Does your secure page load insecure content?
Scripts, styles, images or forms loaded over plain HTTP on a page served over HTTPS.
Why it matters
An insecure script can be changed on its way to the visitor, which defeats the point of HTTPS. Browsers block most of it, which can quietly break parts of your app, and forms that post over HTTP send your users' entries unprotected.
How a survey checks it
Passive check: part of every free survey.
We read the addresses your secure homepage loads and posts to. Scripts and forms count for more than images.
How to fix it
- Change every http:// address in your pages to https://, or to a relative address.
- If a third party does not offer HTTPS, replace it.
- A Content-Security-Policy with upgrade-insecure-requests can help while you clean up.
Prefer us to do it? Ask for a fix quote
Common questions
My browser shows no warning. Why is this flagged?
Browsers often block insecure scripts silently, so the warning only appears in the developer console. The broken feature may simply not work.
Are insecure images a problem?
Less so, which is why they count as low. They can still be swapped on the way and they spoil the secure padlock.