Why are HTTPS sites red instead of black?

[FranL]

When I visit pages at https://stackoverflow.com/, I see this in the NoScript popup:



I (perhaps incorrectly) expected the ...stackoverflow.com to be black. It changes to black when I lock the Match HTTPS content only, which makes sense. Does a red domain name marked TRUSTED mean NoScript allows both HTTP and HTTPS accesses to that domain — so the red color is kind of a warning that both secure and insecure accesses are allowed?

If so, should I always lock the HTTPS lock in this case, given that the page only uses HTTPS to access ...stackoverflow.com?

[barbaz]

Not seeing this in a clean profile. Most likely you simply already had those permissions set for over both HTTP and HTTPS.

[FranL]

I toggled the domain to UNTRUSTED, reloaded the page, then set it back to TRUSTED, and reloaded again — it looks correct now:



NoScript also seems to default to the green lock on TRUSTED domains accessed via HTTPS, which is nice. Thanks, barbaz.

[darby]

Been toggling the sites having this issue as well. Works most of the time.