Understand the idea

Loading the main document over HTTPS does not prove that all its dependencies are requested securely. An old script address can still begin with http://.

Browsers handle insecure subresources on secure pages according to mixed-content rules. Some resource types may be upgraded to HTTPS; others are blocked. Inspect the actual warning and request rather than assuming every insecure dependency fails in the same way.

Read the example

Supplied addresses only. This lesson does not load an insecure resource or weaken browser protections.

Diagnostic notes · EXAMPLE
Illustrative secure page: https://example.com/
Old script reference: http://example.com/assets/site.js
Possible symptom: blocked mixed content
Intended local reference: /assets/site.js
Verify the HTTPS response and its JavaScript content.

Do not group every blocked request together

Mixed content, content security policy, cross-origin restrictions and missing files are different causes. Read the specific Console message and inspect the Network entry before choosing a fix. Adding unrelated access-control headers does not repair an insecure script URL.

HTTPS must actually work

Replacing http with https is only useful when that endpoint serves the expected content securely. Follow any redirects and check the final response. A top-level navigation link to another page is also different from embedding an insecure dependency in the current page.

Keep dependencies deliberate

This site supplies its own runtime assets locally. That reduces reliance on external services, but locally served assets still need correct paths and content types. Do not import an unlicensed asset simply to remove a remote request.

Learn to read the browser’s evidence.

Continue the diagnostic toolkit

All six lessons and three cases · Next: Read the browser’s evidence

A small mistake, explained

What goes wrong

You disable a browser protection to make an old resource work, leaving the deployment problem unresolved.

How to fix it. Use a working HTTPS resource or serve an authorised local copy when its licence allows it. For same-origin assets, an appropriate relative reference uses the page’s scheme. Check the response after editing.

Try it yourself

List the scripts, stylesheets, images and fonts used by a small page you own. Explain which addresses are local and which depend on another host, without pasting private request logs into external services.

Further reading

MDN: Mixed content (new tab)

Original explanation and example prepared for HTML code FYI with AI assistance. Test the code in your own context. How these guides are made.