Support » Everything else WordPress » Loads page resources using protocol relative URIs

  • I use a site check tool that is flagging up prefetch code and saying it’s not happy.

    Loading a resource using protocol relative URIs allow it to be requested over HTTP and opens the door for Man-on-the-side attacks. If a resource is available over SSL, then always use the https:// URI.

    Example link below, others are fonts.googleapis.com and WordPress calls

    <link rel='dns-prefetch' href='//www.google.com' />

    IS it possible to stop the tool complaining by amending the example link above, to this

    <link rel='dns-prefetch' href='https//www.google.com' /> That is, Add https to the path?

    I can’t pin down where this is inserted, the theme provider says Not me. I can’t track this down, can anyone suggest anything?

Viewing 4 replies - 1 through 4 (of 4 total)
  • Howdy @robmcp This looks like a theme or plugin handles some of the content in the <head> part of your website’s pages. To chnge how that is output you need to see where the problematic code is coming from. If you are sure the theme is not doing it, then you could try disabling plugins and enabling them one by one to pinpoint where the <link> element is coming from.

    Thread Starter robmcp

    (@robmcp)

    Will try disabling plug ins next (slow process, lots of plug ins) just wondered – as a shortcut, if anyone else had come up against this. If/When I find it, I will post here.

    Thread Starter robmcp

    (@robmcp)

    Running in safe mode turned off one, this one
    <link rel='dns-prefetch' href='//www.google.com' />

    the fonts.googleapis and s w org are still visible in source view.

    Disabled child theme, and main theme, turned on 2020, the googleapis and s w org are still there.

    I must consider that this is core WP if all plugins/child theme / main theme are off.
    Any other suggestions from anyone?

    Thread Starter robmcp

    (@robmcp)

    Update this code will remove the link rel calls

    // Remove dns-prefetch Link from WordPress Head (Frontend)
    remove_action( 'wp_head', 'wp_resource_hints', 2 );

    However if it is there, surely it’s there for a reason and I would rather add https to the URL somehow.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Loads page resources using protocol relative URIs’ is closed to new replies.