---
title: "Load nothing over plain HTTP · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/mixed-content
updated: 2026-10-20
licence: "All rights reserved"
---

# Load nothing over plain HTTP

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Load every file over HTTPS. Add `upgrade-insecure-requests` as a safety net.
- How: Use root-relative or `https://` addresses for every file. Add `upgrade-insecure-requests` to the CSP on HTTPS.
- Check: `grep -rnE '(src|href|action|srcset)="http://' dist/` finds nothing in the built pages. The browser console shows no mixed-content warnings.

Example:

```html
<!-- Good: root-relative or https -->
<img src="/logo.svg" alt="Example">
<script src="https://cdn.example.com/app.js"></script>
<!-- Bad: plain http on an https page -->
<img src="http://example.com/logo.svg" alt="Example">
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/mixed-content`.

- Previous: [Make browsers always use HTTPS](https://agentwranglers.se/playbook/website/security/hsts)
- Next: [Allow only the scripts you wrote](https://agentwranglers.se/playbook/website/security/content-security-policy)
- [Security](https://agentwranglers.se/playbook/website/security)