Comparison
HSTSvsMixed content
HSTS
typing the bare hostname went straight to HTTPS with no HTTP request made at all.
A header telling the browser to use HTTPS for this host for a given duration, removing the initial insecure request that a redirect still allows. It closes the window where a downgrade attack can happen on the first connection. It is genuinely hard to undo: a long max-age, and especially preload list inclusion, commits every subdomain to HTTPS for as long as browsers remember it.
Full entry →Mixed content
the HTTPS page tried to load an image over HTTP and the browser blocked it silently.
Subresources requested over HTTP from a page loaded over HTTPS, which undermines the guarantees of the secure page. Active content — scripts, stylesheets, frames — is blocked outright, and passive content like images is blocked or upgraded depending on the browser. It shows up most often in legacy content and hard-coded URLs, and the `upgrade-insecure-requests` directive is the blunt fix.
Full entry →