SEC-022
HTTPS page loads insecure http:// resources
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Scripts, styles, images, iframes and form actions referenced over http:// on an HTTPS page.
Why it matters
Browsers block or warn on mixed content, breaking features, and insecure scripts can be tampered with.
Recommended fix
Load every resource over https:// (or a relative URL).
How to verify
Reload with DevTools open and confirm there are no mixed-content warnings in the console.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-022: HTTPS page loads insecure http:// resources
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Replace every http:// resource URL listed in the evidence with its https:// version (or a relative path), including scripts, stylesheets, images, iframes and form actions.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Reload with DevTools open and confirm there are no mixed-content warnings in the console.