Why it matters
Insecure scripts can be swapped in transit, and browsers block them outright, which breaks things in ways that are hard to debug. Insecure images trigger warnings that make the site look neglected.
How Patch checks
We record every request and every src or href in your pages that uses http:// while the page itself is on https://.
How to fix it
- Change these to https:// (most hosts support it).
- If a resource has no https version, host a copy yourself.
- Optionally add upgrade-insecure-requests to your CSP as a safety net.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.