网站导入部署SSL证书后,浏览器还是提示不安全,不出现绿色小锁图标;
打开浏览器控制台,显示
Mixed Content: The page at 'https://xxx.com/'' was loaded over HTTPS, but requested an insecure image 'http://xxx.com/uploads/1.png'.
原因:在当前页面中调用了http资源
解决办法:在header中价格Upgrade-Insecure-Requests,让浏览器将本站的所有http连接升级为https连接
添加header方法如下所示:
1、Nginx
Nginx配置:
server {
listen 80;
server_name test;
add_header Content-Security-Policy "upgrade-insecure-requests"
}
2、Apache
在网站根目录下的 .htaccess 文件中定义
Header add Content-Security-Policy upgrade-insecure-requests
3、IIS
在网站根目录下添加