Insecure (http) resources loaded on a secure page
This page is served over https but loads one or more resources over plain http.
Why it matters
This page is served over https but loads one or more resources over plain http. Browsers block active mixed content (scripts, stylesheets, frames) outright, so those features simply break; passive content (images) loads but travels unencrypted, where anyone on the network path can read or replace it. Either way it undermines the https lock. Change each resource URL to https (or a protocol-relative //), which almost every host now supports.
How ShipReady detects it
Passive read of the fetched HTML: subresources loaded over plain http on a page served over https. Page-scoped because different routes embed different resources. No extra requests.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
Your page is served over https but loads one or more resources over plain http. Browsers block active mixed content — scripts, stylesheets, and frames loaded over http are refused, so those features silently break — while passive content like images loads unencrypted and can be read or swapped by anyone on the network. Find each http:// resource URL in your markup and CSS and change it to https:// (nearly every CDN and host serves https today), or to a protocol-relative // so it inherits the page's scheme. If a resource genuinely has no https version, self-host it. A Content-Security-Policy with `upgrade-insecure-requests` is a good backstop, but fixing the URLs is the real fix.
Frequently asked questions
- What does "Insecure (http) resources loaded on a secure page" mean?
- This page is served over https but loads one or more resources over plain http.
- How serious is it?
- ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.