No mixed content

What this means

Passing means every asset your https home page loads comes from an https:// address, a relative path or a data URL. Failing means at least one script, stylesheet, image, font or frame is loaded over plain http://. The page is encrypted but part of its content is not.

How we test it

We fetch the home page over https and read every src and href in the HTML. A plain http:// address on any asset the page loads fails, because browsers either block it or strip the lock. An ordinary link to an http page is not mixed content and is not counted here; the broken-links check covers links. Nothing found passes.

Why it matters

Browsers block or warn, and the lock icon disappears. A blocked script means a feature silently does not run; a warned image means the address bar tells the visitor the page is not secure, on a page that is. The kit's CSP template ends with upgrade-insecure-requests, which tells the browser to fetch any http:// asset over https instead, but the right fix is to change the address in the source so the page is correct without help.

The fix

Change every http:// asset address in the page source to https:// (or a relative path for first-party files), and keep upgrade-insecure-requests as the last directive in the kit's CSP so a stray one is upgraded rather than blocked. Confirm with curl -s https://YOUR_DOMAIN/ | grep -oE '(src|href)="http://[^"]+"', expected no output. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE '(src|href)="http://[^"]+"' and show me every match.
For each match, tell me which tag it sits in (script, link, img, iframe, a) and which source file emits it.
Run: curl -sI https://YOUR_DOMAIN | grep -i '^content-security-policy' | grep -c upgrade-insecure-requests and show me the number.
Tell me whether each http:// address also answers on https:// by running: curl -s -o /dev/null -w '%{http_code}\n' https://THAT_HOST/THAT_PATH
List what it would take to remove each one, and stop there.
Run: curl -s https://YOUR_DOMAIN/ | grep -cE '(src|href)="http://' and show me the output. Expected on a passing site: 0.

Copy the prompt