Active Mixed Content over HTTPS

This Error occurs when the content is loaded over HTTP within an HTTPS page.

If the HTTPS page includes the content like scripts or stylesheets retrieved through regular, cleartext HTTP, then the connection is only partially encrypted.

There are few technologies to deal with this type of mixed content issues:

1. HTTP Strict Transport Security (HSTS) is a mechanism that enforces secure resource retrieval, even if user does mistakes means try to attemp to access web site on port 80 or any coding errors.

2. Content Security Policy (CSP) can be used to block insecure resource retrieval from third-party web site.

Set htacess Rule as -  

Header set Content-Security-Policy "'self' domain"

HTTP Strict Transport Security (HSTS) Errors and Warnings

The HSTS Errors and Warnings will allow attackers to bypass HSTS. and will allow them to read, modify communication of website.

to fix this error you should consider by adding the domain to the HSTS preload list.

This will ensure that browsers will automatically connect your website by using HTTPS and will prevent users from visiting your website using HTTP.

Set htacess Rule as -  

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

Passive Mixed Content over HTTPS

Passive Mixed Content over HTTPS occurs when a mixed content loaded over HTTP within an HTTPS page.If the HTTPS page includes content retrieved through regular, cleartext HTTP, then the connection is only partially encrypted.

There are two technologies that helps the mixed content issues -

1. Using HTTP Strict Transport Security (HSTS), that enforces secure resource retrieval, even in the face of user mistakes (attempting to access your web site on port 80) and implementation mistake.

Set htacess Rule as -  

Header set Strict-Transport-Security "max-age=10886400; includeSubDomains;"


2. Content Security Policy (CSP) can be used to block insecure resource retrieval from third-party web sites.

Set htacess Rule as -  

Header set Content-Security-Policy "'self' domain.com"