# WEB-074 — Pages must not load sub-resources over HTTP

> A page must not load sub-resources over, or redirect through, unencrypted HTTP — mixed content fails.

- **Rule ID:** WEB-074
- **Layer:** Website (`WEBSITE`)
- **Checks:** `opt-in landing page`
- **Severity:** MEDIUM — Usually survives review, but lowers your trust score or invites manual review.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** TCR, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/website/web-074/

## Why this rule exists

Mixed content produces browser warnings on the exact page where a consumer is about to hand over a phone number, which undermines the trust the whole framework is built on. It also frequently signals an unmaintained site.

## How to fix it

Serve every asset over https and remove any http:// redirect hop in the chain to the opt-in page.

## Notes

Not decidable from a markdown-only fetch — needs the raw HTML and the sub-resource list. Recorded so the crawler gap is visible rather than silently unchecked.