Why it matters
Your page is on HTTPS but pulls in scripts or styles over plain HTTP, which can be swapped in transit. Browsers often block them, so parts of your site may silently break.
How to check it yourself
Open DevTools Console on your site and look for 'Mixed Content' warnings, or search your page source for src="http:// and href="http://.
What the fix involves
Change every http:// script, stylesheet and iframe URL to https://, or self-host the file if the other site has no HTTPS. Adding upgrade-insecure-requests to your CSP catches stragglers.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.