A header that can mitigate mixed content.
WHAT IT DOES
Adding upgrade-insecure-requests to a Content-Security-Policy header tells the browser to request http resources over https instead.
ADDING IT
In .htaccess:
Header always set Content-Security-Policy "upgrade-insecure-requests"
WHAT IT FIXES
Mixed content where the resource is available over https but the reference says http. The browser silently upgrades the request.
WHAT IT DOES NOT FIX
Resources genuinely unavailable over https. Those still fail. The underlying incorrect data in your database.
WHY IT IS A MITIGATION, NOT A SOLUTION
Your content still contains wrong URLs. If you later move the site, or a tool reads the database directly, the wrong URLs are still there.
Use it as a safety net after doing the search and replace properly, not instead of it.
A CAUTION
Content-Security-Policy is a powerful header with many other directives, some of which can break a site if set carelessly. Adding only this directive is low risk; adding more needs testing.
