Sécurité

Mixed content

Detects insecure HTTP resources on HTTPS pages.

Vérifier votre site gratuitement

Pourquoi est-ce important ?

When an HTTPS page loads HTTP resources (images, scripts, CSS), the browser shows a security warning. Modern browsers completely block active mixed content (scripts, iframes). This damages both security and trust.

Comment le corriger ?

Replace all http:// URLs in your HTML, CSS and JavaScript with https:// or relative URLs (//). Check database-stored URLs. Set a Content Security Policy with upgrade-insecure-requests.

Ce check note de 0 à 100. Sous 50 c’est un échec, 50 à 89 un avertissement, 90 ou plus c’est bon. Après chaque crawl vous voyez la note par page dans le rapport, avec une courte explication.

Questions fréquentes

Detects insecure HTTP resources on HTTPS pages.

When an HTTPS page loads HTTP resources (images, scripts, CSS), the browser shows a security warning. Modern browsers completely block active mixed content (scripts, iframes). This damages both security and trust.

Replace all http:// URLs in your HTML, CSS and JavaScript with https:// or relative URLs (//). Check database-stored URLs. Set a Content Security Policy with upgrade-insecure-requests.

Exemple

Copiez le code ci-dessous et adaptez le nom de domaine, la marque et le contenu à votre situation. 

<!-- Use HTTPS for ALL resources -->
<img src="https://cdn.yourdomain.com/images/logo.png">
<script src="https://cdn.yourdomain.com/js/app.js"></script>

<!-- Or use relative URLs (safer) -->
<img src="/images/logo.png">
<link rel="stylesheet" href="/build/assets/app.css">

<!-- CSP header: automatically upgrade HTTP to HTTPS -->
<!-- Add to nginx.conf or .htaccess: -->
add_header Content-Security-Policy "upgrade-insecure-requests" always;
Security headers
Essai gratuit