HTTPS, TLS and mixed content explained

HTTPS is HTTP carried over TLS, the protocol that encrypts traffic between the browser and your server. It protects confidentiality (no one on the network can read the traffic), integrity (no one can modify it in flight), and authenticity (the browser verifies it's really your server). It's a baseline expectation — browsers mark plain HTTP as "Not secure" and many features refuse to run without it.

Support modern TLS, retire the old

Serve TLS 1.2 and 1.3; disable TLS 1.0 and 1.1, which are deprecated and vulnerable. TLS 1.3 is faster and drops legacy cipher suites. Most managed platforms handle this for you — the job is to confirm the old versions are actually off.

Mixed content breaks the padlock

If an HTTPS page loads a script, stylesheet or image over plain http://, that resource can be tampered with — so the page isn't really secure. Browsers block "active" mixed content (scripts, iframes) outright and flag the rest.

<!-- Mixed content on an HTTPS page -->
<script src="http://cdn.example.com/app.js"></script>

<!-- Fix: use https (or a protocol-relative same-scheme URL) -->
<script src="https://cdn.example.com/app.js"></script>

Lock it in with HSTS

Once your whole site is reliably HTTPS, Strict-Transport-Security stops the browser ever trying http again (see the security-headers guide). This removes the initial insecure request an attacker could hijack.

How to fix it

1. Serve the whole site over HTTPS and redirect http to https.
2. Disable TLS 1.0/1.1; keep 1.2 and 1.3.
3. Find and fix any http:// subresources on https pages.
4. Add HSTS once everything is stable, then re-scan.