Security headers check
The page has no mixed content
No http subresource is loaded by an https page.
high severitysec.mixed-content
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
Browsers block active mixed content and warn about passive mixed content. An attacker on the network can tamper with anything loaded over http.
How to fix it
Change every http reference to https, including images, stylesheets, scripts and iframes.
The details
- Category
- Security headers
- Severity of a failure
- high
- Confidence
- high
- Needs a browser
- No
- Check id
- sec.mixed-content
References
Free tools that run this check
Security Headers CheckerSecurity headers tell browsers to stay on HTTPS, refuse to be framed, stop guessing content types and limit what scripts may do. Check which ones your site sends and how they are set.SSL and HTTPS CheckerA trusted certificate is only part of HTTPS. Check that the handshake succeeds, that http redirects to https, that HSTS keeps browsers on https and that no resource is loaded insecurely.