{
  "id": "WEB-074",
  "slug": "web-074",
  "title": "Pages must not load sub-resources over HTTP",
  "statement": "A page must not load sub-resources over, or redirect through, unencrypted HTTP — mixed content fails.",
  "rationale": "Mixed content produces browser warnings on the exact page where a consumer is about to hand over a phone number, which undermines the trust the whole framework is built on. It also frequently signals an unmaintained site.",
  "layer": "WEBSITE",
  "layerSlug": "website",
  "object": "opt-in landing page",
  "severity": "MEDIUM",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "TCR",
    "Twilio"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Serve every asset over https and remove any http:// redirect hop in the chain to the opt-in page.",
  "notes": "Not decidable from a markdown-only fetch — needs the raw HTML and the sub-resource list. Recorded so the crawler gap is visible rather than silently unchecked.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/website/web-074/",
  "markdown": "https://ekas.io/rules/10dlc/website/web-074.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}