top of page
  • Writer's pictureBrent Payne

Loads page resources using protocol relative URIs

When your webpage includes resources using protocol-relative URLs, it indicates that these resources can be fetched using either HTTP or HTTPS. This could pose a security risk by being vulnerable to certain types of attacks.

Why is this important?

Using protocol relative URLs might have been a widespread practice for supporting both HTTP and HTTPS without specific URL schemes. While it’s a flexible solution, it’s unsafe when such a URL loads over HTTP, opening a window for security breaches such as the well-known Man-on-the-side attack.

What does the Optimization check?

The Optimization checks for any use of protocol relative URIs within the website's internal links to resources like scripts, CSS files, or images, whether they are HTTP or HTTPS.

Examples that trigger this Optimization

The following examples demonstrate the use of protocol relative URIs that would activate this hint:

JavaScript library link:

External CSS stylesheet link:

<link href='//' rel='stylesheet' type='text/css'>

Image source using protocol relative URI:

How do you resolve this issue?

It is advisable to replace all protocol relative URLs with absolute HTTPS URLs, ensuring that all resources are loaded securely. For resources not available over HTTPS, consider hosting the resource yourself, using alternative secure hosts, or omitting the resource if necessary.

Further reading


Recent Posts

See All

ClubReq Gets A Link (Because They Asked)

I am a mentor for Techstars and have been for over 10 years. In those ten years I have mentioned to startups to ask ANYONE and everyone that they meet to link to their site. Yet, in all those times on


bottom of page