HTTPS page → HTTP resource
Browsers may block or upgrade insecure subresources. Either way, an explicit HTTP dependency is worth finding and replacing.
Website security
Find obvious HTTP references inside an HTTPS page.
Inspect the bounded HTML response for plaintext resource/link references, insecure form actions and password fields served without HTTPS.
Result
Website security observations
What to review
Read the finding in context.
Form destinations matter
An HTTPS page can still leak submitted data if a form action posts to plaintext HTTP.
Never over plaintext HTTP
A password field on an HTTP page is reported as a serious transport warning.
External script integrity
Missing SRI on a third-party script is shown as an informational supply-chain signal because many dynamic third-party scripts cannot use static SRI hashes.