The HTTPS check: no plain-HTTP addresses on a secure page
Every published Anticode site is served over HTTPS. Mixed content is what happens when a secure page then asks for something over plain HTTP: an image, a stylesheet, a form target. Browsers block or warn about it, and it can undo the protection HTTPS gives. Sentinel runs a mixed content check in the builder, and the server refuses to publish a page that still contains a plain-HTTP address.
Why one http:// matters on an https:// page
HTTPS encrypts the connection between a visitor and the site, so nobody on the same café Wi-Fi can read or alter what's sent. That guarantee covers only what travels over HTTPS. An image fetched over plain HTTP can be swapped in transit; a stylesheet could be altered to restyle the page; a form posting to an http:// address sends the visitor's answers unencrypted for anyone on the network to read.
Browsers know this. They generally block plain-HTTP scripts, stylesheets and frames on a secure page outright, upgrade or block images and media, and warn before sending a form to an insecure address. The visible results are broken images, missing styles, a padlock that disappears, or a warning screen at the worst possible moment: just as someone submits an enquiry.
What each check looks at
| Check | Where it looks |
|---|---|
| Sentinel, in the builder | Any src, href or action attribute whose value starts with http://. Reported as “Every URL uses HTTPS”. |
| The server, at publish | A longer list of URL-bearing attributes, including srcset, poster, formaction, data and background, with each value decoded the way a browser would read it; every entry in a srcset; and url() and @import in styles, both in style elements and inline style attributes. |
The builder's check is quick feedback. The server's is the one that holds, because it runs on what's actually published and can't be skipped by a modified browser. A page that fails is refused with a message naming the element, the attribute and the address it found, for example an image loading a given address over plain HTTP.
Links count too
Strictly, a link to an http:// page isn't mixed content: clicking it leaves your page rather than loading something into it. Both checks still refuse it, and there's a reason. A visitor who follows an insecure link from a secure site loses the protection without being told, and most sites that once used HTTP now redirect to HTTPS anyway. So a mixed content check that also covers links is mostly asking you to write the address the site really uses. Try the https:// version; if the other site genuinely has no HTTPS, consider whether you want to send people there.
Fixing a failure
- Read the address in the failure message.
- Open it with
https://in a new tab. If it loads, change the address in your page. - For images, use the
https://address. Design-engine pages show photos from the curated library, plus an https address in a CMS image field for a collection's entries in its own section and pages; photos you upload are used by app builds. - For a link to a site with no HTTPS at all, decide whether the link is worth keeping.
HTTPS on Anticode sites
Sites on name.anticode.dev and on a connected custom domain are served over HTTPS, with certificates issued automatically for custom domains. Responses from a site also carry a Strict-Transport-Security header, which tells browsers to use HTTPS for that host on future visits even if someone types http://. Design-engine pages load their fonts from Google Fonts and their curated photos from Unsplash's image server, both over HTTPS, so a page fresh from the engine passes. Failures come from addresses added later. For background, read SSL certificates explained.
Limits
- It reads addresses, not destinations. An
https://link to a site with an expired certificate passes; the check doesn't visit it. - Text isn't checked. An
http://address written as plain text in a paragraph isn't a URL attribute and isn't flagged. - Apps are stricter still. App builds can't load anything from other sites at all, so the question rarely arises there; see the app sandbox.
Questions people ask
What is mixed content?
A secure HTTPS page loading something over plain HTTP, such as an image, stylesheet or form target. Browsers block or warn about it because the insecure part can be read or changed in transit.
Why is my image not loading on my HTTPS site?
Often because its address starts with http://, and the browser blocked it. Use the https:// address for the same image.
Does the mixed content check block a plain-HTTP link?
Yes. Both Sentinel and the publish gate treat an http:// href as a failure, so use the site's https:// address.