webzod
account

Load scripts, styles and frames over HTTPS on Cloudflare

headers.resources.mixed_active · effort: about an hour

Why it matters

Browsers block http:// scripts, stylesheets and frames on an https page, so parts of the page break, and anything loaded that way could be altered on the network. Every such resource must come from an https:// URL.

The fix

  1. As a stopgap, open SSL/TLS, Edge Certificates and turn on Automatic HTTPS Rewrites. It rewrites http:// links in HTML that Cloudflare knows are available over https; URLs loaded from JavaScript are not rewritten.
  2. Fix the URLs at the source (the CMS, theme or application) so the site does not depend on the rewrite.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.