> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mixing of secure and insecure content on a web page

> Learn how to resolve an issue that occurs when your visitors request a secure page on your web site that contains insecure elements.

This article describes an issue that occurs when visitors to your web site request a secure web page that contains insecure elements. It also provides several methods for resolving this issue.

## Problem

When visitors to your web site request a page using a secure *https\://* connection, a broken padlock icon may appear in the web browser's location bar. Additionally, they may receive a warning message in their browser:

* **Mozilla Firefox** displays: "The connection to this website is not fully secure because it contains unencrypted elements (such as images)."

* **Google Chrome** displays: "Your connection to *example.com* is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the look of the page."

* **Microsoft Internet Explorer** displays: "Do you want to view only the webpage content that was delivered securely? This webpage contains content that will not be delivered using a secure HTTPS connection, which could compromise the security of the entire webpage."

## Cause

This problem occurs because a web page contains hyperlinks to insecure elements. For example, consider a web page that contains the following HTML snippet:

```
<a href="http://www.example.com/images/picture.jpg">View my picture</a>
```

In this HTML snippet, the hyperlink references a non-secure *http\://* resource (a .jpg file). If a user requests this page using an *https\://* connection, the page itself is encrypted, but the hyperlinked image file is not. As a result, the page contains secure and insecure content, and the browser displays a warning message to the user.

This problem can occur with any type of hyperlinked resource file: a JavaScript library, a CSS file, etc.

## Resolution

There are a few ways you can resolve this problem:

### Method #1: Send a Content-Security-Policy response header directly from the web server

To resolve this problem, you can send a **Content-Security-Policy** HTTP response header. This header instructs web browsers to upgrade insecure requests to HTTPS.

For **Apache web servers** on Linux, add the following lines to the *.htaccess* file (or files) that you use for your website:

```
<IfModule mod_headers.c>
    Header always set Content-Security-Policy "upgrade-insecure-requests;"
</IfModule>
```

### Method #2: Send a Content-Security-Policy directive from page source files

Alternatively, you can use the following **meta** tag in the source files of your site pages:

```
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
```

## More information

For more information about the **upgrade-insecure-requests** directive, please visit [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests).

## Related articles

* [Redirecting visitors to SSL connections](/docs/redirecting-users-to-ssl-connections)