Stop 5 of 42 · The Front Door · Mixed content

The armored truck with one unlocked leg

The bank sends its pages in locked armored trucks (HTTPS). But the page also says “fetch one parcel from this address,” and that address uses a plain, unlocked van (HTTP). Anyone watching the open road can open the van and swap what is inside. Modern browsers now turn such vans away at the door, but older ones don’t, so the bank shouldn’t depend on that.

The Front DoorSources checked 25 Oct 2026

Watch it happen

Play it as

A secure page asks for a script over plain HTTP. Where the browser lets it load (modern ones block it), Mallory on the open road swaps it and Alice’s browser runs it.

Arrival

Alice opens the bank’s page. It arrives in a locked armored truck (HTTPS), so nobody on the road can look inside.

1 / 5

In bank terms and app terms

In the bankIn your app
Locked armored truckAn HTTPS connection (encrypted and tamper-proof)
Unlocked vanA resource loaded over plain http:// (readable and changeable)
Mallory on the open roadAnyone on the same network path, like public Wi-Fi
Swapped parcelA modified script, stylesheet, image or API response

Are you exposed?

You might be exposed if…
  • Your HTML, CSS or JS contains hard-coded http:// URLs for scripts, images, fonts or API calls.
  • The browser console shows a “Mixed Content” warning or error for an http:// resource on your https:// page.
  • You copied an old embed snippet or CDN link that starts with http://.
What to do about it
  1. Change every http:// resource URL to https://, or use relative paths on your own domain like /img/logo.png.
  2. Add Strict-Transport-Security and consider the CSP directive upgrade-insecure-requests.
  3. Check the browser console on each key page and fix any mixed content warnings before you ship.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Search this codebase, including HTML, CSS, JS/TS, env files and config, for any resource or API URL that starts with http://. Replace each with https:// or a relative path. If a third-party host does not support HTTPS, tell me and suggest an alternative. Then add the Strict-Transport-Security header and the CSP directive upgrade-insecure-requests.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.