2

In the administration of advanced iframe I came across following:

"Please do not use a different protocol for the iframe: Do not mix HTTP and HTTPS if possible!".

Please explain the below points.

  • If the protocol of my page is HTTP than use an HTTP page inside the iframe.
  • If the protocol of my page is HTTPS than use an HTTPS page inside the iframe.
Improve this question
2

1 Answer 1

Reset to default
2

[HTTP on HTTPS]By mixing http with https you'll endup with mixed content in your site(in websites) hence the green code in your site that indicates your site is secure will be replaced with a site-is-insecure for that specific page that contains a http call.

Its insecure because generally you'll be serving content on a secure protocol via an insecure tunnel(info on that page can be accessed via a HTTP link) . Anyone with a little know how of how things work on the web can easily intercept the data and even maybe rewrite it for his/her/its own benefits. Imagine if for example Google was serving its services via HTTP, think of how many phishing grounds that would create(hackers trying to get sensitive data), users would no longer be able to know which is the actual secure site and they would end up loosing if not all at least a third of its customers.

Improve this answer
2
  • Welcome to the site! Could you elaborate on why it is insecure? That the status changes from secure to insecure when you mix content is probably clear to anyone who has tried this.
    – Luc
    Feb 27, 2020 at 13:14
  • Additionally, if you attempt to call insecure sites within an iframe, where the iframe is on a secure page, web browsers often will not permit the pages to load.
    – Jeff Clayton
    Feb 28, 2020 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .