mackzwellz

Well, in certain cirumstances (site with Cloudflare Flexible SSL + HTTPS Rewrites and no own server SSL) data-src and <nosript> img src attribute URLs aren’t replaced, and on image load page turns into mixed SSL.
Oh, and reviewing the code a bit more, I came up with a better place to put this string:

* Replace images with placeholders in the content

...

// Strip protocol scheme from src and data-src
$replace = str_replace(['http:', 'https:'], '', $replace);

$content = str_replace( $search, $replace, $content );

I’d suggest making it a checkbox option, or let users even choose – strip both HTTP and HTTPS, replace HTTP with HTTPS or do nothing. Or maybe you could make the plugin choose automatically (i.e. check site adress protocol scheme in wp options) – and make it a fourth option! (alright, this might be a bit over the top). Either way, the best practice right now is to always use HTTPS, but not everyone may be using it still obviously.