Scan rule · RSC-SEC-025
Unencrypted assets on an HTTPS page (active / passive)
SecuritySeverity: HighCWE-311
Finds resources embedded via `http://` on an https page and separates active ones (scripts, frames, stylesheets — blocked by the browser) from passive ones (images, audio, video — warning, no block).
Scan tier
External scan (anonymous)
How to fix it
Switch all references to https; active mixed content first, since browsers block it anyway.