Load scripts, styles and frames over HTTPS
Why it matters
Browsers block http:// scripts, stylesheets and frames on an https page, so parts of the page break, and anything loaded that way could be altered on the network. Every such resource must come from an https:// URL.
The fix
- Find the http:// URLs: the finding lists them, and the browser's developer console shows mixed content errors on each page.
- Change each to https:// after checking the resource loads there. If a third party has no https version, self-host the file or replace the service.
- Look in templates, CMS content and database fields, theme or app settings, and scripts that build URLs.
- As a stopgap while you fix the sources, the Content-Security-Policy directive upgrade-insecure-requests makes browsers request those URLs over https; resources that do not exist on https still fail.
html
<!-- before --> <script src="http://cdn.vendor.example/widget.js"></script> <!-- after --> <script src="https://cdn.vendor.example/widget.js"></script>
Related
Scan your domain to see whether this applies to you.