HSTS and mixed content

Account for every resource in an HTTPS page.

UnderstandStudy an examplePractise

Understand the concept

Loading HTTP resources from an HTTPS page creates mixed content. Depending on resource type and browser policy, requests may be blocked or upgraded; do not rely on accidental success. Review scripts, API calls, images and WebSockets, not just the page redirect.

HSTS learned through secure responses directs future HTTPS use. Preloading is a separate first-connection mechanism. includeSubDomains affects all subdomains, so premature rollout can break services. Long lifetimes and preloading need an operational plan.

HSTS neither repairs certificates nor fixes application flaws. Insecurely delivered policy is not a trusted update. Audit old links, cookies and connection paths during migration.

WHEN TO USE IT

Avoid browser failures during HTTPS migration.

COMMON PITFALL

Enabling subdomain enforcement and preloading without readiness checks.

01 / PRACTICE

One topic. Three levels of depth.

HTTP / illustrative example

Page: https://example.test
API: http://api.example.test

This can create mixed content.

This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.

02 / YOUR TURN

Try it yourself first.

Does HSTS make an expired certificate acceptable?

Show the solution and explanation

Worked solution

HSTS ≠ certificate repair

No; HTTPS enforcement and certificate validity are separate.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.