CSP upgrade-insecure-requests

Rewrites http:// subresource requests to https:// before they are made.

Falls back to

nothing — must be set explicitly

Group

Reporting and hardening

Detail

A migration aid for sites with hardcoded http URLs in old content. It fixes mixed-content warnings without editing the content, but it is a patch rather than a fix — the underlying URLs are still wrong, and anything not covered by the browser rewrite still breaks.

Example

Analyse a full policy → · Generate one →