Security HeadersMixed content: the HTTPS padlock that is lying to your users Your page loads over HTTPS, the padlock shows, everything looks secure. Then one script loads over plain HTTP — and the secure channel you paid for has a hole in it. Oct 5, 2026 · 3 min read