Web security
No mixed content on HTTPS pages
Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.
Why it matters
A script or style loaded over HTTP can be replaced by anyone on the network path - public Wi-Fi, a compromised router - and then controls the page. Browsers block such content, so parts of the page may already be broken for visitors.
How to fix it
Moderate · a few hours- Change every http:// resource URL in templates and content to https:// (or a relative URL).
- For content you cannot edit quickly, add the CSP directive upgrade-insecure-requests.
- Re-run the scan to confirm.
nginx
add_header Content-Security-Policy "upgrade-insecure-requests" always;
WordPress (WP-CLI)
wp search-replace 'http://example.com' 'https://example.com' --dry-run
How we test it
The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.
Does your domain pass this check?
Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.
Scan your domain free