Launch sale: 20% off Fix Pack, Deep Audit and Monitor through Nov 30, 2026. The scan stays free. See sale prices →
Home / Fix guides / Mixed content

Fix mixed content (http:// resources on an https:// page)

Medium

Your HTTPS page references resources over plain http://. Browsers block insecure scripts and frames (breaking your app) and warn on insecure images.

Why it matters

Anything loaded over HTTP can be modified in transit; an insecure script means full control of the page.

Quick fix

  1. Change the listed http:// URLs to https://.
  2. If a resource has no HTTPS version, host it yourself.
  3. Optionally add upgrade-insecure-requests to your CSP.

Step by step

Fix the URLs

Search your code for 'http://' and switch to https://. As a safety net add this CSP directive:

Content-Security-Policy: upgrade-insecure-requests

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Find every http:// URL loaded by my app (scripts, styles, images, iframes, fonts, form actions, API calls) and change it to https://. Add the CSP directive upgrade-insecure-requests.

References

Check your app

Run a free scan

Want help fixing this?

We're opening a done-for-you fix service, a deep audit (database rules, auth, user-to-user data access) and continuous monitoring. Join the waitlist to get first access. No spam, and we never share your email.