VibeSecurity
Join waitlist

Security check

Mixed content and HTTPS: making every request encrypted

If an HTTPS page loads a script, image or API over plain HTTP, an attacker on the network can tamper with it. Browsers block much of this, but leftovers still cause broken pages and downgrade risks.

By the VibeSecurity team1 min read

Find http:// leftovers

  • Search your code and content for http:// links to your own assets and APIs.
  • Open the browser console on each key page and read mixed-content warnings.
  • Check environment variables such as an API base URL that still points at http.

Enforce HTTPS

Response headers
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Security-Policy: upgrade-insecure-requests

Redirects and cookies

  • Redirect every http:// request to https:// at your host or CDN.
  • Mark cookies Secure so they are never sent over plain HTTP.
  • Add includeSubDomains to HSTS only when all subdomains support HTTPS.

Frequently asked questions

Should I add my site to the HSTS preload list?

Only after HSTS has worked for a while on every subdomain, because removal from the list is slow.

Sources

  1. 1.MDN: Mixed content
  2. 2.MDN: Strict-Transport-Security

Related reading

Security check

SQL injection in AI-generated apps: what it looks like and how to fix it

Where SQL injection hides in code written by AI tools, including string-built queries and filter strings, and the parameterised patterns that remove it.

21 Sep 2026 · 1 min readRead →

Security check

Cross-site scripting (XSS) in React and Next.js apps

How XSS still reaches React apps through raw HTML rendering, unsafe links and stored content, plus the fixes that work.

21 Sep 2026 · 1 min readRead →

Security check

CSRF: when your app needs protection and when it does not

Cross-site request forgery explained for apps that use cookie sessions, with SameSite settings, origin checks and tokens.

21 Sep 2026 · 1 min readRead →