When I serve all website content from same domain (https://example.com), tools like pingdom keeps yelling:

Serve static content from a cookieless domain

When I serve static content from cookie-less domain (http://cdn.example.com), Chrome says:

Mixed Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure image 'http://cdn.example.com/img/xyz.jpg'. This content should also be served over HTTPS.

How can I satisfy both conditions at the same time?

1 Answer 1


When I serve static content from cookie-less domain (http://cdn.example.com)

Just as the message says... Your "cookie-less domain" also needs to be HTTPS. eg. https://cdn.example.com.

Once you switch to HTTPS then everything must switch to HTTPS. It's all or nothing. This is for a reason... If you have resources on a non-secure HTTP connection then it is possible that "information" could be leaked over this non-secure connection and intercepted, which kind of defeats the point of having HTTPS in the first place.

  • so what does the Serve static content from a cookieless domain mean?
    – notnull
    Apr 9, 2017 at 20:47
  • By using a different host/domain to serve your static content then the "marginal" overhead of the browser unnecessarily responding to and sending Cookie: headers (that are associated with your main site) is avoided. However, bear in mind, that you can't use a subdomain like cdn.example.com as a cookie-less domain, if you are using the apex domain (eg. example.com) for you main site. You would need to use www.example.com (for example). (One of the advantages of www over non-www.)
    – MrWhite
    Apr 9, 2017 at 20:55
  • So, if I served static content from different domain like mysupercdn.net, then the mixed content warning would disappear?
    – notnull
    Apr 9, 2017 at 20:59
  • Yes, providing it is https://mysupercdn.net (note the HTTPS). The Mixed content warning is because you have both HTTPS (secure) and HTTP (non-secure) content on the same page.
    – MrWhite
    Apr 9, 2017 at 21:01
  • Ah, so I think I got the point now. It's not a matter of HTTP vs HTTPS, it must be always HTTPS, just not setting cookies for static content requests. So I need the domain just because I am using https for *.example.com, therefore there are cookies being set for every subdomain. Is that right?
    – notnull
    Apr 9, 2017 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.