Active mixed content
This HTTPS page's HTML loads a script, frame, or form action over HTTP.
Why it matters
Active mixed content can be altered on the network and then runs in the HTTPS origin. Current browsers usually block it, which also breaks the page.
What to do
Serve every script, iframe, and form action over HTTPS. upgrade-insecure-requests in CSP lowers the severity here but is not a substitute for fixing the URLs.
Reference
HTTPS pages must not load scripts, frames, or other subresources over HTTP.