I'm researching the HTTPS-strict-transport-security protocol (HSTS), and am writing a plugin for Firefox to highlight some of the issues with the protocol. One of the things that I'm looking at is mixed content.

If the site is using HSTS, and the page contains a link to another page on the same site but over HTTP (a mixed content link), then surly this isn't an issue, as the site when retrieving the content will do so over HTTPS, and not HTTP?

Clarification would be good!

2 Answers 2


Only if the mixed content is on the same domain.

If the HSTS policy is on https://example.com and this loads an image from http://example.org then mixed content will show.

If however, the plain HTTP image is loaded from http://example.com then the browser will upgrade the HTTP connection to HTTPS so there will not be mixed content on the page.

  • In your first example, would this result in completely denying the visit due to it not being fully secure?
    – Tim Malone
    Oct 28, 2016 at 21:27
  • No, an image isn't "active" content like eg. script. The browser will warn about mixed content but will still show the page and the image. Oct 28, 2016 at 21:30
  • Thanks. And in the case of active content, it would just refuse to load that content?
    – Tim Malone
    Oct 28, 2016 at 22:02


1) Your browser supports HSTS

2) You load a page at https://www.example.com/ in the browser

3) The page at https://www.example.com/ contains a valid HSTS Strict-Transport-Security header


Any subsequent request to www.example.com will be done over HTTPS, as per the HSTS Strict-Transport-Security header.

So, if the page at https://www.example.com/ contains a reference to some resource at http://www.example.com/someresource, then the browser will request the resource at www.example.com/someresource via HTTPS instead of HTTP, as per the HSTS Strict-Transport-Security header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .