Unencrypted assets on an HTTPS page (active / passive)
Scan rule · RSC-SEC-025
- Security
- Severity: High
- CWE-311
Finds resources embedded via `http://` on an https page and separates active ones (scripts, frames, stylesheets — blocked by the browser) from passive ones (images, audio, video — warning, no block).
Scan tier
- External scan (anonymous)
How to fix it
Switch all references to https; active mixed content first, since browsers block it anyway.