1

I've got a website using third-party JavaScript scripts, from Google AdSense (to show ads), Google Analytics (to track visits), Google Maps (to show maps) or Facebook (to allow users leave comments).

I'm trying to implement HTTPS, but I've noticed that my pages, which now are SSL secured, include these not-SSL scripts. So, web browsers like Chrome are showing the "This page is trying to load scripts from unauthenticated sources" message and avoiding users to see the contents of these scripts, so AdSense ads are not being shown.

I wondered if the solution is as easy as changing the URL of the scripts, from 'http' to 'https', or you guys have used another smarter solution.

Thank you very much in advance.

Improve this question
1
  • 2
    Without knowing the specifics in this case it is usually suficient to switch to using their https address instead.. if that is available. Normally you can use "//www.example.com" to get https whenever that is available. – Kristian Svensson Sep 16 '17 at 13:16
3

You can try this:-

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests" />

Or

<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content" />

Paste it in <head>...</head> tags.

The HTTP Content-Security-Policy (CSP) block-all-mixed-content directive prevents loading any assets using HTTP when the page is loaded using HTTPS.

All mixed content resource requests are blocked, including both active and passive mixed content. This also applies to <iframe> documents, ensuring the entire page is mixed content free.

The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and If the former is set, the latter is effectively a no-op. It is recommended to set one directive or the other – not both.

Improve this answer
1
  • I guess it is a decision: Load a page and have a security warning because there is mixed content or load the page with a secure connection but drop http content...which may cause the page to break completely. I know which I would prefer – Steve Sep 16 '17 at 23:07
0

Google could be alerting you to its own links.

Check (using f12 in chrome) and see what the problem is. I found that it was googleapis.

Mixed Content: The page at https://example.co.uk/ was loaded over HTTPS, but requested an insecure style sheet http://fonts.googleapis.com/css?family=Raleway|Open+Sans|Coming+Soon. This request has been blocked; the content must be served over HTTPS.

Improve this answer
1
  • What is your solution to this problem? Just remove the link to the stylesheet? – Stephen Ostermiller♦ Aug 10 '18 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.