Mixed content

Subresources requested over HTTP from a page loaded over HTTPS, which undermines the guarantees of the secure page. Active content — scripts, stylesheets, frames — is blocked outright, and passive content like images is blocked or upgraded depending on the browser. It shows up most often in legacy content and hard-coded URLs, and the `upgrade-insecure-requests` directive is the blunt fix.