak a\u00e7\u0131k tutun.<\/li>\n<li><strong>HSTS ekleyin.<\/strong> <a href=\"https:\/\/secradar.net\/blog\/hsts-nedir-https-zorunlu-kilma\">HSTS<\/a>, taray\u0131c\u0131y\u0131 sitenize yaln\u0131zca HTTPS ile ba\u011flanmaya zorlayarak bir\u00e7ok kar\u0131\u015f\u0131k i\u00e7erik ve d\u00fc\u015f\u00fcrme senaryosunu ba\u015ftan engeller.<\/li>\n<li><strong>D\u00fczenli denetleyin.<\/strong> Yeni i\u00e7erik veya eklenti eklerken konsolu kontrol edin; SSL\/ba\u015fl\u0131k de\u011fi\u015fikliklerini SecRadar ile s\u00fcrekli izleyin.<\/li>\n<\/ul>\n<h2>SSL Var Ama Kilit Yok mu?<\/h2>\n<p>&#8220;Sertifikam ge\u00e7erli ama site tam g\u00fcvenli g\u00f6r\u00fcnm\u00fcyor&#8221; durumunun neredeyse her zaman sebebi kar\u0131\u015f\u0131k i\u00e7eriktir. E\u011fer sertifikan\u0131n kendisiyle ilgili bir hata (s\u00fcre dolmas\u0131, isim uyu\u015fmazl\u0131\u011f\u0131, zincir hatas\u0131) varsa taray\u0131c\u0131 farkl\u0131 bir uyar\u0131 verir; bunlar\u0131 <a href=\"https:\/\/secradar.net\/blog\/baglantiniz-gizli-degil-hatasi-cozumu\">&#8220;Ba\u011flant\u0131n\u0131z Gizli De\u011fil&#8221; hatas\u0131<\/a> yaz\u0131m\u0131zda ele ald\u0131k. SSL&#8217;in temellerini ise <a href=\"https:\/\/secradar.net\/blog\/ssl-sertifikasi-nedir-nasil-alinir\">SSL Sertifikas\u0131 Nedir<\/a> yaz\u0131s\u0131nda bulabilirsiniz.<\/p>\n<h2>\u00d6zetle<\/h2>\n<p>Kar\u0131\u015f\u0131k i\u00e7erik, HTTPS bir sayfan\u0131n i\u00e7ine s\u0131zan HTTP kaynaklar\u0131ndan do\u011far; hem kilit simgesini k\u0131rar hem de SSL&#8217;in sa\u011flad\u0131\u011f\u0131 g\u00fcvenli\u011fi zay\u0131flat\u0131r. \u00c7\u00f6z\u00fcm, t\u00fcm kaynaklar\u0131 HTTPS&#8217;e ta\u015f\u0131mak, <code>upgrade-insecure-requests<\/code> ve HSTS ile a\u011f\u0131 s\u0131k\u0131la\u015ft\u0131rmakt\u0131r. Birka\u00e7 dakikal\u0131k bir denetim, sitenizin hem g\u00f6r\u00fcn\u00fcrde hem ger\u00e7ekte tam g\u00fcvenli olmas\u0131n\u0131 sa\u011flar.<\/p>\n<p>Sitenizi <a href=\"https:\/\/secradar.net\/ssl-sorgulama\">SSL Sorgulama<\/a> ve <a href=\"https:\/\/secradar.net\/guvenlik-basliklari\">G\u00fcvenlik Ba\u015fl\u0131klar\u0131<\/a> ara\u00e7lar\u0131m\u0131zla denetleyin. Kurumsal SSL sertifikalar\u0131 i\u00e7in <a href=\"https:\/\/www.ihs.com.tr\/ssl\/\" target=\"_blank\" rel=\"noopener\">\u0130HS Telekom SSL hizmetlerini<\/a> inceleyebilirsiniz.<\/p>\n<div style=\"background:#eef2ff;border:1px solid #c7d2fe;border-radius:12px;padding:16px;margin-top:24px\"><b>Sitenizin SSL ve HTTPS yap\u0131land\u0131rmas\u0131n\u0131 s\u00fcrekli denetleyin.<\/b> <a href=\"https:\/\/secradar.net\/register\">SecRadar&#8217;a \u00fccretsiz \u00fcye olun<\/a>; sertifikan\u0131z, TLS yap\u0131land\u0131rman\u0131z veya g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131z de\u011fi\u015fti\u011finde Telegram ya da e-posta ile an\u0131nda uyar\u0131 al\u0131n.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Sitenizi HTTPS&#8217;e ta\u015f\u0131d\u0131n\u0131z, ge\u00e7erli bir SSL sertifikan\u0131z var; ama taray\u0131c\u0131 h\u00e2l\u00e2 adres \u00e7ubu\u011funda tam bir kilit g\u00f6stermiyor ya da &#8220;Bu sayfa tam olarak g\u00fcvenli de\u011fil&#8221; diyor. Bunun en yayg\u0131n sebebi kar\u0131\u015f\u0131k i\u00e7erik (mixed content): g\u00fcvenli (HTTPS) bir sayfan\u0131n, i\u00e7indeki baz\u0131 kaynaklar\u0131 g\u00fcvensiz (HTTP) olarak y\u00fcklemesidir. Bu yaz\u0131da kar\u0131\u015f\u0131k i\u00e7eri\u011fin ne oldu\u011funu, neden riskli oldu\u011funu, t\u00fcrlerini &#8230; <a title=\"Kar\u0131\u015f\u0131k \u0130\u00e7erik (Mixed Content) Nedir ve Nas\u0131l D\u00fczeltilir?\" class=\"read-more\" href=\"https:\/\/secradar.net\/blog\/karisik-icerik-mixed-content-nedir\/\" aria-label=\"Read more about Kar\u0131\u015f\u0131k \u0130\u00e7erik (Mixed Content) Nedir ve Nas\u0131l D\u00fczeltilir?\">Read more<\/a><\/p>\n","protected":false},"author":0,"featured_media":70,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-71","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-sertifika"],"_links":{"self":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts\/71","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/comments?post=71"}],"version-history":[{"count":0,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts\/71\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/media\/70"}],"wp:attachment":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/media?parent=71"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/categories?post=71"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/tags?post=71"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}