Checks · TLS-004

TLS-004 · Mixed content

Why it matters

An HTTPS page that loads scripts or images over HTTP weakens the page.

How we detect it

The HTML references http:// assets.

How we fix it

Change those URLs to https://.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP