Laravel
← Back to all checks

Security

Mixed content

Finds pages served over HTTPS that still load images, scripts or styles over plain HTTP. Browsers block or flag these, breaking the page or the padlock.

How it works

Once a day, we crawl your site and look for pages served over HTTPS that load resources over plain HTTP: images, scripts, stylesheets, iframes, video and audio.

Browsers block insecure scripts, styles and frames, which breaks the page, and they show a warning instead of the padlock for insecure images. The report lists every insecure resource and the page it was found on.

Settings

Setting Default What it does
Ignore — URL patterns to skip, one per line. * matches anything, e.g. /blog/archive/*.

Statuses

Status Meaning
OK No insecure resources were found.
Failed Pages load insecure resources.

By default you are notified of warnings and failures.

Fixing common problems

  • Hard-coded http:// URLs: change them to https://, or to relative URLs. In a CMS, search the database for http://yourdomain and replace it.
  • Third-party resources: load them over HTTPS. If a provider does not support HTTPS, replace it.
  • A safety net: the Content-Security-Policy: upgrade-insecure-requests header asks browsers to load every resource over HTTPS.