Insecure contents
Why is this an issue?
Loading resources over insecure protocols such as HTTP or FTP instead of HTTPS creates security vulnerabilities:
Man-in-the-middle attacks: Unencrypted traffic can be intercepted and modified
Mixed content warnings: Browsers may block or warn about insecure content on HTTPS pages
Data exposure: Sensitive information in requests/responses can be captured
All external resources should be loaded over HTTPS rather than HTTP or FTP.
Examples
Example of incorrect code:
<script src="http://cdn.example.com/library.js"></script>
<link href="http://cdn.example.com/styles.css" rel="stylesheet"/>
<img src="http://example.com/image.png"/>
Example of correct code:
<script src="https://cdn.example.com/library.js"></script>
<link href="https://cdn.example.com/styles.css" rel="stylesheet"/>
<img src="https://example.com/image.png"/>
How can I fix violations?
Change HTTP to HTTPS: Update all resource URLs to use HTTPS.
Use static resources: Host resources as Salesforce static resources.
Resources