In doing some research regarding SSL, I came across this topic. One of the common suggestions was not to serve content over HTTP. What does that mean from a website development POV? Referencing things like stylesheets with a full https URL? Something else?
It means to always use the SSL layer when serving pages. Links don't need to be absolute, but traffic received on port 80 without SSL should be redirected to port 443 with SSL. The rest of the magic is in avoiding attacks where the user doesn't visit the SSL site first and the redirect is hijacked using something like SSLstrip. That is covered in this question: Options when defending against SSLstrip?
It means that all content and resources should be served over HTTPS (not HTTP). Local scripts, stylesheets, and images should be referenced with a URL that will ultimately load the resource over HTTPS, not HTTP.
One way to achieve this is to make sure that all URLs are absolute and fully qualified, and start with https:.
Alternatively, you can continue to use relative URLs, as long as you verify they will ultimately resolve to a https: URL.
For example, suppose you have a page
I hope this makes sense.