sus.botdocs

Security finding

An HTTPS page loads or posts over HTTP, or a password form sits on an HTTP page

Security Error Severity: High

Part of the audit Mixed content and insecure forms. Finding id: security.mixedContent.

What it costs you

Part of the page travels without encryption although the visitor sees an HTTPS address.

What to do

Load every file and post every form over https://. Serve login pages over HTTPS only.

What it checks

  • Insecure file loaded on a secure page
  • Form sends data over an insecure connection
  • Password field on an insecure page

How to fix it

Load the file over https

  1. Change [target] to https:// where it is written. If the other server has no HTTPS, copy the file to your own site.
  2. Until then, the header Content-Security-Policy: upgrade-insecure-requests (next solution) makes browsers ask for the https:// address of each file. It only helps if the file exists there. If the site already sends a Content-Security-Policy, add the directive to that policy instead of a second header.

How to check: Open [page url] with the browser console open: no mixed content message. Recrawl.

Fix

    Post the form over https

    1. Change the action attribute to an https:// address. If the receiving server has no HTTPS, give it a certificate first.

    How to check: View the source of [page url]: the action of the form starts with https://.

    Serve the login page over HTTPS

    1. Serve [page url] over HTTPS and make its HTTP address answer with a redirect.
    2. security.httpsEnforcement gives the redirect for your server.

    How to check: Open [page url] with the browser console open: no mixed content message. Recrawl.