Page loads scripts or styles over plain HTTP

ExplainWhat it is

Mixed content is an HTTPS page that loads part of itself over plain http://. PL-034 covers the parts that can take over the page: <script src="http://…"> and stylesheets (<link rel="stylesheet" href="http://…">). Whoever controls the network can replace that file, and a replaced script runs with full access to your page, including the signed-in session.

Modern browsers block these loads outright, so in practice the usual symptom is a broken feature: a widget, a font or an analytics tag that silently never loads, with a “Mixed Content” error in the console.

CauseWhy AI builders produce it

An old embed snippet copied from a provider’s documentation, a CDN URL written with http://, or a template from years ago. A generator pastes what it was given, and local development over http://localhost raises no error.

ObserveWhat we see

A synthetic example for app.example.com, shortened. Not taken from any real site.

<!-- index.html (vulnerable) -->
<link rel="stylesheet" href="http://cdn.example.net/widget/1.4/widget.css">
<script src="http://cdn.example.net/widget/1.4/widget.js"></script>

CheckCheck it yourself

# script and stylesheet URLs that start with http://
curl -s https://your-app.com | grep -oiE '<(script|link)[^>]+(src|href)="http://[^"]+"'

Scripts your bundle adds at runtime don’t appear in the HTML. Open the site in the browser with DevTools → Console: every blocked load is listed as “Mixed Content” with its URL.

FixThe fix

Change each URL to https://; nearly every provider serves the same file over HTTPS. Better still, install the library from npm so it ships inside your own bundle. Then add upgrade-insecure-requests as a safety net: it tells the browser to fetch any leftover http:// subresource over HTTPS instead.

<!-- index.html (fixed) -->
<link rel="stylesheet" href="https://cdn.example.net/widget/1.4/widget.css">
<script src="https://cdn.example.net/widget/1.4/widget.js"></script>

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Content-Security-Policy", "value": "upgrade-insecure-requests" }
      ]
    }
  ]
}

# public/_headers  (Vite copies public/ into the publish folder)
/*
  Content-Security-Policy: upgrade-insecure-requests

<!-- index.html, inside <head> -->
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Live posture findings come with the header or setting to change. PatchLabs never changes your hosting or your repo.

ProveHow PatchLabs finds it

[LOAD]    https://app.example.com/ → 200
          <script src="http://cdn…">    FLAG
          1 script, 1 stylesheet

Live posture reads the HTML of your home page from its one page load and lists <script> and stylesheet URLs that start with http://. It doesn’t download those files, run the page’s JavaScript or look at other pages, so scripts your app adds later are not seen: the console check above covers them.

IntentWhen the pattern is intended

Never for scripts or styles on an HTTPS page. Plain-HTTP images are a smaller problem and are not part of this finding, but fix them while you are there.

RateWhy it’s rated medium

Medium: a replaced script is a full takeover of the page, but it needs someone on the network path, and current browsers block most of these loads anyway. 15 points in the Live posture grade.

See alsoRelated findings

Guides

• Security headers for AI-built apps (Lovable, Bolt, Vercel, Netlify)

Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.