InformAction Forums

When I visit pages at https://stackoverflow.com/, I see this in the NoScript popup:



I (perhaps incorrectly) expected the ...stackoverflow.com to be black. It changes to black when I lock the Match HTTPS content only, which makes sense. Does a red domain name marked TRUSTED mean NoScript allows both HTTP and HTTPS accesses to that domain — so the red color is kind of a warning that both secure and insecure accesses are allowed?

If so, should I always lock the HTTPS lock in this case, given that the page only uses HTTPS to access ...stackoverflow.com?

Not seeing this in a clean profile. Most likely you simply already had those permissions set for over both HTTP and HTTPS.

I toggled the domain to UNTRUSTED, reloaded the page, then set it back to TRUSTED, and reloaded again — it looks correct now:



NoScript also seems to default to the green lock on TRUSTED domains accessed via HTTPS, which is nice. Thanks, barbaz.

Been toggling the sites having this issue as well. Works most of the time.