Mixed Content Issue with YouTube Plugin in WeWeb

We’ve identified a mixed content issue on our WeWeb site related to the YouTube iframe API plugin, which is loading resources over http instead of https . This is causing mixed content warnings in browsers and potentially affecting our site’s SEO and security. Since the plugin’s code appears to be hardcoded to use http , we’re unable to manually switch to https .

Is there a way to update the plugin to ensure it loads resources over https by default, or is there an alternative solution to prevent these mixed content warnings?

Any assistance to address this issue and enhance our site’s security and SEO performance would be greatly appreciated.

Hi @RianTavaresDev :wave:

Can you clarify where you are seeing this?

Just checked a project that is using the YouTube video extension and I don’t seem to be having the issue but I may be looking in the wrong place!

Hello @RianTavaresDev!
We use a library to manage YouTube. So we don’t really control how the iframe is loaded.
However, I went to look at the library code to see if there was a way to fix it and I came across this code:

I don’t know if you know much about JS, but this code says:

If window.location.protocol = http => iframe protocol = http
otherwise iframe protocol = https

It seems the iframe protocol follows your page’s protocol. What protocol does your page use?

Hi, @Joyce
Thank you for your support.
The mixed content is related to the script of youtube iframe api insertion on the page as you can see on the screenshot I sent on the issue description.

Hi @Kevin,
Thank you for your support.
I’m proficient in JS, but thank you for your explanation .
This is weird then, because my page is running with https protocol :thinking:

Weird, I’ve reported the problem so that we can investigate further!

1 Like

Hi @RianTavaresDev :wave:

We pushed a fix in production. When you get a chance, can you republish your app and let us know if that resolves your issue?

1 Like

Screenshot 2024-04-15 at 1.16.38 PM
Hi @Joyce :wave:

Everything looks good!
I’ve republished the app and now the script insert is using the correct protocol. Thank you and the team for the fix!

1 Like

Awesome! Thank you for flagging it :slight_smile: