HTTP resources on an HTTPS page
Some of these are silently broken for your visitors already.
What browsers do
Scripts and stylesheets loaded over http from an https page are blocked outright — so whatever they did is broken, with only a console message to say so. Images and iframes usually load but can be altered in transit, and the padlock disappears from the address bar.
The same applies to ws:// WebSocket connections, which browsers refuse from a secure page.
Fixing it
Change every http:// reference to https://. Where a resource genuinely is not available over https, host a copy yourself.
Then add upgrade-insecure-requests to your Content-Security-Policy as a safety net for anything you missed.
Leave localhost URLs alone — those are for local development and never reach production behaviour.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site