Fix mixed content on an HTTPS page

content-mixed

An HTTPS page that pulls scripts or images over plain HTTP gives an attacker on the network a way in. Serve every subresource over HTTPS.

Your stack

CDN and edge

Cloudflare

Nginx

Next.js WordPress

1 Enable 'Automatic HTTPS Rewrites' in SSL/TLS settings
2 This rewrites http:// URLs to https:// when the resource is available over HTTPS

nginx

add_header Content-Security-Policy "upgrade-insecure-requests" always;

Does your app still have this?