Agent Wranglers

Security Recommended

Load nothing over plain HTTP

Load every file over HTTPS. Add upgrade-insecure-requests as a safety net.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Use root-relative or https:// addresses for every file. Add upgrade-insecure-requests to the CSP on HTTPS.

Example

<!-- Good: root-relative or https -->
<img src="/logo.svg" alt="Example">
<script src="https://cdn.example.com/app.js"></script>
<!-- Bad: plain http on an https page -->
<img src="http://example.com/logo.svg" alt="Example">

How to check

grep -rnE '(src|href|action|srcset)="http://' dist/ finds nothing in the built pages. The browser console shows no mixed-content warnings.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/mixed-content.