---
title: "Plain-HTTP resource (bp/http-url)"
description: "Loading a subresource or browser fetch over http:// from an HTTPS page is mixed content, which the browser blocks or flags (Lighthouse: does not use HTTPS)."
url: http://localhost:4173/rules/bp/http-url
updated: 2026-11-11
---

# Plain-HTTP resource

> `bp/http-url` is a vetd rule. It flags: Plain-HTTP resource. It runs on every `check`, together with the TypeScript check.

| Fact | Value |
| --- | --- |
| Rule id | `bp/http-url` |
| Severity | warning |
| Group | Best practices |
| Tags | security, lighthouse |

## Why it matters

Loading a subresource or browser fetch over http:// from an HTTPS page is mixed content, which the browser blocks or flags (Lighthouse: does not use HTTPS).

## How to fix it

Use an https:// URL.

## Credit

Based on work by:

- [Google Chrome](https://developer.chrome.com/docs/lighthouse/overview): Lighthouse flags resources not served over HTTPS and web.dev explains mixed content.

## References

- [Does not use HTTPS](https://developer.chrome.com/docs/lighthouse/best-practices/is-on-https), Chrome for Developers
- [What is mixed content?](https://web.dev/articles/what-is-mixed-content), web.dev
- [Mixed content](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Mixed_content), MDN Web Docs

## See it

Demos in the vetd Lab:

- [Serve everything over HTTPS](http://localhost:4173/lab/web-standards/https-everywhere)

## Get this text from vetd

MCP: call `explain` with `{ "diagnosticId": "bp/http-url" }`. CLI: `npx vetd explain bp/http-url`.

---

[All 92 rules](http://localhost:4173/rules.md) · Previous: [`bp/passive-listener`](http://localhost:4173/rules/bp/passive-listener.md)