¿Por qué importa esto?
When an HTTPS page loads HTTP resources (images, scripts, CSS), the browser shows a security warning. Modern browsers completely block active mixed content (scripts, iframes). This damages both security and trust.
¿Cómo se soluciona?
Replace all http:// URLs in your HTML, CSS and JavaScript with https:// or relative URLs (//). Check database-stored URLs. Set a Content Security Policy with upgrade-insecure-requests.
Este check puntúa de 0 a 100. Bajo 50 es un fallo, 50 a 89 un aviso, 90 o más es bueno. Tras cada crawl ve la nota por página en el informe, con una breve explicación.
Preguntas frecuentes
Detects insecure HTTP resources on HTTPS pages.
When an HTTPS page loads HTTP resources (images, scripts, CSS), the browser shows a security warning. Modern browsers completely block active mixed content (scripts, iframes). This damages both security and trust.
Replace all http:// URLs in your HTML, CSS and JavaScript with https:// or relative URLs (//). Check database-stored URLs. Set a Content Security Policy with upgrade-insecure-requests.
Ejemplo
Copie el código de abajo y adapte el dominio, la marca y el contenido a su situación.
<!-- Use HTTPS for ALL resources --> <img src="https://cdn.yourdomain.com/images/logo.png"> <script src="https://cdn.yourdomain.com/js/app.js"></script> <!-- Or use relative URLs (safer) --> <img src="/images/logo.png"> <link rel="stylesheet" href="/build/assets/app.css"> <!-- CSP header: automatically upgrade HTTP to HTTPS --> <!-- Add to nginx.conf or .htaccess: --> add_header Content-Security-Policy "upgrade-insecure-requests" always;