Mixed Content (HTTP Resources on HTTPS): How to Fix It
Send a valid X-Frame-Options header (use SAMEORIGIN, or DENY if your pages are never framed) and…
Add a Strict-Transport-Security response header to force every browser onto HTTPS, starting with a short max-age,…
A password field on a plain HTTP page means login details can be read off the…
The Content-Security-Policy (CSP) HTTP response header tells browsers which sources of scripts, styles, and other content…
Mixed content happens when an HTTPS page loads sub-resources over plain HTTP, so fix it by…
Add a single response header, X-Content-Type-Options: nosniff, so browsers trust your declared MIME types instead of…
Get new blog posts by email:
Technical SEO consulting and GEO strategy for teams who need real implementation support. 20 years of enterprise experience across major media, technology, recruitment, and ecommerce brands, and a major enterprise brand. Case studies, research, and resources for search and AI visibility.