Why does this matter?
When an HTTPS page loads HTTP resources (images, scripts, CSS), the browser shows a security warning. Modern browsers completely block active mixed content (scripts, iframes). This damages both security and trust.
How to fix it?
Replace all http:// URLs in your HTML, CSS and JavaScript with https:// or relative URLs (//). Check database-stored URLs. Set a Content Security Policy with upgrade-insecure-requests.
This check scores from 0 to 100. Below 50 is a fail, 50 to 89 is a warning, 90 or above is good. After each crawl you see the score per page in your report, with a short note on what we found.
Frequently asked questions
Detects insecure HTTP resources on HTTPS pages.
When an HTTPS page loads HTTP resources (images, scripts, CSS), the browser shows a security warning. Modern browsers completely block active mixed content (scripts, iframes). This damages both security and trust.
Replace all http:// URLs in your HTML, CSS and JavaScript with https:// or relative URLs (//). Check database-stored URLs. Set a Content Security Policy with upgrade-insecure-requests.
Example
Copy the code below and adapt the domain name, brand name and content to your situation.
<!-- Use HTTPS for ALL resources --> <img src="https://cdn.yourdomain.com/images/logo.png"> <script src="https://cdn.yourdomain.com/js/app.js"></script> <!-- Or use relative URLs (safer) --> <img src="/images/logo.png"> <link rel="stylesheet" href="/build/assets/app.css"> <!-- CSP header: automatically upgrade HTTP to HTTPS --> <!-- Add to nginx.conf or .htaccess: --> add_header Content-Security-Policy "upgrade-insecure-requests" always;